@vess-id/ai-identity 0.0.0-dev-20260902121045

package/dist/types/permission-vc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-vc.d.ts","sourceRoot":"","sources":["../../src/types/permission-vc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAA;AAEjF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAA;IACZ,oEAAoE;IACpE,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAMD;;;;;;;;;GASG;AACH,MAAM,WAAW,wBAAwB;IACvC,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,uBAAuB;IACvB,IAAI,CAAC,EAAE,wBAAwB,CAAA;IAC/B,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,0CAA0C;IAC1C,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,kBAAkB,EAAE,gBAAgB,EAAE,CAAA;CACxD;AAMD;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,CAAA;IACd,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAA;IACrB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,WAAW,CAAA;IACjB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAA;IACjB,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAA;IAClB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,eAAe,GAAG,kBAAkB,CAAA;AAE5D,8CAA8C;AAC9C,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,GAAG,IAAI,eAAe,CAExE;AAED,iDAAiD;AACjD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,SAAS,GAAG,GAAG,IAAI,kBAAkB,CAE9E;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,EAAE,CAAC,EAAE,MAAM,CAAA;IACX;;;;;OAKG;IACH,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,CAAA;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,uBAAuB;IACvB,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAA;IAC3B,sBAAsB;IACtB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,6EAA6E;IAC7E,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,6BAA6B;IAC7B,WAAW,CAAC,EAAE,qBAAqB,CAAA;IACnC;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,SAAS,CAAA;IACtB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,SAAS,EAAE,CAAA;CAC1B;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,qBAAqB;IACpC,qBAAqB;IACrB,CAAC,EAAE,GAAG,CAAA;IACN,oCAAoC;IACpC,IAAI,EAAE,sBAAsB,CAAA;IAC5B,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAA;IACX,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAA;IACX,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAA;IACX,iBAAiB;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,4BAA4B;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,yEAAyE;IACzE,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iDAAiD;IACjD,GAAG,CAAC,EAAE;QACJ,2DAA2D;QAC3D,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAC7B,CAAA;IACD,+DAA+D;IAC/D,SAAS,EAAE,cAAc,EAAE,CAAA;CAC5B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAA;IAClB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAA;IAClB,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,2BAA2B;IAC1C,2DAA2D;IAC3D,UAAU,EAAE;QACV,2CAA2C;QAC3C,UAAU,EAAE,MAAM,EAAE,CAAA;QACpB,yDAAyD;QACzD,WAAW,EAAE,MAAM,CAAA;QACnB,uDAAuD;QACvD,SAAS,EAAE,MAAM,CAAA;QACjB,iEAAiE;QACjE,QAAQ,EAAE,MAAM,CAAA;KACjB,CAAA;IACD,oEAAoE;IACpE,kBAAkB,EAAE,MAAM,CAAA;IAC1B,mEAAmE;IACnE,YAAY,EAAE;QAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAA;IAC5D,wEAAwE;IACxE,eAAe,EAAE,MAAM,CAAA;IACvB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;;;;;;OAYG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,qBAAsB,SAAQ,IAAI,CAAC,qBAAqB,EAAE,GAAG,CAAC;IAC7E,oFAAoF;IACpF,CAAC,EAAE,GAAG,CAAA;IACN;;;OAGG;IACH,gBAAgB,CAAC,EAAE;QACjB,yCAAyC;QACzC,SAAS,EAAE,MAAM,CAAA;QACjB,2CAA2C;QAC3C,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;IACD;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,YAAY,GAAG,YAAY,GAAG,kBAAkB,GAAG,sBAAsB,CAAA;IACjF;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAA;IAC1B;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,2BAA2B,CAAA;IAClD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,aAAa,CAAC,EAAE,eAAe,GAAG,aAAa,GAAG,YAAY,CAAA;IAC9D;;;;;;;;;;;;;;;;OAgBG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,kBAAkB,GAAG,qBAAqB,GAAG,qBAAqB,CAAA;AAE9E;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG;IAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAKhG;AAMD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,WAAW;IAC1B,kCAAkC;IAClC,OAAO,EAAE;QACP,gBAAgB;QAChB,SAAS,EAAE,MAAM,CAAA;QACjB,iBAAiB;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,2BAA2B;QAC3B,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,qBAAqB;IACrB,MAAM,EAAE;QACN,iBAAiB;QACjB,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;IACD,gDAAgD;IAChD,OAAO,EAAE;QACP,uBAAuB;QACvB,QAAQ,EAAE,MAAM,CAAA;QAChB,wBAAwB;QACxB,MAAM,EAAE,MAAM,CAAA;QACd,sBAAsB;QACtB,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM,CAAA;YACZ,EAAE,EAAE,MAAM,CAAA;YACV,2EAA2E;YAC3E,UAAU,CAAC,EAAE,MAAM,CAAA;SACpB,CAAA;QACD,0EAA0E;QAC1E,OAAO,CAAC,EAAE,OAAO,kBAAkB,EAAE,YAAY,EAAE,CAAA;QACnD,oDAAoD;QACpD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KACjC,CAAA;IACD,uCAAuC;IACvC,WAAW,EAAE;QACX,aAAa;QACb,GAAG,EAAE,MAAM,CAAA;QACX,uBAAuB;QACvB,SAAS,EAAE,MAAM,EAAE,CAAA;QACnB,uBAAuB;QACvB,QAAQ,EAAE,MAAM,CAAA;QAChB,0BAA0B;QAC1B,SAAS,EAAE,MAAM,CAAA;QACjB,2BAA2B;QAC3B,UAAU,EAAE,MAAM,CAAA;QAClB,yCAAyC;QACzC,SAAS,EAAE,cAAc,EAAE,CAAA;KAC5B,CAAA;IACD,sDAAsD;IACtD,WAAW,EAAE;QACX,+BAA+B;QAC/B,GAAG,EAAE,MAAM,CAAA;QACX,wBAAwB;QACxB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,yBAAyB;QACzB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,6CAA6C;QAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAC1B,CAAA;CACF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAA;IAChB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,mCAAmC;IACnC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAMD;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,uBAAuB;IACvB,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAA;IAC3B,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,sBAAsB;IACtB,QAAQ,EAAE;QACR,IAAI,EAAE,MAAM,CAAA;QACZ,EAAE,EAAE,MAAM,CAAA;KACX,CAAA;IACD,iBAAiB;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,iBAAiB;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAMD;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAY5E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAqB1F;AAMD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,EAAG,kBAA2B,CAAA;AAE3D,gDAAgD;AAChD,MAAM,MAAM,aAAa,GAAG,OAAO,gBAAgB,CAAA;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,IAAI,CAAC,qBAAqB,EAAE,OAAO,CAAC,GACzC,qBAAqB,GAAG;IAAE,KAAK,EAAE,aAAa,CAAA;CAAE,CAElD"}

package/dist/types/receipt.d.ts

@@ -0,0 +1,133 @@
+/**
+ * Receipt（証跡）関連の型定義
+ * VESS AI Agent Permission Gateway MVP
+ */
+import { Grant } from './grant';
+/**
+ * Receipt（証跡）の状態
+ */
+export declare enum ReceiptStatus {
+    VALID = "valid",
+    EXPIRED = "expired",
+    REVOKED = "revoked"
+}
+/**
+ * 実行結果
+ */
+export type ReceiptOutcome = 'success' | 'failure' | 'denied';
+/**
+ * Receipt（証跡）
+ * 許可に基づく実行であることを示す検証可能な記録
+ */
+export interface Receipt {
+    /** 一意識別子 */
+    id: string;
+    /** 基となったGrantのID */
+    grantId: string;
+    /** Grant名（参照用） */
+    grantName?: string;
+    /** 対応するAuditEventのID */
+    auditEventId: string;
+    /** Intent内容のハッシュ（SHA-256） */
+    intentHash: string;
+    /** 実行結果 */
+    outcome: ReceiptOutcome;
+    /** 発行者による署名（JWS形式） */
+    signature: string;
+    /** 署名者DID */
+    issuerDid: string;
+    /** 実行したAgent/User DID */
+    executorDid: string;
+    /** 実行アクション */
+    action: string;
+    /** 対象リソース */
+    resource?: string;
+    /** 発行日時 */
+    issuedAt: string;
+    /** 検証日時 */
+    verifiedAt?: string;
+    /** ステータス */
+    status: ReceiptStatus;
+    /** メタデータ */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Receipt作成リクエスト
+ */
+export interface CreateReceiptRequest {
+    /** GrantのID */
+    grantId: string;
+    /** AuditEventのID */
+    auditEventId: string;
+    /** Intent内容 */
+    intent: {
+        action: string;
+        resource?: string;
+        parameters?: Record<string, unknown>;
+    };
+    /** 実行結果 */
+    outcome: ReceiptOutcome;
+    /** 実行者DID */
+    executorDid: string;
+    /** メタデータ */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Receipt検証リクエスト
+ */
+export interface VerifyReceiptRequest {
+    /** ReceiptのID（署名から検証する場合は省略可） */
+    receiptId?: string;
+    /** 署名（IDから検証する場合は省略可） */
+    signature?: string;
+}
+/**
+ * Receipt検証結果
+ */
+export interface VerifyReceiptResult {
+    /** 検証結果 */
+    valid: boolean;
+    /** Receipt情報 */
+    receipt?: Receipt;
+    /** 関連Grant情報 */
+    grant?: Grant;
+    /** エラーメッセージ */
+    error?: string;
+    /** 検証日時 */
+    verifiedAt?: string;
+}
+/**
+ * Receipt検索クエリ
+ */
+export interface ReceiptSearchQuery {
+    /** GrantのIDでフィルタ */
+    grantId?: string;
+    /** 実行者DIDでフィルタ */
+    executorDid?: string;
+    /** アクションでフィルタ */
+    action?: string;
+    /** 結果でフィルタ */
+    outcome?: ReceiptOutcome;
+    /** 開始日時 */
+    startDate?: string;
+    /** 終了日時 */
+    endDate?: string;
+    /** 取得件数上限 */
+    limit?: number;
+    /** オフセット */
+    offset?: number;
+}
+/**
+ * Receipt一覧結果
+ */
+export interface ReceiptListResult {
+    /** Receipt一覧 */
+    receipts: Receipt[];
+    /** 総件数 */
+    total: number;
+    /** 取得件数上限 */
+    limit: number;
+    /** オフセット */
+    offset: number;
+}
+//# sourceMappingURL=receipt.d.ts.map

package/dist/types/receipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt.d.ts","sourceRoot":"","sources":["../../src/types/receipt.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAE/B;;GAEG;AACH,oBAAY,aAAa;IACvB,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAA;AAE7D;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,YAAY;IACZ,EAAE,EAAE,MAAM,CAAA;IACV,oBAAoB;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,kBAAkB;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,wBAAwB;IACxB,YAAY,EAAE,MAAM,CAAA;IACpB,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW;IACX,OAAO,EAAE,cAAc,CAAA;IACvB,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,yBAAyB;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc;IACd,MAAM,EAAE,MAAM,CAAA;IACd,aAAa;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW;IACX,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY;IACZ,MAAM,EAAE,aAAa,CAAA;IACrB,YAAY;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,eAAe;IACf,OAAO,EAAE,MAAM,CAAA;IACf,oBAAoB;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe;IACf,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KACrC,CAAA;IACD,WAAW;IACX,OAAO,EAAE,cAAc,CAAA;IACvB,aAAa;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW;IACX,KAAK,EAAE,OAAO,CAAA;IACd,gBAAgB;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB;IAChB,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,eAAe;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,WAAW;IACX,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,oBAAoB;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,kBAAkB;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,iBAAiB;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,cAAc;IACd,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB,WAAW;IACX,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,aAAa;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,YAAY;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAA;IACnB,UAAU;IACV,KAAK,EAAE,MAAM,CAAA;IACb,aAAa;IACb,KAAK,EAAE,MAAM,CAAA;IACb,YAAY;IACZ,MAAM,EAAE,MAAM,CAAA;CACf"}

package/dist/types/target-binding.d.ts

@@ -0,0 +1,163 @@
+/**
+ * Target Binding Types
+ *
+ * Declarative mapping from tool invocation parameters to resource identifiers.
+ * Used by TargetResolver to extract the actual destination (channel, recipient, etc.)
+ * from tool parameters for policy evaluation.
+ *
+ * Design decisions:
+ * - BindingSource is a discriminated union (source: 'param' | 'context')
+ * - resource_id binding has a `required` flag (default true) controlling fail-open/closed
+ * - multi-value support via `multi` + `separator` for comma-separated params (e.g., Gmail `to`)
+ * - SecondaryBinding is typed but NOT evaluated in alpha
+ * - deny patterns intentionally omitted from TargetConstraint for alpha (trivial to add)
+ * - tenant_ref on ResolvedTargets for future multi-account support
+ */
+/**
+ * Extract value from a tool parameter.
+ *
+ * @example
+ * { source: 'param', param: 'channel' }                              // Slack channel
+ * { source: 'param', param: 'to', multi: true, separator: ',' }      // Gmail recipients
+ * { source: 'param', param: 'calendarId', default: 'primary' }       // Calendar with default
+ */
+export interface ParamBindingSource {
+    source: 'param';
+    /** Parameter name to extract from tool invocation params */
+    param: string;
+    /** Fallback parameter name if primary param is missing (e.g., AI sends "issueKey" instead of "issueIdOrKey") */
+    fallback_param?: string;
+    /** Default value if param is not provided */
+    default?: string;
+    /** Whether this param contains multiple values */
+    multi?: boolean;
+    /** Separator for multi-value params (default: ',') */
+    separator?: string;
+    /** Post-extraction transformation. 'project_key' extracts the project key prefix from a Jira issue key (e.g., "PROJ-123" → "PROJ"). */
+    derive?: 'project_key';
+}
+/**
+ * Extract value from request context (pre-resolved by API layer).
+ * Used when the resource ID is not a direct tool parameter (e.g., GitHub repo from URL).
+ *
+ * @example
+ * { source: 'context', key: 'resource_id' }
+ */
+export interface ContextBindingSource {
+    source: 'context';
+    /** Key in the context map */
+    key: string;
+}
+/** How to extract a value from tool invocation */
+export type BindingSource = ParamBindingSource | ContextBindingSource;
+/**
+ * Resource ID binding with fail-open/closed semantics.
+ *
+ * When `required` is true (default) and the value cannot be resolved,
+ * the policy evaluator MUST deny the request.
+ * When `required` is false, missing value falls back to type-only matching.
+ *
+ * @example
+ * // Required (default) — deny if channel param is missing
+ * { source: 'param', param: 'channel' }
+ *
+ * // Non-required — skip resource.id check if param is missing
+ * { source: 'param', param: 'channel', required: false }
+ */
+export type ResourceIdBinding = BindingSource & {
+    /** If true (default), deny when value cannot be resolved. If false, skip resource.id check. */
+    required?: boolean;
+};
+/**
+ * Secondary target binding.
+ * Alpha: type definition only, NOT evaluated.
+ *
+ * @example
+ * { name: 'cc', source: { source: 'param', param: 'cc' }, type: 'recipient' }
+ * { name: 'attendees', source: { source: 'param', param: 'attendees' }, type: 'participant', extract: '$.email' }
+ */
+export interface SecondaryBinding {
+    /** Target name (used as key in TargetConstraint matching) */
+    name: string;
+    /** How to extract the value */
+    source: BindingSource;
+    /** Informational type hint (e.g., 'recipient', 'participant', 'path') */
+    type: string;
+    /** JSONPath for nested extraction (future, not implemented in alpha) */
+    extract?: string;
+}
+/**
+ * Declarative target binding definition for an action.
+ * Added to each ACTION_REGISTRY entry.
+ *
+ * @example
+ * // slack.message.post
+ * {
+ *   resource_id: { source: 'param', param: 'channel' },
+ * }
+ *
+ * // gmail.message.send
+ * {
+ *   resource_id: { source: 'param', param: 'to', multi: true, separator: ',' },
+ *   secondary: [
+ *     { name: 'cc', source: { source: 'param', param: 'cc' }, type: 'recipient' },
+ *     { name: 'bcc', source: { source: 'param', param: 'bcc' }, type: 'recipient' },
+ *   ],
+ * }
+ */
+export interface TargetBindings {
+    /** Primary resource ID binding */
+    resource_id: ResourceIdBinding;
+    /** Secondary target bindings (alpha: type-only, not evaluated) */
+    secondary?: SecondaryBinding[];
+}
+/**
+ * Constraint on a secondary target value.
+ * Evaluated against resolved PolicyTarget values.
+ *
+ * Alpha: type definition only, NOT evaluated by ConstraintEvaluator.
+ *
+ * Semantics:
+ * - If no TargetConstraint exists for a target name → unconstrained (allow all)
+ * - If `allow` is set → only values matching at least one allow pattern are permitted
+ * - Future: `deny` field will be added, evaluated after allow (deny-override)
+ *
+ * @example
+ * { name: 'recipient', allow: ['*@mycompany.com'] }
+ * { name: 'attendee', allow: ['alice@co.com', 'bob@co.com'] }
+ */
+export interface TargetConstraint {
+    /** Target name (matches SecondaryBinding.name) */
+    name: string;
+    /** Allowed value patterns (glob). Omitted = allow all. */
+    allow?: string[];
+}
+/**
+ * A resolved secondary target from tool parameters.
+ * Populated by TargetResolver and included in PolicyInput.request.targets.
+ *
+ * @example
+ * { name: 'recipient', values: ['alice@co.com', 'bob@co.com'] }
+ */
+export interface PolicyTarget {
+    /** Target name */
+    name: string;
+    /** Resolved values */
+    values: string[];
+}
+/**
+ * Result of TargetResolver.resolve().
+ */
+export interface ResolvedTargets {
+    /** Primary resource ID. null if not resolvable. */
+    resource_id: string | null;
+    /** Whether resource_id was required but missing → should deny */
+    resource_id_required: boolean;
+    /** Resolved values for multi-value resource_id params */
+    resource_id_values?: string[];
+    /** Tenant/workspace reference for multi-account disambiguation (future) */
+    tenant_ref?: string;
+    /** Secondary targets (alpha: always empty) */
+    targets: PolicyTarget[];
+}
+//# sourceMappingURL=target-binding.d.ts.map

package/dist/types/target-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"target-binding.d.ts","sourceRoot":"","sources":["../../src/types/target-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,CAAA;IACf,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAA;IACb,gHAAgH;IAChH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,kDAAkD;IAClD,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uIAAuI;IACvI,MAAM,CAAC,EAAE,aAAa,CAAA;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,SAAS,CAAA;IACjB,6BAA6B;IAC7B,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,kDAAkD;AAClD,MAAM,MAAM,aAAa,GAAG,kBAAkB,GAAG,oBAAoB,CAAA;AAMrE;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG;IAC9C,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB,CAAA;AAMD;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAA;IACZ,+BAA+B;IAC/B,MAAM,EAAE,aAAa,CAAA;IACrB,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAA;IACZ,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,cAAc;IAC7B,kCAAkC;IAClC,WAAW,EAAE,iBAAiB,CAAA;IAC9B,kEAAkE;IAClE,SAAS,CAAC,EAAE,gBAAgB,EAAE,CAAA;CAC/B;AAMD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAA;IACZ,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAEjB;AAMD;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,kBAAkB;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,sBAAsB;IACtB,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAMD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,mDAAmD;IACnD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,iEAAiE;IACjE,oBAAoB,EAAE,OAAO,CAAA;IAC7B,yDAAyD;IACzD,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC7B,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,8CAA8C;IAC9C,OAAO,EAAE,YAAY,EAAE,CAAA;CACxB"}

package/dist/types/tier.d.ts

@@ -0,0 +1,13 @@
+export type UserTier = 'free' | 'pro' | 'team';
+export interface TierLimits {
+    maxProjects: number;
+    maxWritesPerMonth: number;
+    maxWriteVcTtlMinutes: number;
+    readAutoApproveMaxRiskLevel: 'low' | 'medium' | 'none';
+    readAutoApproveTtlMinutes: number;
+    writeAutoApproveEnabled: boolean;
+    auditRetentionDays: number;
+    auditExportEnabled: boolean;
+}
+export declare const TIER_LIMITS: Record<UserTier, TierLimits>;
+//# sourceMappingURL=tier.d.ts.map

package/dist/types/tier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tier.d.ts","sourceRoot":"","sources":["../../src/types/tier.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAA;AAE9C,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,oBAAoB,EAAE,MAAM,CAAA;IAC5B,2BAA2B,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;IACtD,yBAAyB,EAAE,MAAM,CAAA;IACjC,uBAAuB,EAAE,OAAO,CAAA;IAChC,kBAAkB,EAAE,MAAM,CAAA;IAC1B,kBAAkB,EAAE,OAAO,CAAA;CAC5B;AAED,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,CA2CpD,CAAA"}

package/dist/types/vc.d.ts

@@ -0,0 +1,213 @@
+/**
+ * Credential Type enumeration
+ * Used for general credential classification
+ */
+export declare enum CredentialType {
+    PROJECT_ACCESS = "ProjectAccessCredential",
+    TOOL_ACCESS = "ToolAccessCredential",
+    DEVELOPER = "DeveloperCredential",
+    TEMPORARY = "TemporaryCredential",
+    ADMIN = "AdminCredential",
+    RECEIPT = "ReceiptCredential",
+    /**
+     * Account attributes asserted by an organisation about the account holder
+     * (OEM ⑯). Issued server-to-server, never from a user's own grants.
+     */
+    ACCOUNT = "AccountCredential",
+    /**
+     * Agent instance card (OEM ⑯, Model C). Carries a pointer to the service
+     * card and the hash that pins it — not the capability description itself.
+     */
+    AGENT_CARD = "AgentCardCredential"
+}
+/**
+ * Credential Status enumeration
+ * Used for general credential status tracking
+ */
+export declare enum CredentialStatus {
+    ACTIVE = "active",
+    EXPIRED = "expired",
+    REVOKED = "revoked",
+    SUSPENDED = "suspended"
+}
+/**
+ * VC Type enumeration (for Grant-based VCs)
+ * Used specifically for VerifiableCredential entity in the database
+ *
+ * Maps to:
+ * - ACCESS_CREDENTIAL: Pre-execution authorization (similar to TOOL_ACCESS)
+ * - RECEIPT: Post-execution proof (similar to ReceiptCredential)
+ */
+export declare enum VCType {
+    ACCESS_CREDENTIAL = "AccessCredential",
+    RECEIPT = "Receipt"
+}
+/**
+ * VC Status enumeration (for Grant-based VCs)
+ * Used specifically for VerifiableCredential entity in the database
+ *
+ * Maps to CredentialStatus:
+ * - VALID = ACTIVE
+ * - EXPIRED = EXPIRED
+ * - REVOKED = REVOKED
+ * - SUSPENDED = SUSPENDED (temporary revocation, can be reactivated)
+ * - EXHAUSTED = Grant invocation limit reached
+ */
+export declare enum VCStatus {
+    VALID = "valid",
+    EXPIRED = "expired",
+    REVOKED = "revoked",
+    SUSPENDED = "suspended",
+    EXHAUSTED = "exhausted"
+}
+/**
+ * Utility functions for mapping between CredentialStatus and VCStatus
+ */
+export declare function credentialStatusToVCStatus(status: CredentialStatus): VCStatus;
+export declare function vcStatusToCredentialStatus(status: VCStatus): CredentialStatus;
+/**
+ * SD-JWT Verifiable Credential interface
+ */
+export interface DelegationVC {
+    '@context': string[];
+    vct: string;
+    issuer: string;
+    iss: string;
+    iat: number;
+    exp?: number;
+    validFrom: string;
+    validUntil?: string;
+    name?: string;
+    description?: string;
+    credentialSubject: {
+        id: string;
+        [key: string]: any;
+    };
+    credentialStatus?: {
+        id: string;
+        type: string;
+        statusListIndex: string;
+        statusListCredential: string;
+    };
+}
+/**
+ * API Credential entity interface
+ */
+export interface APICredential {
+    /** Unique identifier */
+    id: string;
+    /** Issuer DID */
+    issuer: string;
+    /** Subject DID */
+    subject: string;
+    /** Credential type */
+    type: CredentialType;
+    /** Credential claims */
+    claims: {
+        permissions?: string[];
+        projectId?: string;
+        tools?: string[];
+        authorizedBy?: string;
+        deviceBinding?: string;
+        [key: string]: any;
+    };
+    /** Credential status */
+    status: CredentialStatus;
+    /** Raw SD-JWT credential */
+    rawCredential?: string;
+    /** Cryptographic signature */
+    signature?: string;
+    /** Associated project ID */
+    projectId?: string;
+    /** Associated agent ID */
+    agentId?: string;
+    /** Issuance timestamp */
+    issuedAt: Date;
+    /** Expiration timestamp */
+    expiresAt?: Date;
+    /** Revocation timestamp */
+    revokedAt?: Date;
+    /** Revocation reason */
+    revocationReason?: string;
+    /** Creation timestamp */
+    createdAt: Date;
+    /** Update timestamp */
+    updatedAt: Date;
+}
+/**
+ * SD-JWT Credential issuance request
+ */
+export interface IssueSDJWTVCRequest {
+    /** Issuer DID */
+    issuer: string;
+    /** Subject DID */
+    subject: string;
+    /** Credential type */
+    type?: CredentialType;
+    /** Claims to include */
+    claims: Record<string, any>;
+    /** Expiration date */
+    expirationDate?: Date;
+    /** Project ID */
+    projectId?: string;
+    /** Agent ID */
+    agentId?: string;
+    /** Fields to make selectively disclosable */
+    selectiveDisclosureFields?: string[];
+}
+/**
+ * SD-JWT Credential verification result
+ */
+export interface VerifySDJWTVCResult {
+    /** Whether the credential is valid */
+    valid: boolean;
+    /** Decoded payload if valid */
+    payload?: {
+        iss: string;
+        sub: string;
+        vct: string;
+        exp?: number;
+        iat?: number;
+        [key: string]: any;
+    };
+    /** Error message if invalid */
+    error?: string;
+}
+/**
+ * SD-JWT Credential issuance result
+ */
+export interface IssueSDJWTVCResult {
+    /** The complete SD-JWT VC */
+    credential: string;
+    /** Issuer DID */
+    issuer: string;
+    /** Subject DID */
+    subject: string;
+    /** Credential type */
+    type: CredentialType;
+    /** Expiration timestamp */
+    expiresAt?: Date;
+}
+export interface ToolPermissionVC extends DelegationVC {
+    credentialSubject: {
+        id: string;
+        tool: string;
+        resourceScope?: Record<string, any>;
+        aud: string;
+    };
+}
+export interface DataAccessVC extends DelegationVC {
+    credentialSubject: {
+        id: string;
+        resource: string;
+        actions: ('read' | 'write' | 'delete')[];
+    };
+}
+export interface VCTemplate<T extends DelegationVC = DelegationVC> {
+    type: string;
+    name: string;
+    description?: string;
+    defaults?: Partial<T>;
+    validate?: (vc: T) => boolean;
+}
+//# sourceMappingURL=vc.d.ts.map

package/dist/types/vc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vc.d.ts","sourceRoot":"","sources":["../../src/types/vc.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,oBAAY,cAAc;IACxB,cAAc,4BAA4B;IAC1C,WAAW,yBAAyB;IACpC,SAAS,wBAAwB;IACjC,SAAS,wBAAwB;IACjC,KAAK,oBAAoB;IACzB,OAAO,sBAAsB;IAC7B;;;OAGG;IACH,OAAO,sBAAsB;IAC7B;;;OAGG;IACH,UAAU,wBAAwB;CACnC;AAED;;;GAGG;AACH,oBAAY,gBAAgB;IAC1B,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,SAAS,cAAc;CACxB;AAED;;;;;;;GAOG;AACH,oBAAY,MAAM;IAChB,iBAAiB,qBAAqB;IACtC,OAAO,YAAY;CACpB;AAED;;;;;;;;;;GAUG;AACH,oBAAY,QAAQ;IAClB,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,SAAS,cAAc;CACxB;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,gBAAgB,GAAG,QAAQ,CAe7E;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,QAAQ,GAAG,gBAAgB,CAgB7E;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,iBAAiB,EAAE;QACjB,EAAE,EAAE,MAAM,CAAA;QACV,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KACnB,CAAA;IACD,gBAAgB,CAAC,EAAE;QACjB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,eAAe,EAAE,MAAM,CAAA;QACvB,oBAAoB,EAAE,MAAM,CAAA;KAC7B,CAAA;CACF;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,wBAAwB;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,iBAAiB;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,kBAAkB;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,sBAAsB;IACtB,IAAI,EAAE,cAAc,CAAA;IACpB,wBAAwB;IACxB,MAAM,EAAE;QACN,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;QACtB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;QAChB,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KACnB,CAAA;IACD,wBAAwB;IACxB,MAAM,EAAE,gBAAgB,CAAA;IACxB,4BAA4B;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,yBAAyB;IACzB,QAAQ,EAAE,IAAI,CAAA;IACd,2BAA2B;IAC3B,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,2BAA2B;IAC3B,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,wBAAwB;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,yBAAyB;IACzB,SAAS,EAAE,IAAI,CAAA;IACf,uBAAuB;IACvB,SAAS,EAAE,IAAI,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,iBAAiB;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,kBAAkB;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,sBAAsB;IACtB,IAAI,CAAC,EAAE,cAAc,CAAA;IACrB,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC3B,sBAAsB;IACtB,cAAc,CAAC,EAAE,IAAI,CAAA;IACrB,iBAAiB;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6CAA6C;IAC7C,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,sCAAsC;IACtC,KAAK,EAAE,OAAO,CAAA;IACd,+BAA+B;IAC/B,OAAO,CAAC,EAAE;QACR,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,GAAG,CAAC,EAAE,MAAM,CAAA;QAEZ,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KACnB,CAAA;IACD,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,iBAAiB;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,kBAAkB;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,sBAAsB;IACtB,IAAI,EAAE,cAAc,CAAA;IACpB,2BAA2B;IAC3B,SAAS,CAAC,EAAE,IAAI,CAAA;CACjB;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,iBAAiB,EAAE;QACjB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACnC,GAAG,EAAE,MAAM,CAAA;KACZ,CAAA;CACF;AAED,MAAM,WAAW,YAAa,SAAQ,YAAY;IAChD,iBAAiB,EAAE;QACjB,EAAE,EAAE,MAAM,CAAA;QACV,QAAQ,EAAE,MAAM,CAAA;QAChB,OAAO,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC,EAAE,CAAA;KACzC,CAAA;CACF;AAED,MAAM,WAAW,UAAU,CAAC,CAAC,SAAS,YAAY,GAAG,YAAY;IAC/D,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;IACrB,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,OAAO,CAAA;CAC9B"}

package/dist/types/vp.d.ts

@@ -0,0 +1,25 @@
+export interface VerifiablePresentation {
+    '@context': string[];
+    type: string[];
+    verifiableCredential: any[];
+    holder: string;
+    proof?: {
+        type: string;
+        created: string;
+        verificationMethod: string;
+        proofPurpose: string;
+        challenge?: string;
+        domain?: string;
+        jws?: string;
+        proofValue?: string;
+    };
+}
+export interface VPRequest {
+    challenge: string;
+    domain: string;
+    query?: {
+        type?: string;
+        credentialQuery?: any;
+    };
+}
+//# sourceMappingURL=vp.d.ts.map

package/dist/types/vp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vp.d.ts","sourceRoot":"","sources":["../../src/types/vp.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,oBAAoB,EAAE,GAAG,EAAE,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,kBAAkB,EAAE,MAAM,CAAA;QAC1B,YAAY,EAAE,MAAM,CAAA;QACpB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACF;AAED,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,eAAe,CAAC,EAAE,GAAG,CAAA;KACtB,CAAA;CACF"}

package/dist/utils/action-classifier.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Determine if an action is a write action based on ACTION_REGISTRY effects and risk.
+ * Uses effects (Create/Update/Delete/Write/Execute) as primary signal,
+ * falls back to risk level (medium/high = write) for unknown actions.
+ */
+export declare function isWriteAction(action: string): boolean;
+/**
+ * Pre-computed list of all write action names from ACTION_REGISTRY.
+ * Used for SQL queries where per-row function calls are not practical.
+ * Must be re-generated if ACTION_REGISTRY changes (compile-time constant).
+ */
+export declare const WRITE_ACTION_NAMES: string[];
+//# sourceMappingURL=action-classifier.d.ts.map

package/dist/utils/action-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-classifier.d.ts","sourceRoot":"","sources":["../../src/utils/action-classifier.ts"],"names":[],"mappings":"AAQA;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAerD;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,EAEX,CAAA"}

package/dist/utils/crypto.d.ts

@@ -0,0 +1,22 @@
+import * as jose from 'jose';
+export interface KeyPair {
+    publicKey: any;
+    privateKey: any;
+}
+export declare function generateKeyPair(): Promise<KeyPair>;
+export declare function signJWT(payload: any, privateKey: any, options?: {
+    issuer?: string;
+    audience?: string;
+    expiresIn?: string;
+    notBefore?: string;
+    subject?: string;
+    jti?: string;
+}): Promise<string>;
+export declare function verifyJWT(jwt: string, publicKey: any, options?: {
+    issuer?: string;
+    audience?: string;
+}): Promise<jose.JWTPayload>;
+export declare function generateNonce(): string;
+export declare function getSigner(privateKey: any): Promise<(data: string) => Promise<string>>;
+export declare function getVerifier(publicKey: any): Promise<(data: string, signatureBase64url: string) => Promise<boolean>>;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/utils/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAI5B,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,GAAG,CAAA;IACd,UAAU,EAAE,GAAG,CAAA;CAChB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CA2BxD;AAED,wBAAsB,OAAO,CAC3B,OAAO,EAAE,GAAG,EACZ,UAAU,EAAE,GAAG,EACf,OAAO,CAAC,EAAE;IACR,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GACA,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,GAAG,EACd,OAAO,CAAC,EAAE;IACR,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,GACA,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAU1B;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAsB,SAAS,CAAC,UAAU,EAAE,GAAG,kBAavB,MAAM,sBAwB7B;AAED,wBAAsB,WAAW,CAAC,SAAS,EAAE,GAAG,kBAY1B,MAAM,sBAAsB,MAAM,uBAmBvD"}

package/dist/utils/freemail-domains.d.ts

@@ -0,0 +1,13 @@
+/**
+ * フリーメール / コンシューマ向けメールドメインのリスト。
+ * grant の internalDomains で「ドメイン全体ワイルドカード (*@<freemail>)」を
+ * 許可することを禁止するために使う (個別アドレス x@gmail.com は許可)。
+ * 理由: *@gmail.com を「社内ドメイン」として自動許可すると、全 Gmail ユーザー
+ * 宛が無条件許可になり危険。
+ *
+ * 網羅性は完璧でなくてよい (主要なもの)。後から追加可能な Set 構造。
+ */
+export declare const FREEMAIL_DOMAINS: ReadonlySet<string>;
+/** ドメインがフリーメールか判定 (小文字化して比較)。 */
+export declare function isFreemailDomain(domain: string): boolean;
+//# sourceMappingURL=freemail-domains.d.ts.map

package/dist/utils/freemail-domains.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"freemail-domains.d.ts","sourceRoot":"","sources":["../../src/utils/freemail-domains.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CA8B/C,CAAA;AAEF,iCAAiC;AACjC,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAExD"}