@the-ai-company/cbio-node-runtime 1.7.0 → 1.11.0

package/README.md

@@ -48,10 +48,11 @@ import {
   createOwnerHttpFlowBoundary,
   createStandardAcquireBoundary,
   createStandardDispatchBoundary,
-  createOwnerClient,
+  createVaultClient,
   createAgentClient,
   FsStorageProvider,
   LocalVaultTransport,
+  LocalSigner,
 } from '@the-ai-company/cbio-node-runtime';
 ```
 
@@ -61,6 +62,15 @@ Identity restore example:
 const identity = restoreIdentity(existingPrivateKey);
 ```
 
+Child identity example:
+
+```ts
+const rootIdentity = createIdentity({ nickname: 'root' });
+const childIdentity = createIdentity(rootIdentity, {
+  nickname: 'worker-1',
+});
+```
+
 ## Architecture
 
 Core terms:
@@ -76,7 +86,8 @@ Important role rule:
 
 - outside the vault there are only identities
 - inside a specific vault, those identities may be bound to roles such as `owner` or `agent`
-- identities are independent; they do not imply parent/child lineage or inheritance by default
+- root identities are independent
+- child identities may be deterministically derived from a parent identity
 
 The public runtime surface follows four hard rules:
 
@@ -143,7 +154,7 @@ This package now exposes the production local vault runtime surface as the prima
 const ownerIdentity = createIdentity({ nickname: 'owner-main' });
 const agentIdentity = createIdentity({ nickname: 'agent-worker' });
 const vault = createVaultService(createDefaultVaultCoreDependencies());
-const owner = createOwnerClient({ ownerId: ownerIdentity.identityId }, vault, new LocalSigner(ownerIdentity), clock);
+const client = createVaultClient({ identityId: ownerIdentity.identityId }, vault, new LocalSigner(ownerIdentity), clock);
 const transport = new LocalVaultTransport(vault, capability.capabilityId);
 const agent = createAgentClient({ agentId: agentIdentity.identityId }, capability, new LocalSigner(agentIdentity), transport, clock);
 ```
@@ -162,13 +173,13 @@ const capability = {
   issuedAt: new Date().toISOString(),
 };
 
-await owner.registerCapability({ capability });
+await client.grantCapability({ capability });
 ```
 
 Custom flow example:
 
 ```ts
-await owner.registerCustomFlow({
+await client.registerFlow({
   flowId: 'custom-status-read',
   ...createOwnerHttpFlowBoundary({
     mode: 'send_secret',
@@ -199,7 +210,7 @@ const acquired = await vault.acquireSecret({
 console.log(acquired.responseShape);
 // { token_type: 'Bearer', expires_in: 3600, scope: 'read write' }
 
-const exported = await owner.exportSecret({
+const exported = await client.exportSecret({
   alias: 'issuer-token',
 });
 
@@ -216,12 +227,9 @@ const createdVault = await createVault(storage, {
   ownerIdentity,
 });
 
-// Show once to the owner and let them store it offline.
-console.log(createdVault.initializedCustody.vaultRecoveryKey);
-
 const recoveredVault = await recoverVault(storage, {
   vaultId: 'vault-persistent',
-  vaultRecoveryKey: createdVault.initializedCustody.vaultRecoveryKey,
+  ownerIdentity,
 });
 ```
 

package/dist/clients/owner/client.d.ts

@@ -1,19 +1,19 @@
 import type { Clock } from "../../vault-core/index.js";
 import type { VaultService } from "../../vault-ingress/index.js";
-import type { OwnerAuditQueryInput, OwnerExportSecretInput, OwnerRegisterCapabilityInput, OwnerRegisterCustomHttpFlowInput, OwnerRegisterAgentIdentityInput, OwnerWriteSecretInput } from "./contracts.js";
-export interface OwnerIdentity {
-    ownerId: string;
+import type { VaultAuditQueryInput, VaultExportSecretInput, VaultGrantCapabilityInput, VaultRegisterFlowInput, VaultRegisterAgentInput, OwnerWriteSecretInput } from "./contracts.js";
+export interface VaultIdentity {
+    identityId: string;
 }
-export interface OwnerSigner {
+export interface VaultSigner {
     getPublicKey(): Promise<string>;
     sign(input: string): Promise<string>;
 }
-export interface OwnerClient {
+export interface VaultClient {
     writeSecret(input: OwnerWriteSecretInput): Promise<import("../../vault-core/index.js").SecretRecord>;
-    exportSecret(input: OwnerExportSecretInput): Promise<import("../../vault-core/index.js").OwnerSecretExport>;
-    registerCapability(input: OwnerRegisterCapabilityInput): Promise<void>;
-    getAudit(query?: OwnerAuditQueryInput): Promise<readonly import("../../vault-core/index.js").AuditEntry[]>;
-    registerAgentIdentity(input: OwnerRegisterAgentIdentityInput): Promise<void>;
-    registerCustomFlow(input: OwnerRegisterCustomHttpFlowInput): Promise<void>;
+    exportSecret(input: VaultExportSecretInput): Promise<import("../../vault-core/index.js").OwnerSecretExport>;
+    grantCapability(input: VaultGrantCapabilityInput): Promise<void>;
+    readAudit(query?: VaultAuditQueryInput): Promise<readonly import("../../vault-core/index.js").AuditEntry[]>;
+    registerAgent(input: VaultRegisterAgentInput): Promise<void>;
+    registerFlow(input: VaultRegisterFlowInput): Promise<void>;
 }
-export declare function createOwnerClient(identity: OwnerIdentity, vault: VaultService, signer: OwnerSigner, clock: Clock): OwnerClient;
+export declare function createVaultClient(identity: VaultIdentity, vault: VaultService, signer: VaultSigner, clock: Clock): VaultClient;

package/dist/clients/owner/client.js

@@ -1,4 +1,4 @@
-class DefaultOwnerClient {
+class DefaultVaultClient {
     _identity;
     _vault;
     _signer;
@@ -11,11 +11,11 @@ class DefaultOwnerClient {
     }
     async writeSecret(input) {
         const requestedAt = input.requestedAt ?? this._clock.nowIso();
-        const requestId = `${this._identity.ownerId}:${requestedAt}:${input.alias}:write_secret`;
+        const requestId = `${this._identity.identityId}:${requestedAt}:${input.alias}:write_secret`;
         const signature = await this._signer.sign(JSON.stringify({
             requestId,
             requestedAt,
-            ownerId: this._identity.ownerId,
+            ownerId: this._identity.identityId,
             alias: input.alias,
             plaintext: input.plaintext,
             targetBindings: input.targetBindings,
@@ -26,40 +26,40 @@ class DefaultOwnerClient {
             requestId,
             owner: {
                 kind: "owner",
-                id: this._identity.ownerId,
+                id: this._identity.identityId,
             },
             alias: input.alias,
             plaintext: input.plaintext,
             targetBindings: input.targetBindings,
             requestedAt,
             proof: {
-                ownerId: this._identity.ownerId,
+                ownerId: this._identity.identityId,
                 signature,
                 requestId,
                 requestedAt,
             },
         });
     }
-    async getAudit(query = {}) {
+    async readAudit(query = {}) {
         const requestedAt = this._clock.nowIso();
-        const requestId = `${this._identity.ownerId}:${requestedAt}:read_audit`;
+        const requestId = `${this._identity.identityId}:${requestedAt}:read_audit`;
         const signature = await this._signer.sign(JSON.stringify({
             requestId,
             requestedAt,
-            ownerId: this._identity.ownerId,
+            ownerId: this._identity.identityId,
             query,
         }));
         return this._vault.readAudit({
             vaultId: this._vault.vaultId,
             actor: {
                 kind: "owner",
-                id: this._identity.ownerId,
+                id: this._identity.identityId,
             },
             query,
             requestId,
             requestedAt,
             proof: {
-                ownerId: this._identity.ownerId,
+                ownerId: this._identity.identityId,
                 signature,
                 requestId,
                 requestedAt,
@@ -68,33 +68,33 @@ class DefaultOwnerClient {
     }
     async exportSecret(input) {
         const requestedAt = input.requestedAt ?? this._clock.nowIso();
-        const requestId = `${this._identity.ownerId}:${requestedAt}:${input.alias}:export_secret`;
+        const requestId = `${this._identity.identityId}:${requestedAt}:${input.alias}:export_secret`;
         const signature = await this._signer.sign(JSON.stringify({
             requestId,
             requestedAt,
-            ownerId: this._identity.ownerId,
+            ownerId: this._identity.identityId,
             alias: input.alias,
         }));
         return this._vault.exportSecret({
             vaultId: this._vault.vaultId,
             actor: {
                 kind: "owner",
-                id: this._identity.ownerId,
+                id: this._identity.identityId,
             },
             alias: input.alias,
             requestId,
             requestedAt,
             proof: {
-                ownerId: this._identity.ownerId,
+                ownerId: this._identity.identityId,
                 signature,
                 requestId,
                 requestedAt,
             },
         });
     }
-    async registerAgentIdentity(input) {
+    async registerAgent(input) {
         const requestedAt = input.requestedAt ?? this._clock.nowIso();
-        const requestId = `${this._identity.ownerId}:${requestedAt}:${input.agentId}:register_agent_identity`;
+        const requestId = `${this._identity.identityId}:${requestedAt}:${input.agentId}:register_agent_identity`;
         const agentIdentity = {
             vaultId: this._vault.vaultId,
             agentId: input.agentId,
@@ -103,7 +103,7 @@ class DefaultOwnerClient {
         const signature = await this._signer.sign(JSON.stringify({
             requestId,
             requestedAt,
-            ownerId: this._identity.ownerId,
+            ownerId: this._identity.identityId,
             agentIdentity,
         }));
         await this._vault.registerAgentIdentity({
@@ -111,21 +111,21 @@ class DefaultOwnerClient {
             requestId,
             owner: {
                 kind: "owner",
-                id: this._identity.ownerId,
+                id: this._identity.identityId,
             },
             agentIdentity,
             requestedAt,
             proof: {
-                ownerId: this._identity.ownerId,
+                ownerId: this._identity.identityId,
                 signature,
                 requestId,
                 requestedAt,
             },
         });
     }
-    async registerCapability(input) {
+    async grantCapability(input) {
         const requestedAt = input.requestedAt ?? this._clock.nowIso();
-        const requestId = `${this._identity.ownerId}:${requestedAt}:${input.capability.capabilityId}:register_capability`;
+        const requestId = `${this._identity.identityId}:${requestedAt}:${input.capability.capabilityId}:register_capability`;
         const capability = {
             ...input.capability,
             vaultId: this._vault.vaultId,
@@ -133,7 +133,7 @@ class DefaultOwnerClient {
         const signature = await this._signer.sign(JSON.stringify({
             requestId,
             requestedAt,
-            ownerId: this._identity.ownerId,
+            ownerId: this._identity.identityId,
             capability,
         }));
         await this._vault.registerCapability({
@@ -141,21 +141,21 @@ class DefaultOwnerClient {
             requestId,
             owner: {
                 kind: "owner",
-                id: this._identity.ownerId,
+                id: this._identity.identityId,
             },
             capability,
             requestedAt,
             proof: {
-                ownerId: this._identity.ownerId,
+                ownerId: this._identity.identityId,
                 signature,
                 requestId,
                 requestedAt,
             },
         });
     }
-    async registerCustomFlow(input) {
+    async registerFlow(input) {
         const requestedAt = input.requestedAt ?? this._clock.nowIso();
-        const requestId = `${this._identity.ownerId}:${requestedAt}:${input.flowId}:register_custom_flow`;
+        const requestId = `${this._identity.identityId}:${requestedAt}:${input.flowId}:register_custom_flow`;
         const flow = {
             flowId: input.flowId,
             mode: input.mode,
@@ -167,7 +167,7 @@ class DefaultOwnerClient {
         const signature = await this._signer.sign(JSON.stringify({
             requestId,
             requestedAt,
-            ownerId: this._identity.ownerId,
+            ownerId: this._identity.identityId,
             flow,
         }));
         await this._vault.registerCustomFlow({
@@ -175,12 +175,12 @@ class DefaultOwnerClient {
             requestId,
             owner: {
                 kind: "owner",
-                id: this._identity.ownerId,
+                id: this._identity.identityId,
             },
             flow,
             requestedAt,
             proof: {
-                ownerId: this._identity.ownerId,
+                ownerId: this._identity.identityId,
                 signature,
                 requestId,
                 requestedAt,
@@ -188,7 +188,7 @@ class DefaultOwnerClient {
         });
     }
 }
-export function createOwnerClient(identity, vault, signer, clock) {
-    return new DefaultOwnerClient(identity, vault, signer, clock);
+export function createVaultClient(identity, vault, signer, clock) {
+    return new DefaultVaultClient(identity, vault, signer, clock);
 }
 //# sourceMappingURL=client.js.map

package/dist/clients/owner/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/clients/owner/client.ts"],"names":[],"mappings":"AA6BA,MAAM,kBAAkB;IAEH;IACA;IACA;IACA;IAJnB,YACmB,SAAwB,EACxB,MAAoB,EACpB,OAAoB,EACpB,MAAa;QAHb,cAAS,GAAT,SAAS,CAAe;QACxB,WAAM,GAAN,MAAM,CAAc;QACpB,YAAO,GAAP,OAAO,CAAa;QACpB,WAAM,GAAN,MAAM,CAAO;IAC7B,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,KAA4B;QAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,WAAW,IAAI,KAAK,CAAC,KAAK,eAAe,CAAC;QACzF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YACvD,SAAS;YACT,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;YAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC,CAAC;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAC7B,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;aAC3B;YACD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,WAAW;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;gBAC/B,SAAS;gBACT,SAAS;gBACT,WAAW;aACZ;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAA8B,EAAE;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,WAAW,aAAa,CAAC;QACxE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YACvD,SAAS;YACT,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;YAC/B,KAAK;SACN,CAAC,CAAC,CAAC;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YAC3B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;aAC3B;YACD,KAAK;YACL,SAAS;YACT,WAAW;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;gBAC/B,SAAS;gBACT,SAAS;gBACT,WAAW;aACZ;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAA6B;QAC9C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,WAAW,IAAI,KAAK,CAAC,KAAK,gBAAgB,CAAC;QAC1F,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YACvD,SAAS;YACT,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;YAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC,CAAC;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAC9B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;aAC3B;YACD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS;YACT,WAAW;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;gBAC/B,SAAS;gBACT,SAAS;gBACT,WAAW;aACZ;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAAsC;QAChE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,WAAW,IAAI,KAAK,CAAC,OAAO,0BAA0B,CAAC;QACtG,MAAM,aAAa,GAAG;YACpB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YACvD,SAAS;YACT,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;YAC/B,aAAa;SACd,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;YACtC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;aAC3B;YACD,aAAa;YACb,WAAW;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;gBAC/B,SAAS;gBACT,SAAS;gBACT,WAAW;aACZ;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAmC;QAC1D,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,sBAAsB,CAAC;QAClH,MAAM,UAAU,GAAG;YACjB,GAAG,KAAK,CAAC,UAAU;YACnB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;SAC7B,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YACvD,SAAS;YACT,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;YAC/B,UAAU;SACX,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;YACnC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;aAC3B;YACD,UAAU;YACV,WAAW;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;gBAC/B,SAAS;gBACT,SAAS;gBACT,WAAW;aACZ;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAuC;QAC9D,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,WAAW,IAAI,KAAK,CAAC,MAAM,uBAAuB,CAAC;QAClG,MAAM,IAAI,GAAG;YACX,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YACvD,SAAS;YACT,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;YAC/B,IAAI;SACL,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;YACnC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;aAC3B;YACD,IAAI;YACJ,WAAW;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;gBAC/B,SAAS;gBACT,SAAS;gBACT,WAAW;aACZ;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,UAAU,iBAAiB,CAC/B,QAAuB,EACvB,KAAmB,EACnB,MAAmB,EACnB,KAAY;IAEZ,OAAO,IAAI,kBAAkB,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/clients/owner/client.ts"],"names":[],"mappings":"AA6BA,MAAM,kBAAkB;IAEH;IACA;IACA;IACA;IAJnB,YACmB,SAAwB,EACxB,MAAoB,EACpB,OAAoB,EACpB,MAAa;QAHb,cAAS,GAAT,SAAS,CAAe;QACxB,WAAM,GAAN,MAAM,CAAc;QACpB,YAAO,GAAP,OAAO,CAAa;QACpB,WAAM,GAAN,MAAM,CAAO;IAC7B,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,KAA4B;QAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,WAAW,IAAI,KAAK,CAAC,KAAK,eAAe,CAAC;QAC5F,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YACvD,SAAS;YACT,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU;YAClC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC,CAAC;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAC7B,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU;aAC9B;YACD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,WAAW;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU;gBAClC,SAAS;gBACT,SAAS;gBACT,WAAW;aACZ;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAA8B,EAAE;QAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,WAAW,aAAa,CAAC;QAC3E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YACvD,SAAS;YACT,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU;YAClC,KAAK;SACN,CAAC,CAAC,CAAC;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YAC3B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU;aAC9B;YACD,KAAK;YACL,SAAS;YACT,WAAW;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU;gBAClC,SAAS;gBACT,SAAS;gBACT,WAAW;aACZ;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAA6B;QAC9C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,WAAW,IAAI,KAAK,CAAC,KAAK,gBAAgB,CAAC;QAC7F,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YACvD,SAAS;YACT,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU;YAClC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC,CAAC;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAC9B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU;aAC9B;YACD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS;YACT,WAAW;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU;gBAClC,SAAS;gBACT,SAAS;gBACT,WAAW;aACZ;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAA8B;QAChD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,WAAW,IAAI,KAAK,CAAC,OAAO,0BAA0B,CAAC;QACzG,MAAM,aAAa,GAAG;YACpB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YACvD,SAAS;YACT,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU;YAClC,aAAa;SACd,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;YACtC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU;aAC9B;YACD,aAAa;YACb,WAAW;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU;gBAClC,SAAS;gBACT,SAAS;gBACT,WAAW;aACZ;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAgC;QACpD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,sBAAsB,CAAC;QACrH,MAAM,UAAU,GAAG;YACjB,GAAG,KAAK,CAAC,UAAU;YACnB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;SAC7B,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YACvD,SAAS;YACT,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU;YAClC,UAAU;SACX,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;YACnC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU;aAC9B;YACD,UAAU;YACV,WAAW;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU;gBAClC,SAAS;gBACT,SAAS;gBACT,WAAW;aACZ;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAA6B;QAC9C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,WAAW,IAAI,KAAK,CAAC,MAAM,uBAAuB,CAAC;QACrG,MAAM,IAAI,GAAG;YACX,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YACvD,SAAS;YACT,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU;YAClC,IAAI;SACL,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;YACnC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU;aAC9B;YACD,IAAI;YACJ,WAAW;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU;gBAClC,SAAS;gBACT,SAAS;gBACT,WAAW;aACZ;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,UAAU,iBAAiB,CAC/B,QAAuB,EACvB,KAAmB,EACnB,MAAmB,EACnB,KAAY;IAEZ,OAAO,IAAI,kBAAkB,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/clients/owner/contracts.d.ts

@@ -12,26 +12,26 @@ export interface OwnerWriteSecretInput {
     targetBindings: readonly OwnerSecretTargetBinding[];
     requestedAt?: string;
 }
-export interface OwnerAuditQueryInput {
+export interface VaultAuditQueryInput {
     actorId?: string;
     secretAlias?: string;
     requestId?: string;
     since?: string;
 }
-export interface OwnerExportSecretInput {
+export interface VaultExportSecretInput {
     alias: string;
     requestedAt?: string;
 }
-export interface OwnerRegisterAgentIdentityInput {
+export interface VaultRegisterAgentInput {
     agentId: string;
     publicKey: string;
     requestedAt?: string;
 }
-export interface OwnerRegisterCustomHttpFlowInput extends OwnerHttpFlowBoundary {
+export interface VaultRegisterFlowInput extends OwnerHttpFlowBoundary {
     flowId: string;
     requestedAt?: string;
 }
-export interface OwnerRegisterCapabilityInput {
+export interface VaultGrantCapabilityInput {
     capability: import("../../vault-core/index.js").AgentCapability;
     requestedAt?: string;
 }

package/dist/clients/owner/index.d.ts

@@ -1,3 +1,3 @@
-export { createOwnerClient } from "./client.js";
-export type { OwnerClient, OwnerIdentity, OwnerSigner, } from "./client.js";
-export type { OwnerAuditQueryInput, OwnerExportSecretInput, OwnerRegisterCapabilityInput, OwnerRegisterCustomHttpFlowInput, OwnerRegisterAgentIdentityInput, OwnerSecretTargetBinding, OwnerWriteSecretInput, } from "./contracts.js";
+export { createVaultClient } from "./client.js";
+export type { VaultClient, VaultIdentity, VaultSigner, } from "./client.js";
+export type { VaultAuditQueryInput, VaultExportSecretInput, VaultGrantCapabilityInput, VaultRegisterFlowInput, VaultRegisterAgentInput, OwnerSecretTargetBinding, OwnerWriteSecretInput, } from "./contracts.js";

package/dist/clients/owner/index.js

@@ -1,2 +1,2 @@
-export { createOwnerClient } from "./client.js";
+export { createVaultClient } from "./client.js";
 //# sourceMappingURL=index.js.map

package/dist/protocol/identity.d.ts

@@ -2,7 +2,7 @@
  * Claw-biometric Core Identity. Runtime utilities over protocol primitives.
  * getVaultPath (runtime). Re-exports protocol for consumers.
  */
-import { deriveRootAgentId } from '@the-ai-company/cbio-protocol';
 import { getChildIdentitySecretName, CHILD_KEY_PREFIX } from './childSecretNaming.js';
-export { deriveRootAgentId, getChildIdentitySecretName, CHILD_KEY_PREFIX };
+export { getChildIdentitySecretName, CHILD_KEY_PREFIX };
+export declare function deriveIdentityId(publicKey: string): string;
 export declare function getVaultPath(publicKey: string): string;

package/dist/protocol/identity.js

@@ -5,9 +5,12 @@
 import * as os from 'node:os';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
-import { deriveRootAgentId } from '@the-ai-company/cbio-protocol';
+import { deriveRootAgentId as protocolDeriveIdentityId } from '@the-ai-company/cbio-protocol';
 import { getChildIdentitySecretName, CHILD_KEY_PREFIX } from './childSecretNaming.js';
-export { deriveRootAgentId, getChildIdentitySecretName, CHILD_KEY_PREFIX };
+export { getChildIdentitySecretName, CHILD_KEY_PREFIX };
+export function deriveIdentityId(publicKey) {
+    return protocolDeriveIdentityId(publicKey);
+}
 export function getVaultPath(publicKey) {
     const hash = crypto.createHash('sha256').update(publicKey).digest('hex').substring(0, 12);
     const baseDir = process.env.C_BIO_VAULT_DIR || path.join(os.homedir(), '.c-bio');

package/dist/protocol/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/protocol/identity.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAEtF,OAAO,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,CAAC;AAE3E,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/protocol/identity.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,iBAAiB,IAAI,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAC9F,OAAO,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAEtF,OAAO,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,CAAC;AAExD,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAC9C,OAAO,wBAAwB,CAAC,SAAS,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC,CAAC;AACnD,CAAC"}

package/dist/runtime/bootstrap.d.ts

@@ -1,9 +1,9 @@
-import { type CreatePersistentVaultCoreDependenciesOptions, type InitializedVaultCustody, type InitializeVaultCustodyOptions, type VaultCore } from "../vault-core/index.js";
+import { type CreatePersistentVaultCoreDependenciesOptions, type VaultCore } from "../vault-core/index.js";
 import { type VaultService, type VaultCustomFlowResolver } from "../vault-ingress/index.js";
 import type { IStorageProvider } from "../storage/provider.js";
 import type { CreatedIdentity } from "./identity.js";
-export interface CreateVaultOptions extends Omit<CreatePersistentVaultCoreDependenciesOptions, "vaultWorkingKey"> {
-    custody?: InitializeVaultCustodyOptions;
+export interface CreateVaultOptions extends Omit<CreatePersistentVaultCoreDependenciesOptions, "vaultWorkingKey" | "vaultId"> {
+    vaultId?: string;
     ownerIdentity: CreatedIdentity;
     vault?: {
         customFlows?: VaultCustomFlowResolver;
@@ -11,20 +11,18 @@ export interface CreateVaultOptions extends Omit<CreatePersistentVaultCoreDepend
     };
 }
 export interface CreatedVault {
-    initializedCustody: InitializedVaultCustody;
     core: VaultCore;
     vault: VaultService;
 }
-export interface RecoverVaultOptions extends Omit<CreatePersistentVaultCoreDependenciesOptions, "vaultWorkingKey"> {
-    vaultRecoveryKey: string;
-    custodyStorageKey?: string;
+export interface RecoverVaultOptions extends Omit<CreatePersistentVaultCoreDependenciesOptions, "vaultWorkingKey" | "vaultId"> {
+    vaultId: string;
+    ownerIdentity: CreatedIdentity;
     vault?: {
         customFlows?: VaultCustomFlowResolver;
         fetchImpl?: typeof fetch;
     };
 }
 export interface RecoveredVault {
-    vaultWorkingKey: string;
     core: VaultCore;
     vault: VaultService;
 }

package/dist/runtime/bootstrap.js

@@ -1,11 +1,24 @@
+import crypto from "node:crypto";
 import { createVaultCore } from "../vault-core/core.js";
-import { createPersistentVaultCoreDependencies, initializeVaultCustody, recoverVaultWorkingKey, } from "../vault-core/index.js";
+import { createPersistentVaultCoreDependencies, } from "../vault-core/index.js";
 import { wrapVaultCoreAsVaultService, } from "../vault-ingress/index.js";
+function deriveVaultWorkingKey(privateKey, vaultId) {
+    return crypto
+        .createHash("sha256")
+        .update("cbio:vault-working-key:v1")
+        .update("\n")
+        .update(vaultId)
+        .update("\n")
+        .update(privateKey)
+        .digest("base64url");
+}
 export async function createVault(storage, options) {
-    const initializedCustody = await initializeVaultCustody(storage, options.custody);
+    const vaultId = options.vaultId ?? `vault_${crypto.randomUUID()}`;
+    const vaultWorkingKey = deriveVaultWorkingKey(options.ownerIdentity.privateKey, vaultId);
     const deps = createPersistentVaultCoreDependencies(storage, {
         ...options,
-        vaultWorkingKey: initializedCustody.vaultWorkingKey,
+        vaultId,
+        vaultWorkingKey,
     });
     const core = createVaultCore(deps);
     const bootstrapOwner = {
@@ -15,20 +28,19 @@ export async function createVault(storage, options) {
     };
     await core.bootstrapOwnerIdentity(bootstrapOwner);
     return {
-        initializedCustody,
         core,
         vault: wrapVaultCoreAsVaultService(core, options.vault),
     };
 }
 export async function recoverVault(storage, options) {
-    const vaultWorkingKey = await recoverVaultWorkingKey(storage, options.vaultRecoveryKey, options.custodyStorageKey);
+    const vaultWorkingKey = deriveVaultWorkingKey(options.ownerIdentity.privateKey, options.vaultId);
     const deps = createPersistentVaultCoreDependencies(storage, {
         ...options,
+        vaultId: options.vaultId,
         vaultWorkingKey,
     });
     const core = createVaultCore(deps);
     return {
-        vaultWorkingKey,
         core,
         vault: wrapVaultCoreAsVaultService(core, options.vault),
     };

package/dist/runtime/bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/runtime/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACL,qCAAqC,EACrC,sBAAsB,EACtB,sBAAsB,GAMvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,2BAA2B,GAG5B,MAAM,2BAA2B,CAAC;AAkCnC,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAyB,EACzB,OAA2B;IAE3B,MAAM,kBAAkB,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,qCAAqC,CAAC,OAAO,EAAE;QAC1D,GAAG,OAAO;QACV,eAAe,EAAE,kBAAkB,CAAC,eAAe;KACpD,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,cAAc,GAAwB;QAC1C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU;QACzC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,SAAS;KAC3C,CAAC;IACF,MAAM,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAClD,OAAO;QACL,kBAAkB;QAClB,IAAI;QACJ,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAyB,EACzB,OAA4B;IAE5B,MAAM,eAAe,GAAG,MAAM,sBAAsB,CAClD,OAAO,EACP,OAAO,CAAC,gBAAgB,EACxB,OAAO,CAAC,iBAAiB,CAC1B,CAAC;IACF,MAAM,IAAI,GAAG,qCAAqC,CAAC,OAAO,EAAE;QAC1D,GAAG,OAAO;QACV,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO;QACL,eAAe;QACf,IAAI;QACJ,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC;KACxD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/runtime/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACL,qCAAqC,GAItC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,2BAA2B,GAG5B,MAAM,2BAA2B,CAAC;AAInC,SAAS,qBAAqB,CAAC,UAAkB,EAAE,OAAe;IAChE,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,2BAA2B,CAAC;SACnC,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AA8BD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAyB,EACzB,OAA2B;IAE3B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,SAAS,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;IAClE,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,qCAAqC,CAAC,OAAO,EAAE;QAC1D,GAAG,OAAO;QACV,OAAO;QACP,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,cAAc,GAAwB;QAC1C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU;QACzC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,SAAS;KAC3C,CAAC;IACF,MAAM,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAClD,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAyB,EACzB,OAA4B;IAE5B,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,qCAAqC,CAAC,OAAO,EAAE;QAC1D,GAAG,OAAO;QACV,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC;KACxD,CAAC;AACJ,CAAC"}

package/dist/runtime/identity.d.ts

@@ -1,6 +1,7 @@
 export interface CreatedIdentity {
     identityId: string;
     nickname?: string;
+    parentIdentityId?: string;
     publicKey: string;
     privateKey: string;
 }
@@ -10,5 +11,9 @@ export interface CreateIdentityOptions {
 export interface RestoreIdentityOptions {
     nickname?: string;
 }
+export interface DeriveIdentityOptions {
+    nickname?: string;
+}
+export declare function createIdentity(parent?: CreatedIdentity | string, options?: CreateIdentityOptions): CreatedIdentity;
 export declare function createIdentity(options?: CreateIdentityOptions): CreatedIdentity;
 export declare function restoreIdentity(privateKey: string, options?: RestoreIdentityOptions): CreatedIdentity;

package/dist/runtime/identity.js

@@ -1,30 +1,108 @@
+import { createHmac, createPrivateKey, createPublicKey, randomBytes } from "node:crypto";
 import { derivePublicKey, generateIdentityKeys } from "../protocol/crypto.js";
-import { deriveRootAgentId } from "../protocol/identity.js";
-export function createIdentity(options = {}) {
+import { deriveIdentityId } from "../protocol/identity.js";
+const ED25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
+const ED25519_SEED_LENGTH = 32;
+function normalizeNickname(nickname) {
+    return nickname?.trim() ? nickname.trim() : undefined;
+}
+function decodeEd25519Seed(privateKey) {
+    const der = Buffer.from(privateKey, "base64url");
+    if (der.length !== ED25519_PKCS8_PREFIX.length + ED25519_SEED_LENGTH ||
+        !der.subarray(0, ED25519_PKCS8_PREFIX.length).equals(ED25519_PKCS8_PREFIX)) {
+        throw new Error("unsupported private key format");
+    }
+    return der.subarray(ED25519_PKCS8_PREFIX.length);
+}
+function encodeEd25519PrivateKey(seed) {
+    return Buffer.concat([ED25519_PKCS8_PREFIX, seed]).toString("base64url");
+}
+function toParentPrivateKey(parent) {
+    if (!parent) {
+        return undefined;
+    }
+    return typeof parent === "string" ? parent.trim() : parent.privateKey.trim();
+}
+function createRootIdentity(options = {}) {
     const keyPair = generateIdentityKeys();
     if (!keyPair.publicKey || !keyPair.privateKey) {
         throw new Error("identity generation failed");
     }
-    const nickname = options.nickname?.trim() ? options.nickname.trim() : undefined;
+    const nickname = normalizeNickname(options.nickname);
     return {
-        identityId: deriveRootAgentId(keyPair.publicKey),
+        identityId: deriveIdentityId(keyPair.publicKey),
         nickname,
         publicKey: keyPair.publicKey,
         privateKey: keyPair.privateKey,
     };
 }
+export function createIdentity(parentOrOptions, maybeOptions = {}) {
+    const hasParent = typeof parentOrOptions === "string" ||
+        (typeof parentOrOptions === "object" &&
+            parentOrOptions !== null &&
+            "privateKey" in parentOrOptions);
+    if (!hasParent) {
+        return createRootIdentity(parentOrOptions ?? {});
+    }
+    const parentPrivateKey = toParentPrivateKey(parentOrOptions);
+    if (!parentPrivateKey) {
+        return createRootIdentity(maybeOptions);
+    }
+    const nickname = normalizeNickname(maybeOptions.nickname);
+    const relationId = randomBytes(16).toString("base64url");
+    const childIdentity = deriveIdentity(parentPrivateKey, relationId, { nickname });
+    const parentIdentity = typeof parentOrOptions === "string"
+        ? restoreIdentity(parentPrivateKey)
+        : parentOrOptions;
+    return {
+        ...childIdentity,
+        parentIdentityId: parentIdentity.identityId,
+    };
+}
 export function restoreIdentity(privateKey, options = {}) {
     const normalizedPrivateKey = privateKey.trim();
     if (!normalizedPrivateKey) {
         throw new Error("private key is required");
     }
     const publicKey = derivePublicKey(normalizedPrivateKey);
-    const nickname = options.nickname?.trim() ? options.nickname.trim() : undefined;
+    const nickname = normalizeNickname(options.nickname);
     return {
-        identityId: deriveRootAgentId(publicKey),
+        identityId: deriveIdentityId(publicKey),
         nickname,
         publicKey,
         privateKey: normalizedPrivateKey,
     };
 }
+function deriveIdentity(parentPrivateKey, relationId, options = {}) {
+    const normalizedParentPrivateKey = parentPrivateKey.trim();
+    const normalizedRelationId = relationId.trim();
+    if (!normalizedParentPrivateKey) {
+        throw new Error("parent private key is required");
+    }
+    if (!normalizedRelationId) {
+        throw new Error("relationId is required");
+    }
+    const parentSeed = decodeEd25519Seed(normalizedParentPrivateKey);
+    const childSeed = createHmac("sha256", parentSeed)
+        .update("cbio:identity:child:v1")
+        .update("\0")
+        .update(normalizedRelationId)
+        .digest();
+    const privateKey = encodeEd25519PrivateKey(childSeed);
+    const privateKeyObject = createPrivateKey({
+        key: Buffer.from(privateKey, "base64url"),
+        format: "der",
+        type: "pkcs8",
+    });
+    const publicKey = Buffer.from(createPublicKey(privateKeyObject).export({
+        type: "spki",
+        format: "der",
+    })).toString("base64url");
+    return {
+        identityId: deriveIdentityId(publicKey),
+        nickname: normalizeNickname(options.nickname),
+        publicKey,
+        privateKey,
+    };
+}
 //# sourceMappingURL=identity.js.map

package/dist/runtime/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/runtime/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAiB5D,MAAM,UAAU,cAAc,CAAC,UAAiC,EAAE;IAChE,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;IACvC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,OAAO;QACL,UAAU,EAAE,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC;QAChD,QAAQ;QACR,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,UAAkC,EAAE;IACtF,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,SAAS,GAAG,eAAe,CAAC,oBAAoB,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,OAAO;QACL,UAAU,EAAE,iBAAiB,CAAC,SAAS,CAAC;QACxC,QAAQ;QACR,SAAS;QACT,UAAU,EAAE,oBAAoB;KACjC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/runtime/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAsB3D,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;AACpF,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,SAAS,iBAAiB,CAAC,QAAiB;IAC1C,OAAO,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACjD,IACE,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,GAAG,mBAAmB;QAChE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAC1E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAiC;IAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAiC,EAAE;IAC7D,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;IACvC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrD,OAAO;QACL,UAAU,EAAE,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC;QAC/C,QAAQ;QACR,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;AACJ,CAAC;AAID,MAAM,UAAU,cAAc,CAC5B,eAAkE,EAClE,eAAsC,EAAE;IAExC,MAAM,SAAS,GACb,OAAO,eAAe,KAAK,QAAQ;QACnC,CAAC,OAAO,eAAe,KAAK,QAAQ;YAClC,eAAe,KAAK,IAAI;YACxB,YAAY,IAAI,eAAe,CAAC,CAAC;IAErC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,kBAAkB,CAAE,eAAqD,IAAI,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,eAA2C,CAAC,CAAC;IACzF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,cAAc,CAAC,gBAAgB,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjF,MAAM,cAAc,GAAG,OAAO,eAAe,KAAK,QAAQ;QACxD,CAAC,CAAC,eAAe,CAAC,gBAAgB,CAAC;QACnC,CAAC,CAAC,eAAkC,CAAC;IAEvC,OAAO;QACL,GAAG,aAAa;QAChB,gBAAgB,EAAE,cAAc,CAAC,UAAU;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,UAAkC,EAAE;IACtF,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,SAAS,GAAG,eAAe,CAAC,oBAAoB,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrD,OAAO;QACL,UAAU,EAAE,gBAAgB,CAAC,SAAS,CAAC;QACvC,QAAQ;QACR,SAAS;QACT,UAAU,EAAE,oBAAoB;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,gBAAwB,EACxB,UAAkB,EAClB,UAAiC,EAAE;IAEnC,MAAM,0BAA0B,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC;IAC3D,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;SAC/C,MAAM,CAAC,wBAAwB,CAAC;SAChC,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,oBAAoB,CAAC;SAC5B,MAAM,EAAE,CAAC;IAEZ,MAAM,UAAU,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;QACxC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC;QACzC,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAC3B,eAAe,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC;QACvC,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,KAAK;KACd,CAAC,CACH,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAExB,OAAO;QACL,UAAU,EAAE,gBAAgB,CAAC,SAAS,CAAC;QACvC,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC7C,SAAS;QACT,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/runtime/index.d.ts

@@ -4,13 +4,14 @@
  */
 export { IdentityError, IdentityErrorCode } from "../errors.js";
 export { derivePublicKey, LocalSigner } from "../protocol/crypto.js";
+export { deriveIdentityId } from "../protocol/identity.js";
 export type { IStorageProvider } from "../storage/provider.js";
 export { FsStorageProvider } from "../storage/fs.js";
 export { MemoryStorageProvider } from "../storage/memory.js";
 export { createIdentity, restoreIdentity, type CreateIdentityOptions, type RestoreIdentityOptions, type CreatedIdentity, } from "./identity.js";
 export { createVault, recoverVault, type CreateVaultOptions, type CreatedVault, type RecoverVaultOptions, type RecoveredVault, } from "./bootstrap.js";
 export { createVaultCore, DefaultVaultCore, VaultCoreError, createDefaultVaultCoreDependencies, type CreateDefaultVaultCoreDependenciesOptions, type DefaultPolicyEngineOptions, DefaultPolicyEngine, createPersistentVaultCoreDependencies, initializeVaultCustody, recoverVaultWorkingKey, DEFAULT_VAULT_KEY_CUSTODY_BLOB_KEY, type InitializeVaultCustodyOptions, type InitializedVaultCustody, type CreatePersistentVaultCoreDependenciesOptions, PersistentVaultAuditLog, PersistentVaultCapabilityRegistry, PersistentVaultCapabilityRevocationRegistry, PersistentVaultCustomHttpFlowRegistry, PersistentVaultRateLimitStore, PersistentVaultReplayGuard, PersistentVaultSecretCustody, PersistentVaultSecretRepository, HttpDispatchExecutor, InMemoryAgentIdentityRegistry, InMemoryCapabilityRegistry, InMemoryCapabilityRevocationRegistry, InMemoryCustomHttpFlowRegistry, InMemoryRateLimitStore, InMemoryReplayGuard, InMemoryAuditLog, InMemoryOwnerIdentityRegistry, InMemorySecretCustody, InMemorySecretRepository, RandomIdGenerator, SignatureOwnerProofVerifier, type SignatureAgentProofVerifierOptions, SignatureAgentProofVerifier, SystemClock, type AgentCapability, type AgentIdentityRecord, type AgentProof, type OwnerAuditRequest, type OwnerExportSecretRequest, type OwnerRegisterCapabilityCommand, type OwnerRegisterAgentIdentityCommand, type OwnerRegisterCustomHttpFlowCommand, type OwnerSecretExport, type OwnerIdentityRecord, type CustomHttpFlowDefinition, type OwnerProof, type AuditEntry, type AuditLog, type AuditQuery, type Clock, type DispatchAuthorization, type DispatchInstruction, type DispatchRequest, type DispatchResult, type IdGenerator, type OwnerIdentityRegistry, type OwnerProofVerifier, type PolicyEngine, type RateLimitStore, type ReplayGuard, type CustomHttpFlowRegistry, type SecretAlias, type SecretCustody, type SecretId, type SecretRecord, type SecretRepository, type SecretVersion, type TrustedExecutor, type VaultCore, type VaultCoreDependencies, type VaultPrincipal, type VaultPrincipalKind, type VaultTargetBinding, type VaultWriteSecretCommand, type VaultId, type AgentIdentityRegistry, type AgentProofVerifier, type CapabilityRevocationRegistry, type CapabilityRegistry, } from "../vault-core/index.js";
-export { createOwnerClient, type OwnerClient, type OwnerIdentity, type OwnerSigner, type OwnerAuditQueryInput, type OwnerExportSecretInput, type OwnerRegisterCapabilityInput, type OwnerRegisterCustomHttpFlowInput, type OwnerRegisterAgentIdentityInput, type OwnerSecretTargetBinding, type OwnerWriteSecretInput, } from "../clients/owner/index.js";
+export { createVaultClient, type VaultClient, type VaultIdentity, type VaultSigner, type VaultAuditQueryInput, type VaultExportSecretInput, type VaultGrantCapabilityInput, type VaultRegisterFlowInput, type VaultRegisterAgentInput, type OwnerSecretTargetBinding, type OwnerWriteSecretInput, } from "../clients/owner/index.js";
 export { createAgentClient, type AgentClient, type AgentIdentity, type AgentCapabilityEnvelope, type AgentDispatchIntent, type AgentDispatchTransport, type AgentSigner, } from "../clients/agent/index.js";
 export { createVaultService, wrapVaultCoreAsVaultService, createOwnerHttpFlowBoundary, createStandardAcquireBoundary, createStandardDispatchBoundary, toOwnerHttpFlowBoundary, type VaultService, type VaultAcquireSecretInput, type VaultAcquireSecretResult, type VaultAcquireSecretFlow, type VaultCustomFlowResolver, type VaultAgentDispatchRequest, type VaultAgentDispatchResponse, type VaultAgentDispatchErrorResponse, type RedactedResponseShape, type OwnerHttpFlowBoundary, } from "../vault-ingress/index.js";
 export { LocalVaultTransport, } from "../vault-ingress/defaults.js";

package/dist/runtime/index.js

@@ -4,12 +4,13 @@
  */
 export { IdentityError, IdentityErrorCode } from "../errors.js";
 export { derivePublicKey, LocalSigner } from "../protocol/crypto.js";
+export { deriveIdentityId } from "../protocol/identity.js";
 export { FsStorageProvider } from "../storage/fs.js";
 export { MemoryStorageProvider } from "../storage/memory.js";
 export { createIdentity, restoreIdentity, } from "./identity.js";
 export { createVault, recoverVault, } from "./bootstrap.js";
 export { createVaultCore, DefaultVaultCore, VaultCoreError, createDefaultVaultCoreDependencies, DefaultPolicyEngine, createPersistentVaultCoreDependencies, initializeVaultCustody, recoverVaultWorkingKey, DEFAULT_VAULT_KEY_CUSTODY_BLOB_KEY, PersistentVaultAuditLog, PersistentVaultCapabilityRegistry, PersistentVaultCapabilityRevocationRegistry, PersistentVaultCustomHttpFlowRegistry, PersistentVaultRateLimitStore, PersistentVaultReplayGuard, PersistentVaultSecretCustody, PersistentVaultSecretRepository, HttpDispatchExecutor, InMemoryAgentIdentityRegistry, InMemoryCapabilityRegistry, InMemoryCapabilityRevocationRegistry, InMemoryCustomHttpFlowRegistry, InMemoryRateLimitStore, InMemoryReplayGuard, InMemoryAuditLog, InMemoryOwnerIdentityRegistry, InMemorySecretCustody, InMemorySecretRepository, RandomIdGenerator, SignatureOwnerProofVerifier, SignatureAgentProofVerifier, SystemClock, } from "../vault-core/index.js";
-export { createOwnerClient, } from "../clients/owner/index.js";
+export { createVaultClient, } from "../clients/owner/index.js";
 export { createAgentClient, } from "../clients/agent/index.js";
 export { createVaultService, wrapVaultCoreAsVaultService, createOwnerHttpFlowBoundary, createStandardAcquireBoundary, createStandardDispatchBoundary, toOwnerHttpFlowBoundary, } from "../vault-ingress/index.js";
 export { LocalVaultTransport, } from "../vault-ingress/defaults.js";

package/dist/runtime/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAErE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,cAAc,EACd,eAAe,GAIhB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,WAAW,EACX,YAAY,GAKb,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,kCAAkC,EAGlC,mBAAmB,EACnB,qCAAqC,EACrC,sBAAsB,EACtB,sBAAsB,EACtB,kCAAkC,EAIlC,uBAAuB,EACvB,iCAAiC,EACjC,2CAA2C,EAC3C,qCAAqC,EACrC,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,EAC5B,+BAA+B,EAC/B,oBAAoB,EACpB,6BAA6B,EAC7B,0BAA0B,EAC1B,oCAAoC,EACpC,8BAA8B,EAC9B,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,6BAA6B,EAC7B,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EACjB,2BAA2B,EAE3B,2BAA2B,EAC3B,WAAW,GA8CZ,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,iBAAiB,GAWlB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,iBAAiB,GAOlB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,EAClB,2BAA2B,EAC3B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,GAWxB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,mBAAmB,GACpB,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,cAAc,EACd,eAAe,GAIhB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,WAAW,EACX,YAAY,GAKb,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,kCAAkC,EAGlC,mBAAmB,EACnB,qCAAqC,EACrC,sBAAsB,EACtB,sBAAsB,EACtB,kCAAkC,EAIlC,uBAAuB,EACvB,iCAAiC,EACjC,2CAA2C,EAC3C,qCAAqC,EACrC,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,EAC5B,+BAA+B,EAC/B,oBAAoB,EACpB,6BAA6B,EAC7B,0BAA0B,EAC1B,oCAAoC,EACpC,8BAA8B,EAC9B,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,6BAA6B,EAC7B,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EACjB,2BAA2B,EAE3B,2BAA2B,EAC3B,WAAW,GA8CZ,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,iBAAiB,GAWlB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,iBAAiB,GAOlB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,EAClB,2BAA2B,EAC3B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,GAWxB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,mBAAmB,GACpB,MAAM,8BAA8B,CAAC"}

package/docs/ARCHITECTURE.md

@@ -10,7 +10,7 @@ Related design note:
 Recommended persistent-vault lifecycle:
 
 - create through `createVault(...)`
-- recover through `recoverVault(...)`
+- recover through `recoverVault(...)` using the owner's identity
 
 ## Identity And Roles
 
@@ -27,7 +27,8 @@ This means:
 
 - outside the vault there are only identities
 - inside a specific vault, identities are bound to roles such as `owner` or `agent`
-- identities are independent; there is no built-in parent/child lineage between identities
+- root identities are independent
+- child identities may be deterministically derived from a parent identity private key plus a path
 - an identity may be the `owner` of one vault and an `agent` in another vault
 
 ## Public Modules

package/docs/CUSTODY_MODEL.md

@@ -65,36 +65,14 @@ Non-purpose:
 - not a user-facing day-to-day API credential
 - not the preferred recovery artifact presented to the owner
 
-### `vaultRecoveryKey`
-
-The owner-held recovery artifact.
-
-Purpose:
-
-- recover or re-establish access to vault secret custody
-- support migration and disaster recovery
-- preserve owner material sovereignty over stored secrets
-
-Expected lifecycle:
-
-- generated during vault initialization
-- shown to the owner once
-- then stored by the owner outside the normal runtime working path
-
-Non-purpose:
-
-- not the owner's signing identity
-- not the normal runtime key used for every operation
-
 ## Current Runtime Surface
 
 The persistent runtime surface uses `vaultWorkingKey` as the runtime material-control key.
-
-The older `custodyKey` term is intentionally not part of the current product model.
+The working key is now derived from the owner's private key plus `vaultId` in the high-level runtime path.
 
 ## Required Separation
 
-The runtime separates three concerns:
+The runtime separates two concerns in the high-level path:
 
 1. Identity authority
    `ownerPrivateKey`
@@ -102,9 +80,6 @@ The runtime separates three concerns:
 2. Runtime material control
    `vaultWorkingKey`
 
-3. Recovery authority
-   `vaultRecoveryKey`
-
 This separation is deliberate.
 
 The runtime should not default to a model where one owner signing key directly acts as the encryption root for all stored secret material.
@@ -124,7 +99,7 @@ Instead:
 In practical terms:
 
 - owner must be able to export secret plaintext through a formal audited interface
-- owner must be able to recover the vault through a formal recovery mechanism
+- owner must be able to recover the vault through the owner identity path
 - owner does not need to directly hold the working key during normal runtime operation
 
 ## Export / Reveal Policy
@@ -145,7 +120,7 @@ Future hardening such as MFA/TOTP may be added on top of this model, but it does
 The runtime now includes:
 
 1. formal vault creation through `createVault(...)`
-2. formal recovery-key based re-entry through `recoverVault(...)`
+2. owner-identity based re-entry through `recoverVault(...)`
 3. explicit `vaultWorkingKey` terminology in the persistent dependency surface
 4. continued support for explicit owner export through `exportSecret(...)`
 

package/docs/IDENTITY_MODEL.md

@@ -26,8 +26,8 @@ An `identity` is an external principal represented by a public/private keypair.
 
 Properties:
 
-- independent by default
-- no built-in parent/child lineage
+- root identities are independent
+- child identities may be deterministically derived from a parent identity private key plus a path
 - no built-in inheritance
 - no built-in "owner creates agent identity" relationship
 
@@ -51,7 +51,7 @@ The vault should not treat a display label as the root identity truth.
 
 ## Stable Identity ID
 
-The runtime already has a stable public-key-derived identity primitive available through `deriveRootAgentId(...)`.
+The runtime already has a stable public-key-derived identity primitive available through `deriveIdentityId(...)`.
 
 That derived value is useful for:
 
@@ -78,6 +78,8 @@ The runtime now exposes this concept directly as optional `nickname` on `createI
 
 For existing private keys, the runtime exposes `restoreIdentity(...)`, which reconstructs the same identity shape from the private key alone.
 
+For child identities, the runtime exposes `createIdentity(parentIdentity, { nickname })`. Child identities include `parentIdentityId`, while `nickname` remains display-only.
+
 In other words:
 
 - public key or a stable derived id answers "who is this cryptographically"

package/docs/REFERENCE.md

@@ -21,7 +21,7 @@ The main constructors are:
 - `restoreIdentity(...)`
 - `createVault(...)`
 - `recoverVault(...)`
-- `createOwnerClient(...)`
+- `createVaultClient(...)`
 - `createAgentClient(...)`
 - `LocalVaultTransport`
 
@@ -52,7 +52,8 @@ Role rules:
 
 - outside the vault there are only identities
 - inside a vault, identities are bound to roles such as `owner` or `agent`
-- identities are independent; there is no built-in lineage or inheritance between identities
+- root identities are independent
+- child identities may be deterministically derived from a parent identity
 - the same identity may be `owner` in one vault and `agent` in another
 
 ## Identity Creation
@@ -63,9 +64,12 @@ Role rules:
 - `publicKey`
 - `privateKey`
 - optional `nickname`
+- optional `parentIdentityId` for child identities
 
 `nickname` is human-readable only. It does not affect the derived `identityId`, cryptographic verification, or vault-local role binding.
 
+`createIdentity(parentIdentity, { nickname })` creates a child identity when a parent identity is provided, and the returned identity includes `parentIdentityId`.
+
 `restoreIdentity(privateKey)` returns the same shape for an existing private key.
 
 ## Secret-Flow Model
@@ -100,7 +104,7 @@ The runtime does not claim to understand arbitrary network protocols. The API co
 Important methods:
 
 - `bootstrapOwnerIdentity(...)`
-- `registerAgentIdentity(...)`
+- `registerAgent(...)`
 - `writeSecret(...)`
 - `exportSecret(...)`
 - `acquireSecret(...)`
@@ -122,30 +126,30 @@ await vault.bootstrapOwnerIdentity({
 
 The runtime treats this first owner as the single vault admin. Additional principals should be modeled as agents plus capabilities rather than extra owners.
 
-## Owner Client
+## Vault Client
 
-`clients/owner` is the caller surface for the identity currently bound to the vault's single owner role.
+`clients/owner` currently implements the public vault-management client surface for the identity currently bound to the vault's single admin role.
 
-Current owner operations:
+Current management operations:
 
 - `writeSecret(...)`
 - `exportSecret(...)`
-- `getAudit(...)`
-- `registerAgentIdentity(...)`
-- `registerCapability(...)`
-- `registerCustomFlow(...)`
+- `readAudit(...)`
+- `registerAgent(...)`
+- `grantCapability(...)`
+- `registerFlow(...)`
 
 Example:
 
 ```ts
-const owner = createOwnerClient(ownerIdentity, vault, ownerSigner, clock);
+const client = createVaultClient({ identityId: ownerIdentity.identityId }, vault, ownerSigner, clock);
 
-await owner.registerAgentIdentity({
+await client.registerAgent({
   agentId: 'agent-1',
   publicKey: agentPublicKey,
 });
 
-await owner.registerCustomFlow({
+await client.registerFlow({
   flowId: 'custom-status-read',
   mode: 'send_secret',
   targetUrl: 'https://api.example.com/custom-status',
@@ -153,7 +157,7 @@ await owner.registerCustomFlow({
   responseVisibility: 'shape_only',
 });
 
-await owner.writeSecret({
+await client.writeSecret({
   alias: 'api-token',
   plaintext: 'secret-value',
   targetBindings: [
@@ -166,7 +170,7 @@ await owner.writeSecret({
   ],
 });
 
-const exportedSecret = await owner.exportSecret({
+const exportedSecret = await client.exportSecret({
   alias: 'api-token',
 });
 ```
@@ -205,7 +209,7 @@ const capability = {
   issuedAt: new Date().toISOString(),
 };
 
-await owner.registerCapability({ capability });
+await client.grantCapability({ capability });
 ```
 
 Custom capability example:
@@ -223,7 +227,7 @@ const customCapability = {
   issuedAt: new Date().toISOString(),
 };
 
-await owner.registerCapability({ capability: customCapability });
+await client.grantCapability({ capability: customCapability });
 ```
 
 ## Acquisition Result Shape

package/docs/es/README.md

@@ -23,7 +23,7 @@ import {
   createVault,
   recoverVault,
   LocalVaultTransport,
-  createOwnerClient,
+  createVaultClient,
   createAgentClient,
   FsStorageProvider,
 } from '@the-ai-company/cbio-node-runtime';
@@ -39,7 +39,7 @@ import {
 Ruta principal recomendada para vault persistente:
 
 - crear el vault persistente con `createVault(...)`
-- recuperar el vault persistente con `recoverVault(...)` usando la recovery key
+- recuperar el vault persistente con `recoverVault(...)` usando la identidad del owner
 
 La API antigua centrada en `CbioIdentity` ya no es la superficie principal del producto.
 

package/docs/fr/README.md

@@ -23,7 +23,7 @@ import {
   createVault,
   recoverVault,
   LocalVaultTransport,
-  createOwnerClient,
+  createVaultClient,
   createAgentClient,
   FsStorageProvider,
 } from '@the-ai-company/cbio-node-runtime';
@@ -39,7 +39,7 @@ import {
 Chemin principal recommande pour un vault persistant :
 
 - creer le vault persistant avec `createVault(...)`
-- restaurer le vault persistant avec `recoverVault(...)` via la recovery key
+- restaurer le vault persistant avec `recoverVault(...)` via l'identite du owner
 
 L'ancienne API centree sur `CbioIdentity` n'est plus la surface principale du produit.
 

package/docs/ja/README.md

@@ -23,7 +23,7 @@ import {
   createVault,
   recoverVault,
   LocalVaultTransport,
-  createOwnerClient,
+  createVaultClient,
   createAgentClient,
   FsStorageProvider,
 } from '@the-ai-company/cbio-node-runtime';
@@ -39,7 +39,7 @@ import {
 推奨される persistent-vault の主経路:
 
 - `createVault(...)` で persistent vault を作成する
-- `recoverVault(...)` で recovery key を使って persistent vault を復旧する
+- `recoverVault(...)` で owner identity を使って persistent vault を復旧する
 
 旧 `CbioIdentity` 中心 API は、もはや主要な公開面ではありません。
 

package/docs/ko/README.md

@@ -23,7 +23,7 @@ import {
   createVault,
   recoverVault,
   LocalVaultTransport,
-  createOwnerClient,
+  createVaultClient,
   createAgentClient,
   FsStorageProvider,
 } from '@the-ai-company/cbio-node-runtime';
@@ -39,7 +39,7 @@ import {
 권장되는 persistent-vault 주 경로:
 
 - `createVault(...)` 로 persistent vault 를 생성합니다
-- `recoverVault(...)` 로 recovery key 를 사용해 persistent vault 를 복구합니다
+- `recoverVault(...)` 로 owner identity 를 사용해 persistent vault 를 복구합니다
 
 이전 `CbioIdentity` 중심 API 는 더 이상 주요 제품 표면이 아닙니다.
 

package/docs/pt/README.md

@@ -23,7 +23,7 @@ import {
   createVault,
   recoverVault,
   LocalVaultTransport,
-  createOwnerClient,
+  createVaultClient,
   createAgentClient,
   FsStorageProvider,
 } from '@the-ai-company/cbio-node-runtime';
@@ -39,7 +39,7 @@ import {
 Caminho principal recomendado para vault persistente:
 
 - criar o vault persistente com `createVault(...)`
-- recuperar o vault persistente com `recoverVault(...)` usando a recovery key
+- recuperar o vault persistente com `recoverVault(...)` usando a identidade do owner
 
 A antiga API centrada em `CbioIdentity` nao e mais a superficie principal do produto.
 

package/docs/zh/README.md

@@ -23,7 +23,7 @@ import {
   createVault,
   recoverVault,
   LocalVaultTransport,
-  createOwnerClient,
+  createVaultClient,
   createAgentClient,
   FsStorageProvider,
 } from '@the-ai-company/cbio-node-runtime';
@@ -39,7 +39,7 @@ import {
 推荐的持久化主路径：
 
 - 通过 `createVault(...)` 创建持久化 vault
-- 通过 `recoverVault(...)` 用 recovery key 恢复持久化 vault
+- 通过 `recoverVault(...)` 用 owner 身份恢复持久化 vault
 
 ## 构建
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@the-ai-company/cbio-node-runtime",
-  "version": "1.7.0",
+  "version": "1.11.0",
   "description": "Node.js runtime for cbio identity and credential vault. Library only, no CLI or TUI.",
   "type": "module",
   "main": "./dist/runtime/index.js",