@shieldaai/agent-map 0.1.0-alpha.3 → 1.0.0

package/dist/transport.js

@@ -1,16 +1,50 @@
 import { MapQueryError } from './types.js';
-import { fail } from './boundary.js';
+import { fail, integer } from './common.js';
+import { fields, parseRequest } from './boundary.js';
+// Request plumbing shared by the reference-credential server (http.ts) and the company
+// sign-in server (identity-http.ts): the same headers, limits, error bodies and refusals.
 const CODES = new Map([
-    ['MAP_UNAUTHENTICATED', 401], ['MAP_REQUEST_DENIED', 403], ['MAP_NOT_FOUND', 404],
-    ['MAP_REQUEST_INVALID', 400], ['MAP_ARGUMENT_INVALID', 400], ['MAP_OPERATION_INVALID', 400],
-    ['MAP_SCOPE_INVALID', 403], ['MAP_LIMIT_EXCEEDED', 413], ['MAP_REQUEST_TOO_LARGE', 413],
-    ['MAP_RESPONSE_TOO_LARGE', 413], ['MAP_TIMEOUT', 408], ['MAP_BUSY', 503],
-    ['MAP_RATE_LIMITED', 429], ['MAP_UNAVAILABLE', 503],
-    ['MAP_SESSION_REQUIRED', 401], ['MAP_IDENTITY_INVALID', 401], ['MAP_IDENTITY_UNAVAILABLE', 503],
+    ['MAP_UNAUTHENTICATED', 401],
+    ['MAP_REQUEST_DENIED', 403],
+    ['MAP_NOT_FOUND', 404],
+    ['MAP_REQUEST_INVALID', 400],
+    ['MAP_SCOPE_INVALID', 403],
+    ['MAP_LIMIT_EXCEEDED', 413],
+    ['MAP_REQUEST_TOO_LARGE', 413],
+    ['MAP_RESPONSE_TOO_LARGE', 413],
+    // 408 while the request is still arriving; 504 once it has (see `timeoutStatus`).
+    ['MAP_TIMEOUT', 408],
+    ['MAP_BUSY', 503],
+    ['MAP_RATE_LIMITED', 429],
+    ['MAP_UNAVAILABLE', 503],
+    ['MAP_SESSION_REQUIRED', 401],
+    ['MAP_IDENTITY_INVALID', 401],
+    ['MAP_IDENTITY_UNAVAILABLE', 503],
 ]);
 export function safeError(error) {
     return error instanceof MapQueryError && CODES.has(error.code) ? error.code : 'MAP_UNAVAILABLE';
 }
+/** A refusal HTTP names more exactly than the code's usual status (an unmet `Expect` is 417). */
+class StatusError extends MapQueryError {
+    status;
+    constructor(code, status) {
+        super(code);
+        this.status = status;
+    }
+}
+/**
+ * The status of a timeout. 408 says the client was too slow to send its request; once the whole
+ * request has been received, the time was spent by the service or its database, which is 504.
+ */
+export const timeoutStatus = (received) => (received ? 504 : undefined);
+/**
+ * Answers a failed request with its safe code; nothing from the error itself is sent.
+ * `received`: the request body had been read in full when the failure happened.
+ */
+export function respondError(response, error, received = false) {
+    const code = safeError(error);
+    errorResponse(response, code, error instanceof StatusError ? error.status : code === 'MAP_TIMEOUT' ? timeoutStatus(received) : undefined);
+}
 export function headers(response, size, mime = 'application/json') {
     response.setHeader('Content-Type', mime);
     response.setHeader('Content-Length', size);
@@ -20,7 +54,8 @@ export function headers(response, size, mime = 'application/json') {
     response.setHeader('Connection', 'close');
     response.setHeader('Content-Security-Policy', "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; base-uri 'none'; frame-ancestors 'none'; form-action 'none'");
 }
-export function errorResponse(response, code) {
+/** `status` overrides the code's usual status, for a refusal HTTP names more exactly (417). */
+export function errorResponse(response, code, status) {
     if (response.writableEnded || response.destroyed)
         return;
     if (response.headersSent) {
@@ -31,7 +66,7 @@ export function errorResponse(response, code) {
     headers(response, body.length);
     if (code === 'MAP_UNAUTHENTICATED')
         response.setHeader('WWW-Authenticate', 'Bearer realm="agent-guard-reference"');
-    response.writeHead(CODES.get(code) ?? 503);
+    response.writeHead(status ?? CODES.get(code) ?? 503);
     response.end(body);
 }
 export const count = (request, name) => request.rawHeaders.filter((entry, i) => i % 2 === 0 && entry.toLowerCase() === name).length;
@@ -48,13 +83,30 @@ export function readBody(request, max, signal) {
     return new Promise((resolve, reject) => {
         let size = 0;
         const chunks = [];
-        const cleanup = () => { request.off('data', data); request.off('end', end); request.off('error', aborted); request.off('aborted', aborted); signal.removeEventListener('abort', timeout); };
-        const stop = (code) => { cleanup(); request.pause(); reject(new MapQueryError(code)); };
-        const data = (chunk) => { size += chunk.length; if (size > max) {
-            stop('MAP_REQUEST_TOO_LARGE');
-            return;
-        } chunks.push(chunk); };
-        const end = () => { cleanup(); resolve(Buffer.concat(chunks, size)); };
+        const cleanup = () => {
+            request.off('data', data);
+            request.off('end', end);
+            request.off('error', aborted);
+            request.off('aborted', aborted);
+            signal.removeEventListener('abort', timeout);
+        };
+        const stop = (code) => {
+            cleanup();
+            request.pause();
+            reject(new MapQueryError(code));
+        };
+        const data = (chunk) => {
+            size += chunk.length;
+            if (size > max) {
+                stop('MAP_REQUEST_TOO_LARGE');
+                return;
+            }
+            chunks.push(chunk);
+        };
+        const end = () => {
+            cleanup();
+            resolve(Buffer.concat(chunks, size));
+        };
         const aborted = () => stop('MAP_REQUEST_INVALID');
         const timeout = () => stop('MAP_TIMEOUT');
         if (signal.aborted) {
@@ -68,3 +120,79 @@ export function readBody(request, max, signal) {
         signal.addEventListener('abort', timeout, { once: true });
     });
 }
+/** Per-credential or per-session rate limit: `maxRequests` in each `windowMs`. */
+export function rateLimit(value, defaultMaxRequests) {
+    const rate = value === undefined ? {} : fields(value, ['maxRequests', 'windowMs'], ['maxRequests', 'windowMs']);
+    return {
+        maxRequests: integer(rate.maxRequests, defaultMaxRequests, 1, 10_000),
+        windowMs: integer(rate.windowMs, 60_000, 10, 60_000),
+    };
+}
+/**
+ * The JSON body of an admitted POST. Call it only after the credential (or session and CSRF)
+ * and rate checks have passed: it is what tells a client that sent `Expect: 100-continue` to go
+ * on, and a refusal before it has already answered with its own status.
+ */
+export async function readJsonBody(request, response, limit, signal) {
+    if (count(request, 'content-type') !== 1 ||
+        !/^application\/json(?:\s*;\s*charset=utf-8)?$/i.test(request.headers['content-type'] ?? '') ||
+        count(request, 'content-length') > 1 ||
+        count(request, 'transfer-encoding') > 1 ||
+        request.headers['content-encoding'] !== undefined)
+        fail('MAP_REQUEST_INVALID');
+    const length = request.headers['content-length'];
+    if (length !== undefined && (!/^\d+$/.test(length) || !Number.isSafeInteger(Number(length))))
+        fail('MAP_REQUEST_INVALID');
+    if (length !== undefined && Number(length) > limit)
+        fail('MAP_REQUEST_TOO_LARGE');
+    const expectation = request.headers.expect;
+    if (expectation !== undefined) {
+        // Only `100-continue` can be met; anything else, or anything added to it, is 417.
+        if (expectation.trim().toLowerCase() !== '100-continue')
+            throw new StatusError('MAP_REQUEST_INVALID', 417);
+        // Interim responses exist only in HTTP/1.1. An HTTP/1.0 client that sends the expectation
+        // is not waiting for one (RFC 9110, 10.1.1): its body is read without an invitation.
+        if (request.httpVersionMajor === 1 && request.httpVersionMinor === 1)
+            response.writeContinue();
+    }
+    return parseRequest(await readBody(request, limit, signal), limit);
+}
+/** The `{ operation, args }` envelope of `POST /v1/query`. */
+export function queryEnvelope(parsed) {
+    try {
+        const envelope = fields(parsed, ['operation', 'args'], ['operation', 'args']);
+        return { operation: envelope.operation, args: envelope.args };
+    }
+    catch {
+        return fail('MAP_REQUEST_INVALID');
+    }
+}
+/** A body that must be the empty object, as the sign-in and sign-out routes require. */
+export function emptyObject(parsed) {
+    try {
+        fields(parsed, [], []);
+    }
+    catch {
+        fail('MAP_REQUEST_INVALID');
+    }
+}
+/** Sends one fixed viewer asset. */
+export function sendAsset(response, asset) {
+    headers(response, asset.body.length, asset.mime);
+    response.writeHead(200);
+    response.end(asset.body);
+}
+/**
+ * What neither server speaks: a request that arrives with `Expect: 100-continue` still goes
+ * through the normal handler, any other expectation is 417, and tunnels, upgrades and
+ * malformed requests are dropped.
+ */
+export function refuseOtherTraffic(server, handle) {
+    server.on('checkContinue', (request, response) => {
+        void handle(request, response);
+    });
+    server.on('checkExpectation', (_request, response) => errorResponse(response, 'MAP_REQUEST_INVALID', 417));
+    server.on('connect', (_request, socket) => socket.destroy());
+    server.on('upgrade', (_request, socket) => socket.destroy());
+    server.on('clientError', (_error, socket) => socket.destroy());
+}

package/dist/types.d.ts

@@ -15,10 +15,10 @@ export interface ReadScope {
     readonly teamIds: readonly string[];
     readonly allTeams: boolean;
 }
-export declare const MAP_LABELS: readonly ['GuardAgent', 'GuardDeployment', 'GuardTask', 'GuardPrincipal', 'GuardGrant', 'GuardTool', 'GuardResource', 'GuardResourceBinding', 'GuardExecutionBinding', 'GuardExternalResource', 'GuardExternalIdentity', 'GuardMcpConnection', 'GuardMcpOperation'];
-export type GuardLabel = typeof MAP_LABELS[number];
-export declare const MAP_RELATIONSHIPS: readonly ['G_INSTANCE_OF', 'G_ASSIGNED_TO', 'G_ACTS_AS', 'G_DELEGATED_FROM', 'G_DERIVED_FROM', 'G_HAS_GRANT', 'G_FOR_TOOL', 'G_TARGETS', 'G_BINDS_SELECTOR', 'G_MAPS_TO', 'G_EXECUTES_FOR', 'G_EXECUTES_TOOL', 'G_USES_IDENTITY', 'G_VIA_CONNECTION', 'G_EXPOSES_OPERATION', 'G_OPERATION_TOOL'];
-export type GuardRelation = typeof MAP_RELATIONSHIPS[number];
+export declare const MAP_LABELS: readonly ['GuardAgent', 'GuardDeployment', 'GuardTask', 'GuardPrincipal', 'GuardGrant', 'GuardTool', 'GuardResource', 'GuardResourceBinding', 'GuardExecutionBinding', 'GuardExternalResource', 'GuardExternalIdentity', 'GuardMcpConnection', 'GuardMcpOperation', 'GuardOwner', 'GuardCredentialReference', 'GuardDirectAccess'];
+export type GuardLabel = (typeof MAP_LABELS)[number];
+export declare const MAP_RELATIONSHIPS: readonly ['G_INSTANCE_OF', 'G_ASSIGNED_TO', 'G_ACTS_AS', 'G_DELEGATED_FROM', 'G_DERIVED_FROM', 'G_HAS_GRANT', 'G_FOR_TOOL', 'G_TARGETS', 'G_BINDS_SELECTOR', 'G_MAPS_TO', 'G_EXECUTES_FOR', 'G_EXECUTES_TOOL', 'G_USES_IDENTITY', 'G_VIA_CONNECTION', 'G_EXPOSES_OPERATION', 'G_OPERATION_TOOL', 'G_OWNED_BY', 'G_RESOURCE_OWNED_BY', 'G_USES_CREDENTIAL', 'G_DEPENDS_ON', 'G_DIRECT_ACCESS_FOR'];
+export type GuardRelation = (typeof MAP_RELATIONSHIPS)[number];
 export interface MapNode {
     readonly id: string;
     readonly entityId: string;
@@ -58,6 +58,36 @@ export interface MapPolicyEvidence {
     readonly assessment: 'unknown';
     readonly candidates: readonly MapPolicyCandidate[];
 }
+/** A bucket a tool's static identity has an identity-policy candidate on, outside that tool's bindings. */
+export interface MapIdentityExtraResource {
+    readonly resourceId: string;
+    readonly bucketName: string;
+    readonly relationship: MapPolicyCandidate['relationship'];
+    readonly hasCondition: boolean;
+    readonly conditionKeys: readonly string[];
+}
+/** C2: what a tool's execution identity reaches compared with what that tool's grants bind. */
+export interface MapIdentityScope {
+    readonly executionBindingId: string;
+    readonly deploymentId: string | null;
+    readonly tool: string | null;
+    readonly identityId: string | null;
+    /** The identity's AWS account; candidates are collected per account, so only its buckets are checked. */
+    readonly accountId: string | null;
+    readonly status: 'broader_than_grants' | 'matches_grants' | 'unknown';
+    readonly reason: Exclude<MapPolicyEvidence['reason'], 'no_candidate' | 'unsupported_action' | 'unsupported_binding'> | 'unsupported_identity' | 'not_evaluated' | 'wildcard_grant' | 'binding_narrower_than_candidate' | 'grant_lineage_unknown' | 'truncated';
+    readonly observedAt: string | null;
+    readonly boundBuckets: readonly string[];
+    readonly extraResources: readonly MapIdentityExtraResource[];
+    readonly truncated: boolean;
+    /**
+     * `evidence_outside_visible_scope`: some extra buckets have no binding in your scope (another
+     * team's, or none). `bucket_list_shortened`: the list is cut; the status still stands.
+     */
+    readonly notes?: readonly string[];
+    readonly evidenceKind: 'iam_identity_policy_candidate';
+    readonly assessment: 'unknown';
+}
 export interface MapProjection {
     readonly id: string;
     readonly snapshotId: string;
@@ -68,6 +98,105 @@ export interface MapProjection {
     readonly coverage: MapCoverage;
     /** Current, independently checked policy evidence; omitted for summaries/history. */
     readonly policyEvidence?: readonly MapPolicyEvidence[];
+    /** Current identity-scope comparison per static execution binding; only for one-agent reads. */
+    readonly identityScope?: readonly MapIdentityScope[];
+    /**
+     * The same comparison limited to buckets that visible bindings map to; only for
+     * `outsideGuard` reads. `matches_grants` here covers only those buckets.
+     */
+    readonly identityReach?: readonly MapIdentityScope[];
+    /**
+     * Outside-guard reads for a team-scoped reader: false when the projection has no
+     * deployment or task outside the reader's read, so `none_found` can stand. Never a count.
+     */
+    readonly outsideVisibleScope?: boolean;
+    /** A boundary read had no room left for delegation ancestors and loaded none. */
+    readonly ancestorsNotLoaded?: boolean;
+    /** One-agent boundary reads for a team reader: host resource ids in its scope. */
+    readonly inScopeTargets?: readonly string[];
+    /**
+     * Boundary reads: for each tool the agent holds a `*` grant on, up to five in-scope bindings
+     * of that tool marked confidential or restricted. Read in place of loading every binding.
+     */
+    readonly wildcardSensitivity?: Readonly<Record<string, readonly {
+        readonly id: string;
+        readonly sensitivity: string;
+    }[]>>;
+    /** `undeclared` reads only: activity in this projection that no declared agent accounts for. */
+    readonly undeclared?: MapUndeclaredActivity;
+    /**
+     * A `policy.optional` read found more task/binding/action pairs than one read evaluates and
+     * loaded no policy evidence. Its coverage is unknown, never `not_collected`.
+     */
+    readonly policyEvidenceNotLoaded?: boolean;
+}
+/** A task seen through an enrolled executor that no manifest task binding assigns to a declared agent. */
+export interface MapUndeclaredTask {
+    readonly id: string;
+    readonly taskId: string;
+    readonly principalId: string | null;
+    readonly delegated: boolean | null;
+    readonly derived: boolean | null;
+    readonly revoked: boolean | null;
+    /** Its direct parent or source task is assigned to a declared agent: likely that agent's sub-task. */
+    readonly parentDeclared: boolean;
+    /** Tools the task holds a declared grant on, at most 32. */
+    readonly tools: readonly string[];
+    readonly toolsTruncated: boolean;
+}
+/** A caller principal none of whose tasks is assigned to a declared agent. */
+export interface MapUndeclaredPrincipal {
+    readonly id: string;
+    readonly principalId: string;
+    /** Its tasks in this projection, counted up to 1,000. */
+    readonly tasks: number;
+    readonly tasksCapped: boolean;
+}
+/** Only for `undeclared` reads (all-teams readers). Counting stops at 10,000: `*Capped` means "at least". */
+export interface MapUndeclaredActivity {
+    readonly tasks: number;
+    readonly tasksCapped: boolean;
+    readonly principals: number;
+    readonly principalsCapped: boolean;
+    readonly page?: {
+        readonly kind: 'tasks';
+        readonly items: readonly MapUndeclaredTask[];
+    } | {
+        readonly kind: 'principals';
+        readonly items: readonly MapUndeclaredPrincipal[];
+    };
+}
+/** One enrolled AWS account's collection, judged for an `unclaimedIdentities` read. */
+export interface MapCloudAccount {
+    readonly tenantId: string;
+    readonly partition: string;
+    readonly accountId: string;
+    readonly status: 'complete' | 'unknown';
+    readonly reason: 'collection_invalid' | 'stale' | 'changed' | 'limit_exceeded' | 'claims_limit_exceeded' | null;
+    readonly observedAt: string | null;
+    /** IAM roles and users in the collection, and how many of them no declared binding names; null when unknown. */
+    readonly observed: number | null;
+    readonly unclaimed: number | null;
+}
+/** An IAM role or user in a complete, fresh collection whose ARN no declared execution binding names. */
+export interface MapUnclaimedIdentity {
+    readonly arn: string;
+    readonly kind: 'role' | 'user';
+    readonly name: string;
+    readonly path: string;
+    readonly tenantId: string;
+    readonly partition: string;
+    readonly accountId: string;
+}
+/** Only for `unclaimedIdentities` reads (all-teams readers). */
+export interface MapUnclaimedIdentities {
+    readonly accounts: readonly MapCloudAccount[];
+    /** One page over the complete accounts, ordered by ARN. */
+    readonly identities: readonly MapUnclaimedIdentity[];
+    /** Unclaimed identities across the complete accounts. */
+    readonly total: number;
+    /** Some declared execution binding names no identity, so a listed identity may be its own. */
+    readonly bindingsWithoutIdentity: boolean;
 }
 export interface MapSource {
     readonly id: string;
@@ -79,13 +208,64 @@ export interface MapSource {
 }
 export interface MapView {
     readonly sources: readonly MapSource[];
+    /** `unclaimedIdentities` reads only. */
+    readonly unclaimedIdentities?: MapUnclaimedIdentities;
+}
+/** Narrows the policy evidence of a read to the pairs its caller will show. */
+export interface MapPolicySelection {
+    /** Only pairs of this task (native or entity id). */
+    readonly taskId?: string;
+    /** Only pairs of this tool. */
+    readonly tool?: string;
+    /** Only pairs of bindings with this exact resource reference or mapped ARN. */
+    readonly resourceRef?: string;
+    /** Only this action. */
+    readonly action?: string;
+    /** Past the pair limit, answer with `policyEvidenceNotLoaded` instead of failing the read. */
+    readonly optional?: boolean;
 }
 export interface MapReadRequest {
     readonly sourceId?: string;
     readonly agentId?: string;
+    /** With agentId: also load boundary evidence (get_agent_access). */
+    readonly boundary?: boolean;
+    /** A flags read for a page of agents (1-100 native or entity ids), with one-agent rules. */
+    readonly agentIds?: readonly string[];
     readonly history?: boolean;
     /** Agent/deployment index only; avoids loading task neighborhoods before selecting an agent. */
     readonly summary?: boolean;
+    /** Full graph for boundary flags, without policy or identity evidence reads. */
+    readonly flags?: boolean;
+    /** Full graph plus identity reach limited to the buckets visible bindings map to. */
+    readonly outsideGuard?: boolean;
+    /**
+     * Owner index only (list_owners): agents, resource bindings and owners, plus, for a team
+     * reader, the nodes that decide which bindings are visible. No policy evidence.
+     */
+    readonly owners?: boolean;
+    /**
+     * Policy evidence of the current projection. Omitted: every visible task/binding/action pair,
+     * at most 512 per read (more fails the read). `false`: none, so the read is not bound by
+     * that limit. An object narrows the pairs. Summary, history, flags, owner and discovery
+     * reads never load policy evidence.
+     */
+    readonly policy?: false | MapPolicySelection;
+    /**
+     * All-teams readers only. Per source, counts of tasks and caller principals that no declared
+     * agent accounts for; no nodes are loaded. With `sourceId` and `page`, also one page of them.
+     */
+    readonly undeclared?: boolean;
+    /**
+     * All-teams readers only, never with `sourceId`. IAM roles and users of the enrolled AWS
+     * collections that no declared execution binding names, one `page` at a time.
+     */
+    readonly unclaimedIdentities?: boolean;
+    /** `kind` is required with `undeclared` and refused with `unclaimedIdentities`. */
+    readonly page?: {
+        readonly kind?: 'tasks' | 'principals';
+        readonly offset: number;
+        readonly limit: number;
+    };
 }
 export interface MapStore {
     read(scope: ReadScope, request?: MapReadRequest): Promise<MapView>;

package/dist/types.js

@@ -1,4 +1,4 @@
-import { immutableJson } from '@shieldaai/agent-guard';
+import { immutableJson } from '@shieldaai/agent-guard/internal';
 export class MapQueryError extends Error {
     code;
     constructor(code) {
@@ -7,15 +7,52 @@ export class MapQueryError extends Error {
         this.name = 'MapQueryError';
     }
 }
-export const MAP_LABELS = ['GuardAgent', 'GuardDeployment', 'GuardTask', 'GuardPrincipal', 'GuardGrant',
-    'GuardTool', 'GuardResource', 'GuardResourceBinding', 'GuardExecutionBinding', 'GuardExternalResource',
-    'GuardExternalIdentity', 'GuardMcpConnection', 'GuardMcpOperation'];
-export const MAP_RELATIONSHIPS = ['G_INSTANCE_OF', 'G_ASSIGNED_TO', 'G_ACTS_AS', 'G_DELEGATED_FROM',
-    'G_DERIVED_FROM', 'G_HAS_GRANT', 'G_FOR_TOOL', 'G_TARGETS', 'G_BINDS_SELECTOR', 'G_MAPS_TO',
-    'G_EXECUTES_FOR', 'G_EXECUTES_TOOL', 'G_USES_IDENTITY', 'G_VIA_CONNECTION', 'G_EXPOSES_OPERATION',
-    'G_OPERATION_TOOL'];
+export const MAP_LABELS = [
+    'GuardAgent',
+    'GuardDeployment',
+    'GuardTask',
+    'GuardPrincipal',
+    'GuardGrant',
+    'GuardTool',
+    'GuardResource',
+    'GuardResourceBinding',
+    'GuardExecutionBinding',
+    'GuardExternalResource',
+    'GuardExternalIdentity',
+    'GuardMcpConnection',
+    'GuardMcpOperation',
+    'GuardOwner',
+    'GuardCredentialReference',
+    'GuardDirectAccess',
+];
+export const MAP_RELATIONSHIPS = [
+    'G_INSTANCE_OF',
+    'G_ASSIGNED_TO',
+    'G_ACTS_AS',
+    'G_DELEGATED_FROM',
+    'G_DERIVED_FROM',
+    'G_HAS_GRANT',
+    'G_FOR_TOOL',
+    'G_TARGETS',
+    'G_BINDS_SELECTOR',
+    'G_MAPS_TO',
+    'G_EXECUTES_FOR',
+    'G_EXECUTES_TOOL',
+    'G_USES_IDENTITY',
+    'G_VIA_CONNECTION',
+    'G_EXPOSES_OPERATION',
+    'G_OPERATION_TOOL',
+    'G_OWNED_BY',
+    'G_RESOURCE_OWNED_BY',
+    'G_USES_CREDENTIAL',
+    'G_DEPENDS_ON',
+    'G_DIRECT_ACCESS_FOR',
+];
 export function mapIdentifier(value, code = 'MAP_REQUEST_INVALID') {
-    if (typeof value !== 'string' || !value.trim() || [...value].length > 4096 || value.includes('\0') ||
+    if (typeof value !== 'string' ||
+        !value.trim() ||
+        [...value].length > 4096 ||
+        value.includes('\0') ||
         /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/u.test(value))
         throw new MapQueryError(code);
     return value;
@@ -23,7 +60,9 @@ export function mapIdentifier(value, code = 'MAP_REQUEST_INVALID') {
 export function validateReadScope(value) {
     try {
         const copied = immutableJson(value, 4, 1024, 64 * 1024);
-        if (!copied || Array.isArray(copied) || typeof copied !== 'object' ||
+        if (!copied ||
+            Array.isArray(copied) ||
+            typeof copied !== 'object' ||
             Object.keys(copied).sort().join(',') !== 'allTeams,companyId,subject,teamIds,tenantIds')
             throw new Error();
         mapIdentifier(copied.subject);
@@ -32,7 +71,9 @@ export function validateReadScope(value) {
             throw new Error();
         for (const key of ['tenantIds', 'teamIds']) {
             const items = copied[key];
-            if (!Array.isArray(items) || items.length > 128 || (key === 'tenantIds' && items.length === 0) ||
+            if (!Array.isArray(items) ||
+                items.length > 128 ||
+                (key === 'tenantIds' && items.length === 0) ||
                 new Set(items).size !== items.length)
                 throw new Error();
             items.forEach(item => mapIdentifier(item));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shieldaai/agent-map",
-  "version": "0.1.0-alpha.3",
+  "version": "1.0.0",
   "description": "Read-only AI agent and MCP inventory queries over HTTP and MCP, with scoped access to Cartography projections.",
   "license": "Apache-2.0",
   "type": "module",
@@ -10,12 +10,25 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./service": {
+      "types": "./dist/service.d.ts",
+      "import": "./dist/service.js"
+    },
+    "./oidc": {
+      "types": "./dist/oidc.d.ts",
+      "import": "./dist/oidc.js"
+    },
+    "./identity-http": {
+      "types": "./dist/identity-http.d.ts",
+      "import": "./dist/identity-http.js"
     }
   },
   "bin": {
     "agent-guard-map": "./dist/cli.js",
     "agent-guard-map-identity": "./dist/identity-cli.js"
   },
+  "sideEffects": false,
   "files": [
     "dist",
     "README.md",
@@ -26,13 +39,13 @@
   },
   "dependencies": {
     "@modelcontextprotocol/server": "2.4.0",
-    "@shieldaai/agent-guard": "0.1.0-alpha.3",
+    "@shieldaai/agent-guard": "1.0.0",
     "neo4j-driver": "6.3.0",
     "openid-client": "6.8.8"
   },
   "publishConfig": {
     "access": "public",
-    "tag": "alpha"
+    "tag": "latest"
   },
   "repository": {
     "type": "git",