agentvault 1.0.1 → 1.0.5

package/dist/src/vault/secret-sandbox.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Secret Sandbox – Deny-first secret access control
+ *
+ * Inspired by Agent Safehouse's kernel-level deny-first sandboxing, this module
+ * enforces that every secret access is denied unless an explicit grant exists in
+ * the active scope.  It wraps any `SecretProvider` and interposes policy checks
+ * on every operation.
+ *
+ * Design:
+ * - Scopes are created per agent-execution and carry a list of grants.
+ * - Each grant is a key-pattern + access-level pair.
+ * - Before any provider call, the sandbox checks the scope for a matching grant.
+ * - Denied operations are logged to the audit trail.
+ */
+import type { SecretProvider } from './provider.js';
+import type { SecretSandboxScope, SecretScopeGrant, AuditAction } from './safehouse-types.js';
+/** Callback type for audit events */
+export type AuditCallback = (action: AuditAction, secretKey: string | undefined, allowed: boolean, reason?: string) => void;
+/**
+ * Options for creating a sandbox scope.
+ */
+export interface CreateScopeOptions {
+    agentId: string;
+    label?: string;
+    grants: SecretScopeGrant[];
+    expiresAt?: string | null;
+    maxSecrets?: number;
+    allowCrossAgent?: boolean;
+}
+export declare class SecretSandbox {
+    private readonly provider;
+    private readonly scopes;
+    private activeScope;
+    private readonly onAudit;
+    /** Count of secret keys accessed in the active scope */
+    private accessedKeys;
+    constructor(provider: SecretProvider, onAudit?: AuditCallback);
+    /**
+     * Create a new sandbox scope.  The scope is not activated until `enterScope`
+     * is called.
+     */
+    createScope(options: CreateScopeOptions): SecretSandboxScope;
+    /**
+     * Activate a scope.  All subsequent secret operations are checked against it.
+     */
+    enterScope(scopeId: string): void;
+    /**
+     * Deactivate the current scope.
+     */
+    exitScope(): void;
+    /**
+     * Revoke a scope, preventing any further use.
+     */
+    revokeScope(scopeId: string): void;
+    /**
+     * Get the currently active scope (or null).
+     */
+    getActiveScope(): SecretSandboxScope | null;
+    /**
+     * List all scopes.
+     */
+    listScopes(): SecretSandboxScope[];
+    /**
+     * Read a secret, subject to scope policy.
+     */
+    getSecret(key: string): Promise<string | null>;
+    /**
+     * Store a secret, subject to scope policy.
+     */
+    storeSecret(key: string, value: string): Promise<void>;
+    /**
+     * Delete a secret, subject to scope policy.
+     */
+    deleteSecret(key: string): Promise<void>;
+    /**
+     * List secrets, subject to scope policy.
+     */
+    listSecrets(): Promise<string[]>;
+    /**
+     * Health check (always allowed, not scope-gated).
+     */
+    healthCheck(): Promise<import("./provider.js").SecretProviderHealth>;
+    private requireScope;
+    /**
+     * Check whether the active scope grants the required access level for a key.
+     */
+    private checkAccess;
+    /**
+     * Track a key access against the scope's maxSecrets limit.
+     */
+    private trackAccess;
+    private audit;
+}
+//# sourceMappingURL=secret-sandbox.d.ts.map

package/dist/src/vault/secret-sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-sandbox.d.ts","sourceRoot":"","sources":["../../../src/vault/secret-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAEhB,WAAW,EACZ,MAAM,sBAAsB,CAAC;AAE9B,qCAAqC;AACrC,MAAM,MAAM,aAAa,GAAG,CAC1B,MAAM,EAAE,WAAW,EACnB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,MAAM,KACZ,IAAI,CAAC;AAEV;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAcD,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAChE,OAAO,CAAC,WAAW,CAAmC;IACtD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAE/C,wDAAwD;IACxD,OAAO,CAAC,YAAY,CAAqB;gBAE7B,QAAQ,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,aAAa;IAS7D;;;OAGG;IACH,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,kBAAkB;IAkB5D;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAcjC;;OAEG;IACH,SAAS,IAAI,IAAI;IAMjB;;OAEG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAWlC;;OAEG;IACH,cAAc,IAAI,kBAAkB,GAAG,IAAI;IAI3C;;OAEG;IACH,UAAU,IAAI,kBAAkB,EAAE;IAQlC;;OAEG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAcpD;;OAEG;IACG,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa5D;;OAEG;IACG,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY9C;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAiBtC;;OAEG;IACG,WAAW;IAQjB,OAAO,CAAC,YAAY;IAapB;;OAEG;IACH,OAAO,CAAC,WAAW;IAuBnB;;OAEG;IACH,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,KAAK;CAKd"}

package/dist/src/vault/secret-sandbox.js

@@ -0,0 +1,232 @@
+/**
+ * Secret Sandbox – Deny-first secret access control
+ *
+ * Inspired by Agent Safehouse's kernel-level deny-first sandboxing, this module
+ * enforces that every secret access is denied unless an explicit grant exists in
+ * the active scope.  It wraps any `SecretProvider` and interposes policy checks
+ * on every operation.
+ *
+ * Design:
+ * - Scopes are created per agent-execution and carry a list of grants.
+ * - Each grant is a key-pattern + access-level pair.
+ * - Before any provider call, the sandbox checks the scope for a matching grant.
+ * - Denied operations are logged to the audit trail.
+ */
+import * as crypto from 'node:crypto';
+/**
+ * Matches a secret key against a glob-like pattern.
+ * Supports `*` (any chars) and `?` (single char).
+ */
+function matchKeyPattern(pattern, key) {
+    const escaped = pattern
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+        .replace(/\*/g, '.*')
+        .replace(/\?/g, '.');
+    return new RegExp(`^${escaped}$`).test(key);
+}
+export class SecretSandbox {
+    provider;
+    scopes = new Map();
+    activeScope = null;
+    onAudit;
+    /** Count of secret keys accessed in the active scope */
+    accessedKeys = new Set();
+    constructor(provider, onAudit) {
+        this.provider = provider;
+        this.onAudit = onAudit ?? null;
+    }
+    // -----------------------------------------------------------------------
+    // Scope management
+    // -----------------------------------------------------------------------
+    /**
+     * Create a new sandbox scope.  The scope is not activated until `enterScope`
+     * is called.
+     */
+    createScope(options) {
+        const scope = {
+            scopeId: `scope_${crypto.randomBytes(8).toString('hex')}`,
+            agentId: options.agentId,
+            label: options.label,
+            grants: options.grants,
+            createdAt: new Date().toISOString(),
+            expiresAt: options.expiresAt ?? null,
+            revoked: false,
+            maxSecrets: options.maxSecrets,
+            allowCrossAgent: options.allowCrossAgent ?? false,
+        };
+        this.scopes.set(scope.scopeId, scope);
+        this.audit('scope.create', undefined, true);
+        return scope;
+    }
+    /**
+     * Activate a scope.  All subsequent secret operations are checked against it.
+     */
+    enterScope(scopeId) {
+        const scope = this.scopes.get(scopeId);
+        if (!scope)
+            throw new Error(`Scope "${scopeId}" does not exist`);
+        if (scope.revoked)
+            throw new Error(`Scope "${scopeId}" has been revoked`);
+        if (scope.expiresAt && new Date(scope.expiresAt) < new Date()) {
+            throw new Error(`Scope "${scopeId}" has expired`);
+        }
+        this.activeScope = scope;
+        this.accessedKeys.clear();
+        this.audit('sandbox.enter', undefined, true);
+    }
+    /**
+     * Deactivate the current scope.
+     */
+    exitScope() {
+        this.audit('sandbox.exit', undefined, true);
+        this.activeScope = null;
+        this.accessedKeys.clear();
+    }
+    /**
+     * Revoke a scope, preventing any further use.
+     */
+    revokeScope(scopeId) {
+        const scope = this.scopes.get(scopeId);
+        if (!scope)
+            throw new Error(`Scope "${scopeId}" does not exist`);
+        scope.revoked = true;
+        if (this.activeScope?.scopeId === scopeId) {
+            this.activeScope = null;
+            this.accessedKeys.clear();
+        }
+        this.audit('scope.revoke', undefined, true);
+    }
+    /**
+     * Get the currently active scope (or null).
+     */
+    getActiveScope() {
+        return this.activeScope ? { ...this.activeScope } : null;
+    }
+    /**
+     * List all scopes.
+     */
+    listScopes() {
+        return [...this.scopes.values()].map(s => ({ ...s }));
+    }
+    // -----------------------------------------------------------------------
+    // Sandboxed provider operations
+    // -----------------------------------------------------------------------
+    /**
+     * Read a secret, subject to scope policy.
+     */
+    async getSecret(key) {
+        this.requireScope();
+        if (!this.checkAccess(key, 'read')) {
+            this.audit('secret.read', key, false, 'No matching grant for read access');
+            this.audit('scope.deny', key, false, `read denied for "${key}"`);
+            throw new Error(`Access denied: no read grant for secret "${key}"`);
+        }
+        this.trackAccess(key);
+        const value = await this.provider.getSecret(key);
+        this.audit('secret.read', key, true);
+        return value;
+    }
+    /**
+     * Store a secret, subject to scope policy.
+     */
+    async storeSecret(key, value) {
+        this.requireScope();
+        if (!this.checkAccess(key, 'write')) {
+            this.audit('secret.write', key, false, 'No matching grant for write access');
+            this.audit('scope.deny', key, false, `write denied for "${key}"`);
+            throw new Error(`Access denied: no write grant for secret "${key}"`);
+        }
+        this.trackAccess(key);
+        await this.provider.storeSecret(key, value);
+        this.audit('secret.write', key, true);
+    }
+    /**
+     * Delete a secret, subject to scope policy.
+     */
+    async deleteSecret(key) {
+        this.requireScope();
+        if (!this.checkAccess(key, 'admin')) {
+            this.audit('secret.delete', key, false, 'No matching grant for admin access');
+            this.audit('scope.deny', key, false, `delete denied for "${key}"`);
+            throw new Error(`Access denied: no admin grant for secret "${key}"`);
+        }
+        await this.provider.deleteSecret(key);
+        this.audit('secret.delete', key, true);
+    }
+    /**
+     * List secrets, subject to scope policy.
+     */
+    async listSecrets() {
+        this.requireScope();
+        // List is allowed if ANY grant exists with read or higher access
+        const hasAnyGrant = this.activeScope.grants.some(g => g.access !== 'none');
+        if (!hasAnyGrant) {
+            this.audit('secret.list', undefined, false, 'No grants with read or higher access');
+            throw new Error('Access denied: no grants permit listing secrets');
+        }
+        const allKeys = await this.provider.listSecrets();
+        this.audit('secret.list', undefined, true);
+        // Filter to only keys the scope can read
+        return allKeys.filter(key => this.checkAccess(key, 'read'));
+    }
+    /**
+     * Health check (always allowed, not scope-gated).
+     */
+    async healthCheck() {
+        return this.provider.healthCheck();
+    }
+    // -----------------------------------------------------------------------
+    // Internal helpers
+    // -----------------------------------------------------------------------
+    requireScope() {
+        if (!this.activeScope) {
+            throw new Error('No active sandbox scope. Call enterScope() first.');
+        }
+        if (this.activeScope.revoked) {
+            throw new Error('Active scope has been revoked');
+        }
+        if (this.activeScope.expiresAt && new Date(this.activeScope.expiresAt) < new Date()) {
+            this.activeScope = null;
+            throw new Error('Active scope has expired');
+        }
+    }
+    /**
+     * Check whether the active scope grants the required access level for a key.
+     */
+    checkAccess(key, required) {
+        if (!this.activeScope)
+            return false;
+        const levelOrder = {
+            none: 0,
+            read: 1,
+            write: 2,
+            admin: 3,
+        };
+        const requiredLevel = levelOrder[required];
+        for (const grant of this.activeScope.grants) {
+            if (matchKeyPattern(grant.keyPattern, key)) {
+                if (levelOrder[grant.access] >= requiredLevel) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+    /**
+     * Track a key access against the scope's maxSecrets limit.
+     */
+    trackAccess(key) {
+        this.accessedKeys.add(key);
+        if (this.activeScope?.maxSecrets &&
+            this.accessedKeys.size > this.activeScope.maxSecrets) {
+            this.audit('scope.deny', key, false, 'maxSecrets limit exceeded');
+            throw new Error(`Access denied: scope limit of ${this.activeScope.maxSecrets} secrets exceeded`);
+        }
+    }
+    audit(action, secretKey, allowed, reason) {
+        if (this.onAudit) {
+            this.onAudit(action, secretKey, allowed, reason);
+        }
+    }
+}
+//# sourceMappingURL=secret-sandbox.js.map

package/dist/src/vault/secret-sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-sandbox.js","sourceRoot":"","sources":["../../../src/vault/secret-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AA6BtC;;;GAGG;AACH,SAAS,eAAe,CAAC,OAAe,EAAE,GAAW;IACnD,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;SACpC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;SACpB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvB,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,OAAO,aAAa;IACP,QAAQ,CAAiB;IACzB,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IACxD,WAAW,GAA8B,IAAI,CAAC;IACrC,OAAO,CAAuB;IAE/C,wDAAwD;IAChD,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzC,YAAY,QAAwB,EAAE,OAAuB;QAC3D,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC;IACjC,CAAC;IAED,0EAA0E;IAC1E,mBAAmB;IACnB,0EAA0E;IAE1E;;;OAGG;IACH,WAAW,CAAC,OAA2B;QACrC,MAAM,KAAK,GAAuB;YAChC,OAAO,EAAE,SAAS,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACzD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;YACpC,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,KAAK;SAClD,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAAe;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,OAAO,kBAAkB,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,OAAO,oBAAoB,CAAC,CAAC;QAE1E,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,UAAU,OAAO,eAAe,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,SAAS;QACP,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,OAAe;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,OAAO,kBAAkB,CAAC,CAAC;QACjE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;QACrB,IAAI,IAAI,CAAC,WAAW,EAAE,OAAO,KAAK,OAAO,EAAE,CAAC;YAC1C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,0EAA0E;IAC1E,gCAAgC;IAChC,0EAA0E;IAE1E;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,EAAE,mCAAmC,CAAC,CAAC;YAC3E,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,KAAK,EAAE,oBAAoB,GAAG,GAAG,CAAC,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,4CAA4C,GAAG,GAAG,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,KAAa;QAC1C,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,oCAAoC,CAAC,CAAC;YAC7E,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,KAAK,EAAE,qBAAqB,GAAG,GAAG,CAAC,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,6CAA6C,GAAG,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,EAAE,KAAK,EAAE,oCAAoC,CAAC,CAAC;YAC9E,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,KAAK,EAAE,sBAAsB,GAAG,GAAG,CAAC,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,6CAA6C,GAAG,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,iEAAiE;QACjE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,sCAAsC,CAAC,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAClD,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAE3C,yCAAyC;QACzC,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,CAAC;IAED,0EAA0E;IAC1E,mBAAmB;IACnB,0EAA0E;IAElE,YAAY;QAClB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACpF,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW,EAAE,QAA2B;QAC1D,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,KAAK,CAAC;QAEpC,MAAM,UAAU,GAAsC;YACpD,IAAI,EAAE,CAAC;YACP,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,CAAC;YACR,KAAK,EAAE,CAAC;SACT,CAAC;QAEF,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE3C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YAC5C,IAAI,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC3C,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;oBAC9C,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW;QAC7B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAE3B,IACE,IAAI,CAAC,WAAW,EAAE,UAAU;YAC5B,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,EACpD,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,KAAK,EAAE,2BAA2B,CAAC,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,CAAC,WAAW,CAAC,UAAU,mBAAmB,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAmB,EAAE,SAA6B,EAAE,OAAgB,EAAE,MAAe;QACjG,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;CACF"}

package/dist/src/vault/types.d.ts

@@ -0,0 +1,148 @@
+/**
+ * Types for HashiCorp Vault integration
+ *
+ * Provides per-agent private Vault instances for secrets and API key management.
+ */
+/**
+ * Vault authentication method
+ */
+export type VaultAuthMethod = 'token' | 'approle' | 'kubernetes' | 'userpass';
+/**
+ * Secret backend provider
+ */
+export type VaultBackend = 'hashicorp' | 'bitwarden';
+/**
+ * Vault secret engine type
+ */
+export type VaultSecretEngine = 'kv-v2' | 'kv-v1' | 'transit';
+/**
+ * Vault connection configuration
+ */
+export interface VaultConfig {
+    /** Secret backend provider */
+    backend?: VaultBackend;
+    /** Vault server address (e.g. http://127.0.0.1:8200) */
+    address: string;
+    /** Authentication method */
+    authMethod: VaultAuthMethod;
+    /** Vault token (for token auth) */
+    token?: string;
+    /** AppRole role ID (for approle auth) */
+    roleId?: string;
+    /** AppRole secret ID (for approle auth) */
+    secretId?: string;
+    /** Kubernetes auth role (for k8s auth) */
+    k8sRole?: string;
+    /** Username (for userpass auth) */
+    username?: string;
+    /** Password (for userpass auth) */
+    password?: string;
+    /** Vault namespace (enterprise feature) */
+    namespace?: string;
+    /** TLS CA certificate path */
+    caCertPath?: string;
+    /** Skip TLS verification (not recommended for production) */
+    tlsSkipVerify?: boolean;
+    /** Request timeout in milliseconds */
+    timeoutMs?: number;
+}
+/**
+ * Per-agent Vault policy configuration
+ */
+export interface AgentVaultPolicy {
+    /** Agent identifier */
+    agentId: string;
+    /** Base path in Vault for this agent's secrets */
+    secretPath: string;
+    /** Secret engine to use */
+    engine: VaultSecretEngine;
+    /** Whether agent can create new secrets */
+    allowCreate: boolean;
+    /** Whether agent can update existing secrets */
+    allowUpdate: boolean;
+    /** Whether agent can delete secrets */
+    allowDelete: boolean;
+    /** Whether agent can list secrets */
+    allowList: boolean;
+    /** Maximum number of secrets this agent can store */
+    maxSecrets?: number;
+    /** Allowed secret key patterns (glob) */
+    allowedKeyPatterns?: string[];
+}
+/**
+ * A secret stored in Vault
+ */
+export interface VaultSecret {
+    /** Secret key/path */
+    key: string;
+    /** Secret value (string or key-value map) */
+    value: string | Record<string, string>;
+    /** Metadata */
+    metadata: VaultSecretMetadata;
+}
+/**
+ * Vault secret metadata
+ */
+export interface VaultSecretMetadata {
+    /** Secret version number */
+    version: number;
+    /** Creation timestamp */
+    createdAt: string;
+    /** Last update timestamp */
+    updatedAt: string;
+    /** Whether the secret has been destroyed */
+    destroyed: boolean;
+    /** Custom metadata key-value pairs */
+    customMetadata?: Record<string, string>;
+}
+/**
+ * Result of a Vault operation
+ */
+export interface VaultOperationResult<T = void> {
+    /** Whether the operation succeeded */
+    success: boolean;
+    /** Result data (if applicable) */
+    data?: T;
+    /** Error message (if failed) */
+    error?: string;
+}
+/**
+ * Vault health status
+ */
+export interface VaultHealthStatus {
+    /** Whether Vault is initialized */
+    initialized: boolean;
+    /** Whether Vault is sealed */
+    sealed: boolean;
+    /** Vault server version */
+    version: string;
+    /** Cluster name */
+    clusterName?: string;
+}
+/**
+ * Agent Vault initialization options
+ */
+export interface AgentVaultInitOptions {
+    /** Agent identifier */
+    agentId: string;
+    /** Secret engine type */
+    engine?: VaultSecretEngine;
+    /** Maximum number of secrets */
+    maxSecrets?: number;
+    /** Allowed key patterns */
+    allowedKeyPatterns?: string[];
+}
+/**
+ * Vault secret list entry (without value)
+ */
+export interface VaultSecretListEntry {
+    /** Secret key/path */
+    key: string;
+    /** Secret version */
+    version: number;
+    /** Creation timestamp */
+    createdAt: string;
+    /** Last update timestamp */
+    updatedAt: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/vault/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/vault/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,GAAG,UAAU,CAAC;AAE9E;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,WAAW,CAAC;AAErD;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;AAE9D;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,8BAA8B;IAC9B,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,UAAU,EAAE,eAAe,CAAC;IAC5B,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,2CAA2C;IAC3C,WAAW,EAAE,OAAO,CAAC;IACrB,gDAAgD;IAChD,WAAW,EAAE,OAAO,CAAC;IACrB,uCAAuC;IACvC,WAAW,EAAE,OAAO,CAAC;IACrB,qCAAqC;IACrC,SAAS,EAAE,OAAO,CAAC;IACnB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,sBAAsB;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,eAAe;IACf,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,SAAS,EAAE,OAAO,CAAC;IACnB,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB,CAAC,CAAC,GAAG,IAAI;IAC5C,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,kCAAkC;IAClC,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,mCAAmC;IACnC,WAAW,EAAE,OAAO,CAAC;IACrB,8BAA8B;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,2BAA2B;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,mBAAmB;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,yBAAyB;IACzB,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,gCAAgC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2BAA2B;IAC3B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,sBAAsB;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,qBAAqB;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/src/vault/types.js

@@ -0,0 +1,7 @@
+/**
+ * Types for HashiCorp Vault integration
+ *
+ * Provides per-agent private Vault instances for secrets and API key management.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/vault/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/vault/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/src/wallet/cbor-serializer.d.ts

@@ -0,0 +1,82 @@
+/**
+ * CBOR Serializer/Deserializer
+ *
+ * Uses cbor-x to encode/decode wallet data and transactions.
+ * Provides efficient binary serialization for wallet operations.
+ */
+import type { WalletData, Transaction, TransactionRequest, SignedTransaction } from './types.js';
+/**
+ * CBOR serializer options
+ */
+interface CborOptions {
+    /** Include diagnostic info */
+    diagnostic?: boolean;
+    /** Use indefinite-length encoding */
+    indefinite?: boolean;
+}
+/**
+ * Serialize wallet data to CBOR
+ *
+ * @param wallet - Wallet data to serialize
+ * @param options - CBOR encoding options
+ * @returns CBOR-encoded wallet data
+ */
+export declare function serializeWallet(wallet: WalletData, _options?: CborOptions): Uint8Array;
+/**
+ * Deserialize CBOR data to wallet
+ *
+ * @param data - CBOR-encoded wallet data
+ * @returns Deserialized wallet data
+ */
+export declare function deserializeWallet(data: Uint8Array): WalletData;
+/**
+ * Serialize transaction to CBOR
+ *
+ * @param transaction - Transaction to serialize
+ * @returns CBOR-encoded transaction
+ */
+export declare function serializeTransaction(transaction: Transaction): Uint8Array;
+/**
+ * Deserialize CBOR data to transaction
+ *
+ * @param data - CBOR-encoded transaction data
+ * @returns Deserialized transaction
+ */
+export declare function deserializeTransaction(data: Uint8Array): Transaction;
+/**
+ * Serialize transaction request to CBOR
+ *
+ * @param request - Transaction request to serialize
+ * @returns CBOR-encoded transaction request
+ */
+export declare function serializeTransactionRequest(request: TransactionRequest): Uint8Array;
+/**
+ * Deserialize CBOR data to transaction request
+ *
+ * @param data - CBOR-encoded transaction request data
+ * @returns Deserialized transaction request
+ */
+export declare function deserializeTransactionRequest(data: Uint8Array): TransactionRequest;
+/**
+ * Serialize signed transaction to CBOR
+ *
+ * @param signedTx - Signed transaction to serialize
+ * @returns CBOR-encoded signed transaction
+ */
+export declare function serializeSignedTransaction(signedTx: SignedTransaction): Uint8Array;
+/**
+ * Deserialize CBOR data to signed transaction
+ *
+ * @param data - CBOR-encoded signed transaction data
+ * @returns Deserialized signed transaction
+ */
+export declare function deserializeSignedTransaction(data: Uint8Array): SignedTransaction;
+/**
+ * Validate CBOR data structure
+ *
+ * @param data - CBOR-encoded data
+ * @returns True if data appears valid
+ */
+export declare function validateCborData(data: Uint8Array): boolean;
+export {};
+//# sourceMappingURL=cbor-serializer.d.ts.map

package/dist/src/wallet/cbor-serializer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cbor-serializer.d.ts","sourceRoot":"","sources":["../../../src/wallet/cbor-serializer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAEpB;;GAEG;AACH,UAAU,WAAW;IACnB,8BAA8B;IAC9B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qCAAqC;IACrC,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,UAAU,EAClB,QAAQ,GAAE,WAAgB,GACzB,UAAU,CAiCZ;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAwC9D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,WAAW,GAAG,UAAU,CAmBzE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAmBpE;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,kBAAkB,GAAG,UAAU,CAgBnF;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,UAAU,GAAG,kBAAkB,CAgBlF;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,iBAAiB,GAAG,UAAU,CAclF;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,UAAU,GAAG,iBAAiB,CAchF;AA6CD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAc1D"}