@vess-id/ai-identity 0.0.0-dev-20260902121045

package/README.md

@@ -0,0 +1,265 @@
+# @vess-id/ai-identity
+
+TypeScript SDK for AI Identity Layer — secure delegation and permission management for AI agents using W3C Verifiable Credentials (VCs), Verifiable Presentations (VPs), and SD-JWT.
+
+## Installation
+
+```bash
+npm install @vess-id/ai-identity
+# or
+pnpm add @vess-id/ai-identity
+```
+
+## Quick Start
+
+```typescript
+import { AIdentityClient } from '@vess-id/ai-identity'
+
+// Initialize client
+const client = new AIdentityClient({
+  proxyApi: {
+    baseUrl: 'http://localhost:3000',
+  },
+})
+
+// Create agent with its own did:jwk identity
+const agent = await client.setup()
+
+// Issue a tool permission VC
+const vc = await client.issueToolPermission('slack', 'message.post', {
+  subjectDid: agent.did,
+  resourceScope: { channel: 'C123456' },
+  expiresIn: '1h',
+})
+
+// Invoke tool with VC authorization
+const result = await client.invokeTool(
+  'slack',
+  'message.post',
+  { channel: 'C123456', text: 'Hello from AI Agent!' },
+  [vc]
+)
+```
+
+## Architecture
+
+```
+User (Issuer)                Agent (Subject)              Service
+    │                            │                           │
+    ├─── issue VC ──────────────►│                           │
+    │    (permission grant)      │                           │
+    │                            ├─── present VP ───────────►│
+    │                            │    (prove permission)     │
+    │                            │◄──── response ────────────┤
+```
+
+- **Users** issue Verifiable Credentials to delegate permissions to agents
+- **Agents** create Verifiable Presentations to prove their permissions
+- **Services** verify VPs before executing operations
+
+## Core Modules
+
+### AIdentityClient
+
+The main orchestrator that provides access to all managers:
+
+```typescript
+const client = new AIdentityClient(config?, password?)
+
+client.agent   // AgentManager — agent creation, export/import, lifecycle
+client.user    // UserIdentityManager — user DID management
+client.vc      // VCManager — VC issuance (SD-JWT)
+client.vp      // VPManager — VP creation and verification
+client.tool    // ToolManager — tool invocation with VP authorization
+client.grant   // GrantManager — grant suggestion and confirmation
+```
+
+### Agent Management
+
+```typescript
+// Create agent with did:jwk identity
+const agent = await client.setup()
+
+// List agents
+const agents = await client.agent.list()
+
+// Export/import agent (including private key)
+const backup = await client.agent.export(agent.did)
+await client.agent.import(backup.agent, backup.privateKey)
+```
+
+Agent types: `autonomous`, `sub_agent`, `tool_agent`, `assistant`, `proxy`
+
+### Verifiable Credentials
+
+Issue SD-JWT VCs with selective disclosure:
+
+```typescript
+// Tool permission
+const vc = await client.issueToolPermission('github', 'issue.create', {
+  subjectDid: agent.did,
+  expiresIn: '24h',
+})
+
+// Data access
+const vc = await client.issueDataAccess('slack:channel', ['read'], {
+  subjectDid: agent.did,
+})
+```
+
+VC types: `ToolAccessCredential`, `ProjectAccessCredential`, `DeveloperCredential`, `TemporaryCredential`, `AdminCredential`, `ReceiptCredential`
+
+### Verifiable Presentations
+
+```typescript
+// Create VP (with holder binding via KB-JWT)
+const vp = await client.vp.create([vc1, vc2], {
+  holderDid: agent.did,
+  challenge: 'nonce-123',
+  domain: 'api.example.com',
+})
+
+// Verify VP
+const result = await client.vp.verify(vp, {
+  expectedChallenge: 'nonce-123',
+  expectedDomain: 'api.example.com',
+})
+```
+
+### Tool Invocation
+
+```typescript
+const result = await client.invokeTool<SlackResponse>(
+  'slack',
+  'message.post',
+  { channel: 'C123456', text: 'Hello!' },
+  [vc]
+)
+```
+
+## Action Registry
+
+All supported actions are defined in `ACTION_REGISTRY` using `provider.resource.operation` format:
+
+| Provider | Actions |
+|----------|---------|
+| **Slack** | `message.post`, `message.read`, `message.update`, `message.delete`, `channel.read`, `user.read`, `batch.read` |
+| **GitHub** | `issue.create`, `issue.list`, `issue.read`, `issue.update` |
+| **Gmail** | `message.search`, `message.read`, `message.send`, `label.read`, `batch.read` |
+| **Calendar** | Calendar operations |
+| **JIRA** | Issue management |
+| **OS** | Local operations |
+
+Each action defines: risk level, required relations, required scopes, input schema, constraints, and effects.
+
+```typescript
+import { ACTION_REGISTRY, indexActions } from '@vess-id/ai-identity'
+
+const actions = indexActions(ACTION_REGISTRY)
+const slackPost = actions.get('slack.message.post')
+// { risk: 'high', required_relations: ['editor', 'admin', ...], ... }
+```
+
+## Permission Constraints
+
+Fine-grained access control on VCs:
+
+```typescript
+interface PermissionConstraints {
+  time?: {
+    not_before?: number        // Unix timestamp
+    not_after?: number
+    recurring_start?: string   // "09:00"
+    recurring_end?: string     // "17:00"
+    days_of_week?: number[]    // [1,2,3,4,5] (Mon-Fri)
+    timezone?: string
+  }
+  max_invocations?: number
+  rate_limit_per_min?: number
+}
+```
+
+The `ConstraintEvaluator` checks: expiration, invocation limits, time windows, IP allowlists, and risk thresholds.
+
+## Registry Utilities
+
+```typescript
+import {
+  // Action normalization (MCP interop)
+  normalizeMcpActionName,
+  getAllValidMcpActionNames,
+
+  // Action aliases
+  canonicalizeAction,
+  isActionEquivalent,
+
+  // Providers
+  resolveProvider,
+  CANONICAL_PROVIDERS,  // 'slack' | 'github' | 'gmail' | 'calendar' | 'jira' | 'os'
+
+  // Access orchestration (ABAC/ReBAC)
+  resolveActionsFromSelection,
+  planDelegationForVC,
+  checkPermissionWithVP,
+} from '@vess-id/ai-identity'
+```
+
+## Gateway Client
+
+Event-based communication for CLI and daemon:
+
+```typescript
+import { GatewayClient } from '@vess-id/ai-identity'
+
+const gateway = new GatewayClient({ baseUrl: 'https://app.vesslabs.ai' })
+
+// Long-poll for events
+const { events, cursor } = await gateway.getEvents({
+  cursor: lastCursor,
+  waitSeconds: 30,
+})
+
+// Acknowledge processed event
+await gateway.ackEvent(event.id)
+```
+
+## Configuration
+
+```typescript
+interface AIdentityConfig {
+  didApi?: {
+    baseUrl: string
+    apiKey?: string
+    bearerToken?: string
+  }
+  issuerApi?: {
+    baseUrl: string
+    apiKey?: string
+    bearerToken?: string
+  }
+  verifierApi?: {
+    baseUrl: string
+    apiKey?: string
+    bearerToken?: string
+  }
+  proxyApi?: {
+    baseUrl: string
+  }
+  storage?: {
+    keyStorePath?: string  // Default: ~/.vess-aidentity/keys
+  }
+}
+```
+
+## Security
+
+- Agents use `did:jwk` identifiers with EC P-256 key pairs
+- Private keys are stored locally with optional password encryption
+- VCs use SD-JWT format with selective disclosure
+- VPs include nonce and domain binding to prevent replay attacks
+- All tool invocations require valid VP authorization
+- Constraint evaluation enforces time windows, invocation limits, IP allowlists, and risk thresholds
+
+## License
+
+MIT

package/dist/agent/agent-did-manager.d.ts

@@ -0,0 +1,97 @@
+import { KeyManager } from '../did/key-manager';
+export interface AgentDIDManagerOptions {
+    /**
+     * Directory holding the `<agentId>.did` files that map an agent ID to its DID.
+     *
+     * 🔴 Omit this and the default stays exactly what it has always been —
+     * `~/.vess-aidentity/agent-dids/`. Every mapping written so far lives there,
+     * so changing the default would make existing agents unresolvable.
+     *
+     * Supply it for either of two reasons:
+     *
+     * - **Tenant isolation.** With the path hard-coded to `os.homedir()`, one
+     *   process serving several tenants funnels all of them into a single shared
+     *   directory, where agent IDs can collide across tenants.
+     *
+     * - **Test isolation.** Tests could not otherwise steer this path away from
+     *   the developer's real home. Under jest, `process.env.HOME = x` does not
+     *   help: jest-environment-node replaces `process.env` with a plain object
+     *   behind a Proxy, so the assignment never reaches `setenv(3)`, while
+     *   `os.homedir()` goes through libuv to `getenv("HOME")` and reads the real
+     *   environ. Both reads and writes therefore escape to the real home and the
+     *   suite stays green while polluting it.
+     */
+    mappingDir?: string;
+}
+/**
+ * Agent DID Manager
+ * Manages DID generation and lifecycle for AI Agents specifically
+ */
+export declare class AgentDIDManager {
+    private keyManager;
+    private agentDIDMap;
+    private readonly mappingDirOverride?;
+    constructor(keyManager?: KeyManager, options?: AgentDIDManagerOptions);
+    /**
+     * 🔴 The one place the mapping directory is derived.
+     *
+     * It used to be derived independently in four methods, and two of them
+     * (`loadAgentDIDMapping` / `deleteAgentDIDMapping`) looked at `~/.vess/`
+     * while the writes went to `~/.vess-aidentity/`. Within a single process the
+     * in-memory Map answered first, so nobody noticed; across processes
+     * `getAgentDID` failed every time — whenever a long-lived host restarts, or
+     * on each Lambda invocation. The four copies are now one, so the paths
+     * cannot drift apart again.
+     *
+     * (An earlier version of this note named agentd as the example. It is not
+     * one: agentd resolves Agent DIDs through its own store — OS keychain plus
+     * SQLite, keyed by project × client — and takes only stateless primitives
+     * from this SDK. Nothing in this repo constructs an AgentDIDManager; the
+     * callers are SDK consumers.)
+     *
+     * The default resolves to `.vess-aidentity` because that is where the real
+     * files ended up; treating `.vess` as canonical would orphan every existing
+     * mapping.
+     */
+    private mappingDir;
+    /**
+     * Generate a new DID for an AI Agent
+     */
+    generateAgentDID(agentId: string): Promise<string>;
+    /**
+     * Get DID for a specific agent
+     */
+    getAgentDID(agentId: string): Promise<string>;
+    /**
+     * Check if agent has a DID
+     */
+    hasAgentDID(agentId: string): Promise<boolean>;
+    /**
+     * Get agent's key pair
+     */
+    getAgentKeyPair(agentId: string): Promise<any>;
+    /**
+     * Delete agent DID and associated keys
+     */
+    deleteAgentDID(agentId: string): Promise<void>;
+    /**
+     * List all agent DIDs
+     */
+    listAgentDIDs(): Promise<Array<{
+        agentId: string;
+        did: string;
+    }>>;
+    /**
+     * Save agent ID -> DID mapping to persistent storage
+     */
+    private saveAgentDIDMapping;
+    /**
+     * Load agent ID -> DID mapping from persistent storage
+     */
+    private loadAgentDIDMapping;
+    /**
+     * Delete agent ID -> DID mapping from persistent storage
+     */
+    private deleteAgentDIDMapping;
+}
+//# sourceMappingURL=agent-did-manager.d.ts.map

package/dist/agent/agent-did-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-did-manager.d.ts","sourceRoot":"","sources":["../../src/agent/agent-did-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAI/C,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;GAGG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,WAAW,CAAiC;IACpD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAQ;gBAEhC,UAAU,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,sBAAsB;IAKrE;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,UAAU;IASxB;;OAEG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBxD;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgBnD;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASpD;;OAEG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAcpD;;OAEG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBpD;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IA2BvE;;OAEG;YACW,mBAAmB;IAYjC;;OAEG;YACW,mBAAmB;IAcjC;;OAEG;YACW,qBAAqB;CAapC"}

package/dist/auth/auth-provider.d.ts

@@ -0,0 +1,51 @@
+import { IStateStore } from '../state/state-store.interface';
+import { GatewayClient, ApiKeyValidationResult } from '../gateway/gateway-client';
+/**
+ * Authentication state persisted in the StateStore
+ */
+export interface AuthState {
+    apiKey: string;
+    apiUrl: string;
+    userId?: string;
+    projectId?: string;
+    scopes?: string[];
+    authenticatedAt: string;
+}
+/**
+ * Authentication provider that validates API keys and persists auth state.
+ * Used by CLI and MCP to authenticate against the Gateway API.
+ */
+export declare class AuthProvider {
+    private stateStore;
+    private gatewayClient;
+    constructor(stateStore: IStateStore, gatewayClient: GatewayClient);
+    /**
+     * Authenticate with an API key. Validates against the Gateway and
+     * persists the result in the StateStore.
+     *
+     * @returns The validation result
+     */
+    login(apiKey: string, apiUrl: string, projectId?: string): Promise<ApiKeyValidationResult>;
+    /**
+     * Get the current auth state from the StateStore.
+     * Returns undefined if not authenticated.
+     */
+    getAuthState(): Promise<AuthState | undefined>;
+    /**
+     * Check if we have stored auth credentials
+     */
+    isAuthenticated(): Promise<boolean>;
+    /**
+     * Clear auth state (logout)
+     */
+    logout(): Promise<void>;
+    /**
+     * Get the stored API key, or undefined if not authenticated
+     */
+    getApiKey(): Promise<string | undefined>;
+    /**
+     * Get the stored API URL, or undefined if not authenticated
+     */
+    getApiUrl(): Promise<string | undefined>;
+}
+//# sourceMappingURL=auth-provider.d.ts.map

package/dist/auth/auth-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider.d.ts","sourceRoot":"","sources":["../../src/auth/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAA;AAEjF;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,eAAe,EAAE,MAAM,CAAA;CACxB;AAED;;;GAGG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,aAAa,CAAe;gBAExB,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa;IAKjE;;;;;OAKG;IACG,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAkBhG;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAIpD;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAKzC;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAK9C;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAI/C"}

package/dist/auth/index.d.ts

@@ -0,0 +1,2 @@
+export { AuthProvider, AuthState } from './auth-provider';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/client.d.ts

@@ -0,0 +1,63 @@
+import { type AIdentityConfig } from './config';
+import { AgentManager } from './did/agent';
+import { UserIdentityManager } from './identity/user-identity-manager';
+import { VCManager } from './vc/vc-manager';
+import { VPManager } from './vp/vp-manager';
+import { ToolManager } from './tool/tool-manager';
+import { GrantManager } from './grant/grant-manager';
+import { Agent, ConnectorResponse } from './types';
+export declare class AIdentityClient {
+    readonly agent: AgentManager;
+    readonly user: UserIdentityManager;
+    readonly vc: VCManager;
+    readonly vp: VPManager;
+    readonly tool: ToolManager;
+    readonly grant: GrantManager;
+    private keyManager;
+    private currentAgent?;
+    constructor(config?: AIdentityConfig, password?: string);
+    /**
+     * Quick setup: Create or load an agent
+     */
+    setup(did?: string): Promise<Agent>;
+    /**
+     * Get current agent
+     */
+    getCurrentAgent(): Agent | undefined;
+    /**
+     * Get current user DID
+     */
+    getCurrentUserDID(): Promise<string>;
+    /**
+     * Create or reset user identity
+     */
+    resetUserIdentity(): Promise<string>;
+    /**
+     * Issue a VC for tool permission
+     * Enhanced to support User → Agent delegation pattern
+     */
+    issueToolPermission(tool: string, action: string, options: {
+        subjectDid?: string;
+        agentId?: string;
+        issuerDid?: string;
+        resourceScope?: Record<string, any>;
+        expiresIn?: string;
+    }): Promise<string>;
+    /**
+     * Issue a VC for data access
+     * Enhanced to support User → Agent delegation pattern
+     */
+    issueDataAccess(resource: string, actions: ('read' | 'write' | 'delete')[], options: {
+        subjectDid?: string;
+        agentId?: string;
+        issuerDid?: string;
+        expiresIn?: string;
+    }): Promise<string>;
+    /**
+     * Invoke a tool with automatic VP creation
+     */
+    invokeTool<T = any>(tool: string, action: string, params: Record<string, any>, vcs: string[]): Promise<ConnectorResponse<T>>;
+}
+export declare function getClient(config?: AIdentityConfig, password?: string): AIdentityClient;
+export { configure, type AIdentityConfig } from './config';
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAa,MAAM,UAAU,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAElD,qBAAa,eAAe;IAC1B,SAAgB,KAAK,EAAE,YAAY,CAAA;IACnC,SAAgB,IAAI,EAAE,mBAAmB,CAAA;IACzC,SAAgB,EAAE,EAAE,SAAS,CAAA;IAC7B,SAAgB,EAAE,EAAE,SAAS,CAAA;IAC7B,SAAgB,IAAI,EAAE,WAAW,CAAA;IACjC,SAAgB,KAAK,EAAE,YAAY,CAAA;IAEnC,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,YAAY,CAAC,CAAO;gBAEhB,MAAM,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,MAAM;IAuBvD;;OAEG;IACG,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAWzC;;OAEG;IACH,eAAe,IAAI,KAAK,GAAG,SAAS;IAIpC;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI1C;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI1C;;;OAGG;IACG,mBAAmB,CACvB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;QACP,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACnC,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,GACA,OAAO,CAAC,MAAM,CAAC;IAiBlB;;;OAGG;IACG,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC,EAAE,EACxC,OAAO,EAAE;QACP,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,GACA,OAAO,CAAC,MAAM,CAAC;IAgBlB;;OAEG;IACG,UAAU,CAAC,CAAC,GAAG,GAAG,EACtB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,GAAG,EAAE,MAAM,EAAE,GACZ,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;CAWjC;AAKD,wBAAgB,SAAS,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,eAAe,CAKtF;AAED,OAAO,EAAE,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,UAAU,CAAA"}

package/dist/config/index.d.ts

@@ -0,0 +1,84 @@
+import type { KeyStorageProvider } from '../storage/key-storage.interface';
+export interface AIdentityConfig {
+    didApi?: {
+        baseUrl: string;
+        apiKey?: string;
+        bearerToken?: string;
+    };
+    issuerApi?: {
+        baseUrl: string;
+        apiKey?: string;
+        bearerToken?: string;
+    };
+    verifierApi?: {
+        baseUrl: string;
+        apiKey?: string;
+        bearerToken?: string;
+    };
+    proxyApi?: {
+        baseUrl: string;
+    };
+    storage?: {
+        keyStorePath?: string;
+    };
+    /**
+     * Where agentId → DID mappings are kept.
+     *
+     * 🔴 Leave it unset and the default is unchanged: `~/.vess-aidentity/agent-dids`.
+     * Every mapping written so far lives there, so moving the default would make
+     * existing agents unresolvable.
+     *
+     * Set it when a single process serves several tenants — otherwise they all
+     * share one directory and agent IDs can collide across them — or when a test
+     * must not touch the developer's real home.
+     *
+     * Reaches `AgentDIDManager` through `AgentManager`; without this field a
+     * caller could implement nothing and had no way to move the path, the same
+     * gap `keyStorage` closed for private keys.
+     */
+    agentMappingDir?: string;
+    /**
+     * Where the user DID (`user-did.txt`) is kept.
+     *
+     * 🔴 Leave it unset and the default is unchanged: `~/.vess-aidentity`. Note
+     * this is the config root itself, not a subdirectory — the user DID is one
+     * fixed filename sitting alongside `keys/` and `agent-dids/`. Moving the
+     * default would orphan the existing identity, and every VC issued so far
+     * names that DID as its issuer.
+     *
+     * Set it when a single process serves several tenants — the filename is
+     * fixed, so without it the last `createUserDID` overwrites every other
+     * tenant's issuer identity — or when a test must not touch the developer's
+     * real home.
+     *
+     * Reaches `UserIdentityManager` through `AIdentityClient`; separate from
+     * `agentMappingDir` because the two point at different directories and a
+     * caller may well want to move only one.
+     */
+    userMappingDir?: string;
+    /**
+     * Where private keys are kept.
+     *
+     * 🔴 Supply this when the filesystem is not durable. On AWS Lambda and
+     * similar, the default provider writes to a disk that is wiped between
+     * invocations, so keys fail to persist SILENTLY — nothing throws at
+     * construction, and the failure surfaces later as a key that cannot be
+     * found.
+     *
+     * `KeyManager` has always accepted a provider; what was missing was a way
+     * to reach it from here, so a client could implement the interface and had
+     * nowhere to put the result. Distinct from `storage.keyStorePath`, which
+     * only moves the filesystem provider's directory and cannot replace it.
+     *
+     * Implement `KeyStorageProvider` against S3, DynamoDB, Secrets Manager or
+     * anything else; `MemoryKeyStorage` is exported for the ephemeral case.
+     */
+    keyStorage?: KeyStorageProvider;
+}
+export declare function configure(config: AIdentityConfig): void;
+export declare function getConfig(): AIdentityConfig;
+export declare function getDidApiUrl(path: string): string;
+export declare function getIssuerApiUrl(path: string): string;
+export declare function getVerifierApiUrl(path: string): string;
+export declare function getApiHeaders(apiType: 'did' | 'issuer' | 'verifier'): any;
+//# sourceMappingURL=index.d.ts.map

package/dist/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AAE1E,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE;QACP,OAAO,EAAE,MAAM,CAAA;QACf,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB,CAAA;IACD,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,MAAM,CAAA;QACf,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB,CAAA;IACD,WAAW,CAAC,EAAE;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB,CAAA;IACD,QAAQ,CAAC,EAAE;QACT,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD,OAAO,CAAC,EAAE;QACR,YAAY,CAAC,EAAE,MAAM,CAAA;KACtB,CAAA;IAED;;;;;;;;;;;;;;OAcG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;;;;;;;;;;;;;;;;OAiBG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAA;CAChC;AAID,wBAAgB,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAEvD;AAED,wBAAgB,SAAS,IAAI,eAAe,CAE3C;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMjD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMpD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMtD;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,KAAK,GAAG,QAAQ,GAAG,UAAU,GAAG,GAAG,CA+BzE"}