@vess-id/ai-identity 0.0.0-dev-20260902121045

package/dist/resolver/canonical-resource-id.d.ts

@@ -0,0 +1,37 @@
+/**
+ * THE single canonical resource-id function (INV-1). Consumed by Cedar-context,
+ * Gate-2 enforcement, and issuance so all participants agree byte-for-byte.
+ *
+ * Returns undefined when the action's binding cannot resolve a concrete id.
+ *
+ * The function is intentionally CONTEXT-FREE for the canonical id: the same
+ * (action, params) always yields the same string, with NO tenant qualification.
+ * This is what guarantees INV-1 across every participant — including agentd,
+ * which derives resource ids via its own extraction path and never qualifies.
+ * An earlier revision tenant-qualified calendar's default `primary`
+ * (`<tenant>:primary`) ONLY when a `tenant` ctx key was passed, but only ONE of
+ * the four api-side callers threaded it, so the same default-calendar write
+ * produced divergent strings (`<tenant>:primary` on Gate-2 vs bare `primary` on
+ * issuance/Cedar/agentd) — an INV-1 violation. That qualification has been
+ * removed (#884 Task 3 review, Option B).
+ *
+ * KNOWN LIMITATION: two tenants' default `primary` calendars share the id
+ * `primary`. This is NOT currently exploitable because calendar grants default
+ * to a wildcard resource (`pattern:'*'`), and Gate-2's
+ * `validateVCResourceConstraint` short-circuits on wildcard delegates, so the
+ * resource id is never compared cross-tenant. If calendar ever issues
+ * resource-pinned grants, tenant disambiguation must be re-introduced UNIFORMLY
+ * across ALL participants (api + agentd) at once, not on a single caller.
+ *
+ * TODO(#884-followup): if a resource-PINNED calendar grant is ever introduced
+ * (non-wildcard calendar resource), two tenants' `primary` would collide — solve
+ * tenant-qualification at the binding level for ALL participants (api + agentd)
+ * before that lands. Tracked as a #884 follow-up.
+ *
+ * @param ctx Binding context map forwarded to {@link TargetResolver.resolve}
+ *   for any `source: 'context'` bindings. (No registry binding is currently
+ *   context-sourced.) The previously-reserved `tenant` key no longer has special
+ *   meaning and is ignored for qualification.
+ */
+export declare function canonicalResourceId(action: string, params: Record<string, unknown> | undefined, ctx?: Record<string, string>): string | undefined;
+//# sourceMappingURL=canonical-resource-id.d.ts.map

package/dist/resolver/canonical-resource-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-resource-id.d.ts","sourceRoot":"","sources":["../../src/resolver/canonical-resource-id.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC3C,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,MAAM,GAAG,SAAS,CA8CpB"}

package/dist/resolver/compare-resource-id.d.ts

@@ -0,0 +1,37 @@
+/**
+ * THE single source of truth for resource-id EQUIVALENCE (#884).
+ *
+ * Pairs with {@link canonicalResourceId} (`./canonical-resource-id`):
+ *   - `canonicalResourceId` NORMALIZES an (action, params) pair into a single
+ *     canonical resource-id string.
+ *   - `compareResourceIds` COMPARES two resource-id strings (a credential's
+ *     constraint vs an incoming request's resource).
+ *
+ * Both api and remote-mcp import this from the SDK so every participant agrees
+ * byte-for-byte on what "the same resource" means.
+ *
+ * The comparison is intentionally 3-VALUED:
+ *   - 'match'         — definitely the same resource.
+ *   - 'mismatch'      — definitely a different resource.
+ *   - 'indeterminate' — one side is a provider-native id (e.g. a Slack channel
+ *                       id `C0123ABCD`) and the other is a human-readable name
+ *                       (e.g. `#general`). These cannot be resolved to a common
+ *                       form without calling the external provider API, so the
+ *                       caller MUST decide the safe side (fail-closed for
+ *                       enforcement, or defer to an API-backed resolution).
+ */
+export type ResourceMatch = 'match' | 'mismatch' | 'indeterminate';
+/**
+ * Check if a string looks like a provider-native resource ID
+ * (e.g., Slack channel IDs like "C0A159PP6QM", "D01234ABCDE", "G98765ZYXWV").
+ * Returns false for human-readable names like "#general" or "dev-weekly-report".
+ */
+export declare function looksLikeNativeId(value: string): boolean;
+/**
+ * Check if two resource identifiers can be compared at the remote-mcp level.
+ * When one is a native ID and the other is a human-readable name, we cannot
+ * determine equivalence without calling the external provider API (e.g., Slack).
+ * In that case, return 'indeterminate' so the caller can defer to the API side.
+ */
+export declare function compareResourceIds(credResourceId: string, requestResourceId: string): ResourceMatch;
+//# sourceMappingURL=compare-resource-id.d.ts.map

package/dist/resolver/compare-resource-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compare-resource-id.d.ts","sourceRoot":"","sources":["../../src/resolver/compare-resource-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,UAAU,GAAG,eAAe,CAAA;AAElE;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAgBxD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,cAAc,EAAE,MAAM,EACtB,iBAAiB,EAAE,MAAM,GACxB,aAAa,CAYf"}

package/dist/resolver/salient-digest.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Produce the deterministic canonical JSON string over ONLY the given salient
+ * `fields` of `params`. Field-list-explicit variant — the pure core that the
+ * golden vectors pin and that the action-aware wrappers delegate to.
+ *
+ * @throws if any selected value violates the number rules (float / non-finite)
+ *   or contains an unsupported value type.
+ */
+export declare function canonicalizeWithFields(fields: string[], params: Record<string, unknown>): string;
+/**
+ * `sha256:` + lowercase-hex sha256 of {@link canonicalizeWithFields}.
+ * Field-list-explicit variant.
+ */
+export declare function digestWithFields(fields: string[], params: Record<string, unknown>): string;
+/**
+ * Look up the action's declared approval-salient fields.
+ *
+ * As of Step 2 the registry declares `approval_salient_fields` (typed on
+ * `ActionMeta`) for every approval-gated action. The runtime guards below still
+ * defend against a malformed literal (the registry JSON is a widened object
+ * literal, not schema-validated at import time), returning `undefined` when the
+ * action is unknown or has no well-formed string[] salient set.
+ *
+ * @returns the declared salient field names, or `undefined` if the action is
+ *   unknown or has not declared a salient set.
+ */
+export declare function salientFieldsFor(action: string): string[] | undefined;
+/**
+ * Canonical JSON string over the action's declared salient set.
+ *
+ * Thin wrapper: resolves the field list via {@link salientFieldsFor} then
+ * delegates to {@link canonicalizeWithFields}.
+ *
+ * @throws if the action has no declared salient set — callers that may hit an
+ *   action without a set should gate on {@link salientFieldsFor} /
+ *   {@link salientDigest} (which returns `undefined`) first. Throwing here keeps
+ *   the "no set" case loud rather than silently canonicalizing `{}`.
+ */
+export declare function canonicalizeSalient(action: string, params: Record<string, unknown>): string;
+/**
+ * `sha256:` digest over the action's declared salient set.
+ *
+ * Thin wrapper: resolves the field list via {@link salientFieldsFor} then
+ * delegates to {@link digestWithFields}. Returns `undefined` when the action has
+ * no salient set (issuer omits `params_hash`; PEP skips the salient gate).
+ */
+export declare function salientDigest(action: string, params: Record<string, unknown>): string | undefined;
+//# sourceMappingURL=salient-digest.d.ts.map

package/dist/resolver/salient-digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"salient-digest.d.ts","sourceRoot":"","sources":["../../src/resolver/salient-digest.ts"],"names":[],"mappings":"AA4HA;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CA4BhG;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAI1F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAOrE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAM3F;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAIjG"}

package/dist/resolver/target-resolver.d.ts

@@ -0,0 +1,28 @@
+import { TargetBindings, ResolvedTargets } from '../types/target-binding';
+/**
+ * Extract the project key from a Jira issue key.
+ * Returns the project prefix (e.g., "AIDENTITY" from "AIDENTITY-35") or null if not a valid issue key.
+ *
+ * @remarks Project keys must be at least 2 uppercase characters, matching Jira's requirement.
+ * Single-letter keys (e.g., "A-1") return null.
+ */
+export declare function extractProjectKey(value: string): string | null;
+/**
+ * TargetResolver — extracts resource IDs and secondary targets from tool parameters.
+ *
+ * Pure function with no external dependencies (NestJS, DB, etc.).
+ * Used by the API layer to populate PolicyInput.request.resource.id and targets[].
+ */
+export declare class TargetResolver {
+    /**
+     * Resolve target bindings against tool invocation parameters.
+     *
+     * @param bindings - Target binding declarations from ACTION_REGISTRY
+     * @param params - Tool invocation parameters
+     * @param context - Optional pre-resolved context values (e.g., resource_id from URL)
+     */
+    resolve(bindings: TargetBindings, params: Record<string, unknown>, context?: Record<string, string>): ResolvedTargets;
+    private resolveBinding;
+    private resolveSecondary;
+}
+//# sourceMappingURL=target-resolver.d.ts.map

package/dist/resolver/target-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"target-resolver.d.ts","sourceRoot":"","sources":["../../src/resolver/target-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,eAAe,EAIhB,MAAM,yBAAyB,CAAA;AAShC;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG9D;AAED;;;;;GAKG;AACH,qBAAa,cAAc;IACzB;;;;;;OAMG;IACH,OAAO,CACL,QAAQ,EAAE,cAAc,EACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,eAAe;IAiBlB,OAAO,CAAC,cAAc;IAgDtB,OAAO,CAAC,gBAAgB;CAmBzB"}

package/dist/state/index.d.ts

@@ -0,0 +1,3 @@
+export { IStateStore } from './state-store.interface';
+export { JsonStateStore } from './json-state-store';
+//# sourceMappingURL=index.d.ts.map

package/dist/state/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/state/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/state/json-state-store.d.ts

@@ -0,0 +1,24 @@
+import { IStateStore } from './state-store.interface';
+/**
+ * JSON file-based state store.
+ * Stores state in ~/.vess/state.json by default.
+ * Uses atomic write (temp file → rename) for safety.
+ */
+export declare class JsonStateStore implements IStateStore {
+    private filePath;
+    private data;
+    constructor(filePath?: string);
+    get<T = unknown>(key: string): Promise<T | undefined>;
+    set<T = unknown>(key: string, value: T): Promise<void>;
+    delete(key: string): Promise<boolean>;
+    has(key: string): Promise<boolean>;
+    getAll(): Promise<Record<string, unknown>>;
+    clear(): Promise<void>;
+    /**
+     * Get the file path used by this store (useful for diagnostics)
+     */
+    getFilePath(): string;
+    private load;
+    private save;
+}
+//# sourceMappingURL=json-state-store.d.ts.map

package/dist/state/json-state-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-state-store.d.ts","sourceRoot":"","sources":["../../src/state/json-state-store.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAErD;;;;GAIG;AACH,qBAAa,cAAe,YAAW,WAAW;IAChD,OAAO,CAAC,QAAQ,CAAQ;IACxB,OAAO,CAAC,IAAI,CAAuC;gBAEvC,QAAQ,CAAC,EAAE,MAAM;IAIvB,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAKrD,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAMtD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUrC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKlC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAI1C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5B;;OAEG;IACH,WAAW,IAAI,MAAM;YAIP,IAAI;YAoBJ,IAAI;CAUnB"}

package/dist/state/state-store.interface.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Generic state store interface for persisting application state.
+ * Allows different backends: JSON file, SQLite, Postgres, etc.
+ */
+export interface IStateStore {
+    /**
+     * Get a value by key
+     * @param key Dot-notation key (e.g., "auth.token", "events.cursor")
+     * @returns The stored value, or undefined if not found
+     */
+    get<T = unknown>(key: string): Promise<T | undefined>;
+    /**
+     * Set a value by key
+     * @param key Dot-notation key
+     * @param value Value to store
+     */
+    set<T = unknown>(key: string, value: T): Promise<void>;
+    /**
+     * Delete a value by key
+     * @param key Dot-notation key
+     * @returns true if the key existed and was deleted
+     */
+    delete(key: string): Promise<boolean>;
+    /**
+     * Check if a key exists
+     */
+    has(key: string): Promise<boolean>;
+    /**
+     * Get all stored data as a plain object
+     */
+    getAll(): Promise<Record<string, unknown>>;
+    /**
+     * Clear all stored data
+     */
+    clear(): Promise<void>;
+}
+//# sourceMappingURL=state-store.interface.d.ts.map

package/dist/state/state-store.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-store.interface.d.ts","sourceRoot":"","sources":["../../src/state/state-store.interface.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAA;IAErD;;;;OAIG;IACH,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEtD;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAErC;;OAEG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAElC;;OAEG;IACH,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAE1C;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB"}

package/dist/storage/filesystem-key-storage.d.ts

@@ -0,0 +1,16 @@
+import { KeyStorageProvider, KeyStorageConfig } from './key-storage.interface';
+/**
+ * Filesystem-based key storage provider
+ */
+export declare class FilesystemKeyStorage implements KeyStorageProvider {
+    private keyStorePath;
+    constructor(config?: KeyStorageConfig);
+    store(id: string, encryptedKey: string): Promise<void>;
+    retrieve(id: string): Promise<string | null>;
+    delete(id: string): Promise<void>;
+    list(): Promise<string[]>;
+    isAvailable(): Promise<boolean>;
+    private ensureKeyStoreExists;
+    private getKeyPath;
+}
+//# sourceMappingURL=filesystem-key-storage.d.ts.map

package/dist/storage/filesystem-key-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem-key-storage.d.ts","sourceRoot":"","sources":["../../src/storage/filesystem-key-storage.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAE9E;;GAEG;AACH,qBAAa,oBAAqB,YAAW,kBAAkB;IAC7D,OAAO,CAAC,YAAY,CAAQ;gBAEhB,MAAM,CAAC,EAAE,gBAAgB;IAI/B,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMtD,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAa5C,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IASzB,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;YASvB,oBAAoB;IAQlC,OAAO,CAAC,UAAU;CAGnB"}

package/dist/storage/index.d.ts

@@ -0,0 +1,4 @@
+export * from './key-storage.interface';
+export * from './filesystem-key-storage';
+export * from './memory-key-storage';
+//# sourceMappingURL=index.d.ts.map

package/dist/storage/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAA;AACvC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA"}

package/dist/storage/key-storage.interface.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Interface for key storage persistence
+ * Allows different storage backends (filesystem, database, memory, etc.)
+ */
+export interface KeyStorageProvider {
+    /**
+     * Store an encrypted key
+     * @param id Unique identifier for the key (e.g., DID hash)
+     * @param encryptedKey Encrypted key data
+     */
+    store(id: string, encryptedKey: string): Promise<void>;
+    /**
+     * Retrieve an encrypted key
+     * @param id Unique identifier for the key
+     * @returns Encrypted key data, or null if not found
+     */
+    retrieve(id: string): Promise<string | null>;
+    /**
+     * Delete a key
+     * @param id Unique identifier for the key
+     */
+    delete(id: string): Promise<void>;
+    /**
+     * List all stored key identifiers
+     * @returns Array of key identifiers
+     */
+    list(): Promise<string[]>;
+    /**
+     * Check if the storage is available and initialized
+     */
+    isAvailable(): Promise<boolean>;
+}
+/**
+ * Configuration for key storage
+ */
+export interface KeyStorageConfig {
+    /** Storage type identifier */
+    type: string;
+    /** Storage-specific options */
+    options?: Record<string, any>;
+}
+//# sourceMappingURL=key-storage.interface.d.ts.map

package/dist/storage/key-storage.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-storage.interface.d.ts","sourceRoot":"","sources":["../../src/storage/key-storage.interface.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEtD;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAE5C;;;OAGG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjC;;;OAGG;IACH,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAEzB;;OAEG;IACH,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAC9B"}

package/dist/storage/memory-key-storage.d.ts

@@ -0,0 +1,17 @@
+import { KeyStorageProvider } from './key-storage.interface';
+/**
+ * In-memory key storage provider (for testing)
+ */
+export declare class MemoryKeyStorage implements KeyStorageProvider {
+    private keys;
+    store(id: string, encryptedKey: string): Promise<void>;
+    retrieve(id: string): Promise<string | null>;
+    delete(id: string): Promise<void>;
+    list(): Promise<string[]>;
+    isAvailable(): Promise<boolean>;
+    /**
+     * Clear all stored keys (for testing)
+     */
+    clear(): void;
+}
+//# sourceMappingURL=memory-key-storage.d.ts.map

package/dist/storage/memory-key-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-key-storage.d.ts","sourceRoot":"","sources":["../../src/storage/memory-key-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D;;GAEG;AACH,qBAAa,gBAAiB,YAAW,kBAAkB;IACzD,OAAO,CAAC,IAAI,CAAiC;IAEvC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItD,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI5C,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAIzB,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAIrC;;OAEG;IACH,KAAK,IAAI,IAAI;CAGd"}

package/dist/tool/tool-manager.d.ts

@@ -0,0 +1,44 @@
+import { ConnectorResponse } from '../types';
+import { VPManager } from '../vp/vp-manager';
+export interface ToolDefinition {
+    name: string;
+    description: string;
+    actions: {
+        name: string;
+        description: string;
+        parameters: Record<string, any>;
+    }[];
+}
+export declare class ToolManager {
+    private vpManager;
+    private tools;
+    private proxyApiUrl;
+    constructor(vpManager?: VPManager);
+    /**
+     * Invoke a tool action with VC authorization
+     */
+    invoke<T = any>(tool: string, action: string, params: Record<string, any>, options: {
+        vcs: string[];
+        holderDid: string;
+    }): Promise<ConnectorResponse<T>>;
+    /**
+     * List available tools
+     */
+    list(): ToolDefinition[];
+    /**
+     * Get a specific tool definition
+     */
+    getTool(name: string): ToolDefinition | undefined;
+    /**
+     * Register a custom tool
+     */
+    registerTool(tool: ToolDefinition): void;
+    /**
+     * Check if VCs authorize a tool action
+     */
+    checkAuthorization(vcs: string[], tool: string, action: string, resourceScope?: Record<string, any>): Promise<boolean>;
+    private matchScope;
+    private generateChallenge;
+    private registerDefaultTools;
+}
+//# sourceMappingURL=tool-manager.d.ts.map

package/dist/tool/tool-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-manager.d.ts","sourceRoot":"","sources":["../../src/tool/tool-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAG5C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAA;QACZ,WAAW,EAAE,MAAM,CAAA;QACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;KAChC,EAAE,CAAA;CACJ;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,SAAS,CAAW;IAC5B,OAAO,CAAC,KAAK,CAAyC;IACtD,OAAO,CAAC,WAAW,CAAQ;gBAEf,SAAS,CAAC,EAAE,SAAS;IAOjC;;OAEG;IACG,MAAM,CAAC,CAAC,GAAG,GAAG,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,EAAE;QACP,GAAG,EAAE,MAAM,EAAE,CAAA;QACb,SAAS,EAAE,MAAM,CAAA;KAClB,GACA,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAgHhC;;OAEG;IACH,IAAI,IAAI,cAAc,EAAE;IAIxB;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIjD;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI;IAIxC;;OAEG;IACG,kBAAkB,CACtB,GAAG,EAAE,MAAM,EAAE,EACb,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAClC,OAAO,CAAC,OAAO,CAAC;IAyBnB,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,oBAAoB;CAuO7B"}

package/dist/types/agent.d.ts

@@ -0,0 +1,139 @@
+import { DIDDocument } from './did';
+/**
+ * Agent Status enumeration
+ */
+export declare enum AgentStatus {
+    ACTIVE = "active",
+    SUSPENDED = "suspended",// @deprecated — kept for backward compatibility with existing DB rows
+    REVOKED = "revoked",// @deprecated — kept for backward compatibility with existing DB rows
+    DELETED = "deleted"
+}
+/**
+ * Agent Type enumeration
+ */
+export declare enum AgentType {
+    AUTONOMOUS = "autonomous",// Independent AI Agent
+    SUB_AGENT = "sub_agent",// Part of multi-agent system
+    TOOL_AGENT = "tool_agent",// Tool-specific agent
+    ASSISTANT = "assistant",// AI Assistant (Claude Code etc.)
+    PROXY = "proxy"
+}
+/**
+ * AI Agent Identity representation
+ * Agents are AI entities that need identity for permission delegation
+ */
+export interface Agent {
+    /** The DID associated with this agent */
+    did: string;
+    /** DID Document for the agent's identity */
+    didDocument: DIDDocument;
+    /** ISO 8601 timestamp of when the agent was created */
+    createdAt: string;
+    /** Optional metadata for the agent */
+    metadata?: Record<string, any>;
+}
+/**
+ * Extended Agent interface matching API entity structure
+ */
+export interface APIAgent {
+    /** Unique identifier */
+    id: string;
+    /** Agent's DID (Decentralized Identifier) */
+    did: string;
+    /** Agent's display name */
+    name: string;
+    /** Agent type */
+    type: AgentType;
+    /** Agent status */
+    status: AgentStatus;
+    /** Agent information */
+    agentInfo: {
+        model?: string;
+        capabilities?: string[];
+        configuration?: Record<string, any>;
+        [key: string]: any;
+    };
+    /** Additional metadata */
+    metadata?: Record<string, any>;
+    /** Owner user ID */
+    ownerId?: string;
+    /** Parent agent ID for hierarchical agents */
+    parentAgentId?: string;
+    /** Whether agent is currently active */
+    isActive: boolean;
+    /** Last activity timestamp */
+    lastActiveAt?: Date;
+    /** Creation timestamp */
+    createdAt: Date;
+    /** Update timestamp */
+    updatedAt: Date;
+}
+/**
+ * Agent with unique identifier
+ * Used for managing multiple agents with distinct identities
+ */
+export interface AgentWithId extends Agent {
+    /** Unique identifier for this agent instance */
+    id: string;
+}
+/**
+ * User Identity representation
+ * Users are human entities who issue VCs to agents
+ */
+export interface UserIdentity {
+    /** The DID associated with this user */
+    did: string;
+    /** DID Document for the user's identity */
+    didDocument: DIDDocument;
+    /** ISO 8601 timestamp of when the user identity was created */
+    createdAt: string;
+    /** Optional metadata for the user */
+    metadata?: Record<string, any>;
+}
+/**
+ * Configuration for Agent DID generation
+ */
+export interface AgentDIDConfig {
+    /** Whether to auto-generate DID for new agents */
+    generateDID: boolean;
+    /** DID method to use (currently only 'jwk' supported) */
+    didMethod: 'jwk';
+    /** Key type for cryptographic operations */
+    keyType: 'ES256';
+    /** Whether agent DIDs are ephemeral (deleted with agent) */
+    ephemeral: boolean;
+}
+/**
+ * Configuration for User Identity management
+ */
+export interface UserIdentityConfig {
+    /** Whether to auto-create user identity if none exists */
+    autoCreate: boolean;
+    /** DID method to use (currently only 'jwk' supported) */
+    didMethod: 'jwk';
+    /** Key type for cryptographic operations */
+    keyType: 'ES256';
+    /** Whether to support external DIDs (future feature) */
+    allowExternalDID: boolean;
+}
+/**
+ * Agent creation options
+ */
+export interface AgentCreateOptions {
+    /** Optional name for the agent */
+    name?: string;
+    /** Optional metadata to associate with the agent */
+    metadata?: Record<string, any>;
+    /** Override default DID generation behavior */
+    generateDID?: boolean;
+}
+/**
+ * User identity creation options
+ */
+export interface UserIdentityCreateOptions {
+    /** Optional metadata to associate with the user */
+    metadata?: Record<string, any>;
+    /** Force creation of new identity (replace existing) */
+    force?: boolean;
+}
+//# sourceMappingURL=agent.d.ts.map

package/dist/types/agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/types/agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAA;AAEnC;;GAEG;AACH,oBAAY,WAAW;IACrB,MAAM,WAAW;IACjB,SAAS,cAAc,CAAE,sEAAsE;IAC/F,OAAO,YAAY,CAAM,sEAAsE;IAC/F,OAAO,YAAY;CACpB;AAED;;GAEG;AACH,oBAAY,SAAS;IACnB,UAAU,eAAe,CAAO,uBAAuB;IACvD,SAAS,cAAc,CAAQ,6BAA6B;IAC5D,UAAU,eAAe,CAAM,sBAAsB;IACrD,SAAS,cAAc,CAAQ,kCAAkC;IACjE,KAAK,UAAU;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,KAAK;IACpB,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAA;IACX,4CAA4C;IAC5C,WAAW,EAAE,WAAW,CAAA;IACxB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAA;IACjB,sCAAsC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,wBAAwB;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAA;IACX,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,iBAAiB;IACjB,IAAI,EAAE,SAAS,CAAA;IACf,mBAAmB;IACnB,MAAM,EAAE,WAAW,CAAA;IACnB,wBAAwB;IACxB,SAAS,EAAE;QACT,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;QACvB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACnC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KACnB,CAAA;IACD,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9B,oBAAoB;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,8CAA8C;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,wCAAwC;IACxC,QAAQ,EAAE,OAAO,CAAA;IACjB,8BAA8B;IAC9B,YAAY,CAAC,EAAE,IAAI,CAAA;IACnB,yBAAyB;IACzB,SAAS,EAAE,IAAI,CAAA;IACf,uBAAuB;IACvB,SAAS,EAAE,IAAI,CAAA;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,KAAK;IACxC,gDAAgD;IAChD,EAAE,EAAE,MAAM,CAAA;CACX;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAA;IACX,2CAA2C;IAC3C,WAAW,EAAE,WAAW,CAAA;IACxB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAA;IACjB,qCAAqC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,kDAAkD;IAClD,WAAW,EAAE,OAAO,CAAA;IACpB,yDAAyD;IACzD,SAAS,EAAE,KAAK,CAAA;IAChB,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAA;IAChB,4DAA4D;IAC5D,SAAS,EAAE,OAAO,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,0DAA0D;IAC1D,UAAU,EAAE,OAAO,CAAA;IACnB,yDAAyD;IACzD,SAAS,EAAE,KAAK,CAAA;IAChB,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAA;IAChB,wDAAwD;IACxD,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,kCAAkC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9B,+CAA+C;IAC/C,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9B,wDAAwD;IACxD,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB"}

package/dist/types/audit.d.ts

@@ -0,0 +1,23 @@
+export interface AuditEvent {
+    id: string;
+    ts: string;
+    actorDid: string;
+    issuerDid: string;
+    vcId: string;
+    action: string;
+    resource?: string;
+    result: 'allow' | 'deny' | 'expired' | 'revoked';
+    requestId: string;
+    metadata?: Record<string, any>;
+}
+export interface AuditQuery {
+    actorDid?: string;
+    issuerDid?: string;
+    action?: string;
+    result?: AuditEvent['result'];
+    startTime?: string;
+    endTime?: string;
+    limit?: number;
+    offset?: number;
+}
+//# sourceMappingURL=audit.d.ts.map

package/dist/types/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/types/audit.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;IAChD,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAC/B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB"}

package/dist/types/cedar-policy.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Cedar-specific schema / policy / decision wire types.
+ *
+ * Phase 1 Step 2: Type-only declarations. The actual Cedar engine wrapper
+ * lives in Step 1's lane (`packages/sdk/src/policy/cedar-engine.ts` — not
+ * touched here). This module exposes the opaque handle types that other
+ * services (PEP, decision audit, policy registry) use to communicate
+ * *about* Cedar without depending on cedar-wasm internals.
+ *
+ * Spec refs:
+ * - docs/specs/2026-05-23-cedar-rar-implementation-plan-phase1.md Task 2.2
+ * - docs/specs/2026-05-23-cedar-rar-permission-redesign.md §3.3 (Cedar schema)
+ */
+/**
+ * Cedar schema (entity types + actions + context shapes).
+ *
+ * Opaque to AIdentity at the type level — the concrete JSON shape follows
+ * the Cedar spec and is produced by `connector-plugin` codegen. Treat
+ * instances as black-box payloads that round-trip through the Cedar engine.
+ */
+export interface CedarSchema {
+}
+/**
+ * Opaque handle returned by the Cedar engine after parsing / compiling a
+ * PolicySet. Implementations may store wasm pointers, validation state, etc.
+ * Consumers MUST NOT introspect the shape.
+ */
+export interface CedarPolicySetHandle {
+}
+/**
+ * Opaque handle returned by the Cedar engine after parsing / compiling a
+ * Schema. See {@link CedarPolicySetHandle} for usage notes.
+ */
+export interface CedarSchemaHandle {
+}
+/**
+ * 3-valued decision returned by the AIdentity Decision Service after the
+ * 2-phase Cedar evaluation.
+ *
+ * Mapping:
+ * - `Permit`           → Cedar Permit && no constraints failed
+ * - `Forbid`           → Cedar Forbid OR no matching permit
+ * - `RequireApproval`  → AIdentity-specific intermediate state (e.g.,
+ *                        high-risk action that needs human approval).
+ *                        Cedar itself only emits Permit / Forbid; the
+ *                        decision service derives `RequireApproval` from
+ *                        annotated policies or constraint-level escalation.
+ */
+export type CedarDecisionValue = 'Permit' | 'Forbid' | 'RequireApproval';
+/**
+ * Diagnostic information accompanying a Cedar decision. Surfaced to audit
+ * logs and (in shadow mode) to legacy/Cedar parity checks.
+ */
+export interface CedarDecisionDiagnostic {
+    /** IDs of the Cedar policies that matched the request (in evaluation order). */
+    matched_policy_ids: string[];
+    /** Cedar diagnostics passthrough (parse / validation errors, if any). */
+    errors: string[];
+}
+//# sourceMappingURL=cedar-policy.d.ts.map

package/dist/types/cedar-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cedar-policy.d.ts","sourceRoot":"","sources":["../../src/types/cedar-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;GAMG;AAEH,MAAM,WAAW,WAAW;CAE3B;AAED;;;;GAIG;AAEH,MAAM,WAAW,oBAAoB;CAEpC;AAED;;;GAGG;AAEH,MAAM,WAAW,iBAAiB;CAEjC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,QAAQ,GAAG,iBAAiB,CAAA;AAExE;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,gFAAgF;IAChF,kBAAkB,EAAE,MAAM,EAAE,CAAA;IAC5B,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB"}