@vess-id/ai-identity 0.16.0-alpha.1 → 0.16.0-alpha.2

package/dist/index.d.mts

@@ -865,6 +865,14 @@ interface PolicyRefInline {
      * resolve で取得できるため optional のまま).
      */
     schema_id?: string;
+    /**
+     * Policy engine that authored / evaluates this document. Omitted ⇒ `cedar`
+     * (historical default — all pre-Plan-B refs are Cedar and MUST stay wire-
+     * identical). Corresponds to the Policy Registry `engine` column (Plan B
+     * Task 1). Non-cedar engines (e.g. `'scheduling-delegation/v1'`) carry a
+     * non-Cedar `policy_inline` body and skip Cedar lint.
+     */
+    engine?: string;
 }
 /**
  * Reference policy mode — policy lives in the Policy Registry.
@@ -891,6 +899,15 @@ interface PolicyRefReference {
      * 同梱せず Registry 側で resolve する方針。
      */
     schema_id?: string;
+    /**
+     * Policy engine that authored / evaluates the referenced document. Omitted ⇒
+     * `cedar` (historical default — all pre-Plan-B refs are Cedar and MUST stay
+     * wire-identical). Corresponds to the Policy Registry `engine` column (Plan B
+     * Task 1); the served `/.well-known/policy-registry/:id` document declares the
+     * same value. Non-cedar engines (e.g. `'scheduling-delegation/v1'`) resolve to
+     * a non-Cedar body and skip Cedar lint.
+     */
+    engine?: string;
 }
 /**
  * Tagged union of policy reference shapes. Discriminator: `mode`.
@@ -1141,6 +1158,31 @@ interface VcSchedulingDelegationClaim {
      * which negotiation the write was for.
      */
     itemId?: string;
+    /**
+     * Scheduling Phase 2 Plan B (Task 3 bakes this) — the Policy Registry id of
+     * the signed delegation-policy document the auto-issuance relied on. Lets an
+     * auditor fetch the exact JWS-signed `/.well-known/policy-registry/:id`
+     * document that this snapshot was derived from, instead of trusting the
+     * inline snapshot alone. ADDITIVE / OPTIONAL: absent on legacy rows minted
+     * before Plan B (which have no registry document).
+     *
+     * AUDIT-ONLY, same principle as the rest of this claim: no enforcement gate
+     * reads it. At invoke time the delegation is re-evaluated against the LIVE
+     * policy row + actual request parameters — the VC claim is never trusted as
+     * an authorization source (#884 canonical resource checks unchanged).
+     */
+    policyRegistryId?: string;
+    /**
+     * Scheduling Phase 2 Plan B (Task 3 bakes this) — `sha256-` prefixed hash of
+     * the canonical policy body the {@link policyRegistryId} document was minted
+     * with. Tamper-evidence linking this snapshot to that exact document version.
+     * ADDITIVE / OPTIONAL: absent on legacy rows minted before Plan B.
+     *
+     * AUDIT-ONLY, same principle as the rest of this claim: no enforcement gate
+     * reads it. Invoke-time evaluation trusts the live policy row + actual
+     * parameters, never the VC claim (#884 unchanged).
+     */
+    policyHash?: string;
 }
 interface PermissionVcClaims_V3 extends Omit<PermissionVcClaims_V2, 'v'> {
     /** Schema version — v3 adds Cedar policy_ref support and chain hierarchy fields. */
@@ -28364,7 +28406,23 @@ declare function isDecision(value: unknown): value is Decision;
  * lookup (registry keys are all lowercase), so `gmail.message.TRASH` still
  * hits the registry `high` instead of mis-falling-back to the suffix value.
  */
-type ActionRisk = 'low' | 'medium' | 'high';
+/**
+ * Risk tiers an action can declare. Aligned with the registry JSON-schema
+ * enum (`action-registry.ts` → `risk: ['low','medium','high','critical']`)
+ * and the Cedar-facing `RiskLevel` (types/context.ts) — PR #931 review: the
+ * previous 3-value union LIED about the runtime, because a registry entry
+ * declaring `risk: 'critical'` flowed through the `as ActionRisk` cast below
+ * and `resolveActionRisk` returned the string `'critical'` while its type
+ * said it could not. Every STRICTNESS seam (Gate-2 strict arm, the
+ * autoIssueVC permit-arm pin, `stripHighRiskWildcardActions`,
+ * `validateHighRiskResources`, agentd's wildcard-approval refuse) must treat
+ * `'critical'` at least as strictly as `'high'` — never compare
+ * `=== 'high'` alone.
+ *
+ * The suffix heuristic never yields 'critical' (only a registry entry can
+ * declare it); no registry action uses it yet as of 2026-07-05.
+ */
+type ActionRisk = 'low' | 'medium' | 'high' | 'critical';
 /**
  * Resolve the risk level for a dotted action name.
  *