@vess-id/ai-identity 0.16.0-alpha.10 → 0.16.0-alpha.11

package/dist/index.d.mts

@@ -974,6 +974,24 @@ interface PermissionRule {
     actions: string[];
     /** Rule-level constraints */
     constraints?: PermissionConstraints;
+    /**
+     * RAR authorization-details type (RFC 9396 §2), carried verbatim (#952).
+     *
+     * A free-form URN naming the kind of authorization this delegate represents,
+     * for consumers that speak RAR. Deliberately unvalidated: the registry of
+     * types belongs to whoever issues them, and rejecting an unrecognised URN
+     * here would make this service the gatekeeper of a vocabulary it does not
+     * own.
+     *
+     * NOT an authorization input. Gate-2 authorises on `provider`, `actions`,
+     * `resource.type` and `resource.id`; a credential must not be able to widen
+     * or narrow what it may do by naming a type. Note how close this sits to
+     * `resource.type`, which Gate-2 *does* read — the two are one level apart
+     * and the format is unchecked, so a line reaching for the wrong one would
+     * not be caught by the compiler or at runtime. Pinned in
+     * `gate2-fast-path.spec.ts` ("delegates[].type is inert at Gate-2").
+     */
+    type?: string;
     /**
      * Cedar policy binding (Phase 1).
      *
@@ -1244,6 +1262,41 @@ interface PermissionVcClaims_V3 extends Omit<PermissionVcClaims_V2, 'v'> {
      * no enforcement gate reads it. {@link VcSchedulingDelegationClaim}.
      */
     schedulingDelegation?: VcSchedulingDelegationClaim;
+    /**
+     * How this credential came to exist (#954).
+     *
+     * - `'user_approved'` — a person consented. Paired with {@link approval},
+     *   which carries the back-reference to the approval request and outcome.
+     * - `'auto_issued'` — consent was given on the user's behalf: a Cedar
+     *   permit, an advance delegation policy, or a signup funnel.
+     * - `'unrecorded'` — provenance is genuinely unknown. Credentials issued
+     *   before the consent type was recorded, and any path where no approval
+     *   assertion reaches the issuer, land here.
+     *
+     * Derived from the approval's `consent_type` — HOW the consent was
+     * obtained — and never from `granted_by`, which records WHO. Those come
+     * apart in practice: booking start writes `granted_by: 'system'` for both
+     * an explicit human click and an automatic funnel, because the visitor's
+     * identity is gone by the time the credential is issued.
+     *
+     * The third value is not a placeholder to be tidied away later. Guessing
+     * between the other two would fabricate audit data, and this claim is
+     * signed — it cannot be corrected once issued.
+     *
+     * Never taken from the request: `approvalAssertion` is an internal-only
+     * extension on `issueVC` precisely so this stays true (see the comment on
+     * `IssueVCRequestDto`).
+     *
+     * Optional, and permanently so. The type describes credentials that are
+     * already signed and in circulation; those cannot be re-issued to carry a
+     * new field, so a required one would invalidate them at the type layer.
+     * Absent means "issued before #954", not "auto-issued".
+     *
+     * Audit and disclosure metadata — no gate reads it to decide anything. If a
+     * gate ever should, the decision belongs in policy, against `approval`,
+     * rather than against a label the issuer wrote about itself.
+     */
+    issuance_mode?: 'user_approved' | 'auto_issued' | 'unrecorded';
 }
 /**
  * Permission VC Claims (canonical union of v2 + v3).
@@ -1977,6 +2030,17 @@ interface ApprovalContext {
     granted_at: string;
     /** user id or `'system'` for auto-approve. */
     granted_by: string;
+    /**
+     * HOW the consent was obtained — `'explicit'` (the user acted) or `'auto'`
+     * (consent given on their behalf). Distinct from `granted_by`, which
+     * records WHO: booking start writes `'system'` for both, because the
+     * visitor's identity is gone by issuance time.
+     *
+     * Optional and nullable on purpose. Absent means "not recorded" — rows
+     * predating the column, which are deliberately not backfilled. Readers must
+     * treat that as a third state rather than defaulting it either way.
+     */
+    consent_type?: 'explicit' | 'auto';
 }
 
 /**
@@ -38799,7 +38863,7 @@ declare function isDecision(value: unknown): value is Decision;
  *      deterministic suffix heuristic below:
  *        - write/send/delete-class suffixes → 'high'
  *        - read/list/get-class suffixes     → 'low'
- *        - everything else                  → 'medium' (fail-safe)
+ *        - everything else                  → UNCLASSIFIED_ACTION_RISK ('high', fail-closed)
  *
  * The suffix heuristic classifies by the **last dotted segment** of the
  * action name (e.g., `gmail.message.send` → `send` → 'high').
@@ -38825,6 +38889,29 @@ declare function isDecision(value: unknown): value is Decision;
  * declare it); no registry action uses it yet as of 2026-07-05.
  */
 type ActionRisk = 'low' | 'medium' | 'high' | 'critical';
+/**
+ * Risk assigned to an action we cannot classify — unregistered, unrecognised
+ * suffix, or malformed input.
+ *
+ * This is `'high'`, not `'medium'`, and the distinction is load-bearing.
+ * `'medium'` reads like a cautious middle ground but is on the permissive
+ * side of every gate downstream:
+ *
+ *   - The Cedar default policy permits `["low","medium"]` unconditionally,
+ *     without consulting `context.approval.granted`
+ *     (`api/src/grant/services/system-policy.service.ts:105`), so a medium
+ *     action is approved with no prompt at all.
+ *   - Gate-2 only pins an invocation to its delegated resource when the risk
+ *     is high or critical (`api/src/tool/services/tool-executor.service.ts`),
+ *     so a medium action also escapes resource narrowing.
+ *
+ * An action nobody registered therefore got *less* scrutiny than one that was.
+ * The rest of the codebase already treats unknown as dangerous — agentd
+ * (`agentd/src/core/execution-engine.ts`), the approval UI's own table, the
+ * remote-mcp tool gate, and the approval-request validator all reject or
+ * escalate. This constant brings the SDK resolver in line. (#1285)
+ */
+declare const UNCLASSIFIED_ACTION_RISK: ActionRisk;
 /**
  * Resolve the risk level for a dotted action name.
  *
@@ -38837,14 +38924,14 @@ type ActionRisk = 'low' | 'medium' | 'high' | 'critical';
  *   resolveActionRisk('jira.issue.transition')    → 'high'  (registry)
  *   resolveActionRisk('unknown.connector.send')   → 'high'  (suffix fallback)
  *   resolveActionRisk('unknown.connector.read')   → 'low'   (suffix fallback)
- *   resolveActionRisk('unknown.connector.sync')   → 'medium'(suffix fallback)
+ *   resolveActionRisk('unknown.connector.sync')   → 'high'  (unclassified, #1285)
  *
  * Defensive defaults:
- *   - empty / falsy input → 'medium' (fail-safe; never throws)
- *   - unknown suffix      → 'medium'
+ *   - empty / falsy input → 'high' (fail-closed; never throws)
+ *   - unknown suffix      → 'high'
  */
 declare function resolveActionRisk(action: string | undefined | null): ActionRisk;
 
 declare const version = "0.0.1";
 
-export { type ABACPolicyEngine, ACTION_PARAMS_MAX_SIZE, ACTION_PREFIXES, ACTION_REGISTRY, AIdentityClient, type AIdentityConfig, AIdentityError, type APIAgent, type APICredential, APIVCManager, APPROVAL_REQUIRED_ACTION, type AbacDecision, type AbacInput, type AcceptInvitationRequest, type AckEventResponse, type ActionInputSchema, type ActionMapping, type ActionMeta, type ActionParamDisplay, type ActionRegistry, type ActionRisk, type ActionRiskLevel, type Agent, type AgentCreateOptions, type AgentDIDConfig, AgentDIDManager, AgentManager, AgentStatus, AgentType, type AgentWithId, AllowAllAbac, type AnyProvider, type ApiKeyValidationResult, type ApprovalContext, type ApprovalResolverKind, type AuditEvent, type AuditQuery, AuthProvider, type AuthState, AuthenticationError, type AutoApproveConfig, type BindingSource, type BuildKbJwtPayloadArgs, type BuildKbJwtPayloadDeps, CANONICAL_PROVIDERS, type CanonicalProvider, type CapabilityMeta, type CedarDecision, type CedarDecisionDiagnostic, type CedarDecisionValue, type CedarEngine, CedarEngineUnavailableError, type CedarEntitiesInput, type CedarEntity, type CedarEntityDescriptor, type CedarError, type CedarEvaluateRequest, CedarParseError, type CedarPolicySetHandle, type CedarSchema, type CedarSchemaHandle, type CheckGrantPermissionRequest, type CheckGrantPermissionResult, type CheckPermissionInput, type CheckPermissionResult, type CollectContextRequest, type ConfirmGrantSuggestionRequest, type ConnectorAction, type ConnectorConfig, type ConnectorExecutionContext, type ConnectorResponse, type ConnectorResponseMetadata, type ConnectorTokenConfig, type ConstraintEvaluationResult, ConstraintEvaluator, type ConstraintEvaluatorOptions, type ConstraintViolation, type ConstraintWarning, type ContextBindingSource, type ContextProvider, type CreateGrantRequest, type CreateInvitationRequest, type CreateReceiptRequest, type CredentialRef, CredentialStatus, type CredentialStore, CredentialType, DECISION_VALUES, DEFAULT_CONSTRAINTS_BY_RISK, type DIDDocument, type DataAccessVC, type Decision, type DecisionTrace, type DelegationVC, DeviceEnrollManager, type DeviceEnrollPollResult, type DeviceEnrollServerSideParams, type DeviceEnrollStartParams, type DeviceEnrollStartResult, type DisclosureFields, DummyCreds, DummyVpVerifier, type EmployeeVPRequest, type EvaluateInput, type EvaluateResult, type EvaluationContext, type ExternalActionRequest, FREEMAIL_DOMAINS, FilesystemKeyStorage, GATEWAY_ERROR_CODE, GatewayClient, GatewayError, type GatewayErrorCode, type GatewayEvent, type GetEventsOptions, type GetEventsResponse, type GitHubConfig, type GoogleConfig, type Grant, type GrantConstraints, type GrantResource, GrantResourceType, GrantScope, GrantStatus, type GrantUsage, type IConnectorService, type IStateStore, type Intent, type IntentEvaluationResult, type IntentObligation, type IntentResource, type InternalHmacSignerKey, InvalidVPError, type Invitation, type InvitationRole, InvitationStatus, type IssueSDJWTVCRequest, type IssueSDJWTVCResult, type JiraBoard, type JiraConfig, type JiraIssue, type JiraIssueLink, type JiraIssueLinkType, type JiraIssueType, type JiraProject, type JiraSprint, type JiraStatus, type JiraUser, type JiraWorklog, type JsonSchema, JsonStateStore, KB_JWT_DEFAULT_LIFETIME_SECONDS, type KbJwtPayload, KeyManager, type KeyPairGenerationResult, type KeyStorageConfig, type KeyStorageProvider, LEGACY_RESOURCE_TYPE_MAP, MIN_SIGNER_KEY_BYTES, MemoryKeyStorage, NetworkError, type NormalizeIntentRequest, type NormalizedIntent, type OAuthAuthorizeRequest, type OAuthCallbackParams, type OAuthConnection, OAuthProvider, type OAuthToken, type OrganizationConfig, type OrganizationPermission, type OrganizationPolicy, type OrganizationVC, PHASE_1_VC_LAYER, PROVIDER_ALIASES, type ParamBindingSource, type ParsedResourceType, type ParsedSignature, type PermissionConstraints, type PermissionMode, type PermissionResource, type PermissionRule, type PermissionTimeConstraint, type PermissionVcClaims, type PermissionVcClaims_V2, type PermissionVcClaims_V3, type Phase1VcLayer, type PlanDelegationInput, type PlanDelegationResult, type PolicyCondition, type PolicyEvaluationResult, type PolicyInput, type PolicyRef, type PolicyRefInline, type PolicyRefReference, type PolicyRule, type PolicySetHandle, type PolicyTarget, type PolicyValidationError, type Provider, REAUTH_REQUIRED_ACTION, RESOLVED_PARAMS_KEY, RESOURCE_TYPES, RESOURCE_TYPE_LABELS, type ReBACChecker, type Receipt, type ReceiptListResult, type ReceiptOutcome, type ReceiptSearchQuery, ReceiptStatus, type Relation, type ResolvedTargets, type ResolverBackedField, type ResourceIdBinding, type ResourceMatch, type ResourceRef, type ResourceScope, type ResourceType, type RiskAssessmentResult, type RiskFactor, type RiskLevel, SDJwtClient, SIGNATURE_HEADER, SIGNATURE_VERSION_PREFIX, type SchemaHandle, ScopeUnmatchedError, type SecondaryBinding, type SignRequestArgs, SimpleRebac, type SlackConfig, StandardActionCategory, type SuggestGrantRequest, type SuggestedAction, type SuggestedConstraints, type SuggestedGrant, type SuggestedResource, type SuggestionRiskLevel, TIER_LIMITS, type TargetBindings, type TargetConstraint, TargetResolver, type TierLimits, type TimeWindowCheckResult, type TimeWindowConstraint, type ToolDefinition, type ToolInvocation, ToolManager, type ToolPermissionRequest, type ToolPermissionVC, type UnifiedResourceType, type UpdateGrantRequest, type UserIdentity, type UserIdentityConfig, type UserIdentityCreateOptions, UserIdentityManager, UserKeyPairManager, type UserTier, VALID_MCP_ACTIONS, VALID_MCP_TOOLS, VCExpiredError, VCManager, VCRevokedError, VCStatus, type VCTemplate, VCType, VPManager, type VPRequest, type ValidateActionInputResult, type VcApprovalClaim, type VcSchedulingDelegationClaim, type VerifiablePresentation, type VerificationMethod, type VerifiedVcClaims, type VerifyInvitationResponse, type VerifyReceiptRequest, type VerifyReceiptResult, type VerifySDJWTVCResult, type VpVerifier, WRITE_ACTION_NAMES, type WeeklyReportData, type WeeklyReportSummary, buildCanonicalString, buildCedarEntities, buildGrantIdFields, buildKbJwtPayload, buildPhase1VcClaims, buildValidationErrors, canonicalResourceId, canonicalizeAction, canonicalizeSalient, canonicalizeWithFields, checkPermissionWithVP, classifyCedarErrorMessage, compareResourceIds, configure, createAjv, createCedarEngine, createDidJwk, credentialStatusToVCStatus, defaultConstraintEvaluator, digestWithFields, evaluateConstraints, extractProjectKey, extractPublicKey, extractPublicKeyFromDid, formatSignatureHeader, generateActionParamsDisplay, generateActionSummary, generateKeyPair, generateNonce, getActionAliases, getAllActionForms, getAllValidMcpActionNames, getClient, getDefaultDisclosureFields, getKeyIdFromDid, getRequiredRelations, getRequiredScopes, getTierLimits, getValidMcpActionNames, grantConstraintsToPermissionConstraints, grantToPermissionRules, indexActions, indexCapabilities, isActionEquivalent, isCanonicalProvider, isDecision, isFreemailDomain, isPolicyRefInline, isPolicyRefReference, isUnlimited, isValidDidJwk, isValidProvider, isWriteAction, loadActionRegistryFromFile, loadActionRegistryFromObject, looksLikeNativeId, normalizeDomain, normalizeMcpActionName, parseGrantAction, parseGrantResourceType, parseSignatureHeader, planDelegationForVC, publicKeysMatch, readVcExpSeconds, resolveActionRisk, resolveActionsFromSelection, resolveProvider, resolveResourceType, resolveUserTier, resolverBackedFieldsFor, salientDigest, salientFieldsFor, sha256Hex, signJWT, signRequest, stripResolvedParams, validateActionInput, validateRegistryObject, vcStatusToCredentialStatus, verifyJWT, version };
+export { type ABACPolicyEngine, ACTION_PARAMS_MAX_SIZE, ACTION_PREFIXES, ACTION_REGISTRY, AIdentityClient, type AIdentityConfig, AIdentityError, type APIAgent, type APICredential, APIVCManager, APPROVAL_REQUIRED_ACTION, type AbacDecision, type AbacInput, type AcceptInvitationRequest, type AckEventResponse, type ActionInputSchema, type ActionMapping, type ActionMeta, type ActionParamDisplay, type ActionRegistry, type ActionRisk, type ActionRiskLevel, type Agent, type AgentCreateOptions, type AgentDIDConfig, AgentDIDManager, AgentManager, AgentStatus, AgentType, type AgentWithId, AllowAllAbac, type AnyProvider, type ApiKeyValidationResult, type ApprovalContext, type ApprovalResolverKind, type AuditEvent, type AuditQuery, AuthProvider, type AuthState, AuthenticationError, type AutoApproveConfig, type BindingSource, type BuildKbJwtPayloadArgs, type BuildKbJwtPayloadDeps, CANONICAL_PROVIDERS, type CanonicalProvider, type CapabilityMeta, type CedarDecision, type CedarDecisionDiagnostic, type CedarDecisionValue, type CedarEngine, CedarEngineUnavailableError, type CedarEntitiesInput, type CedarEntity, type CedarEntityDescriptor, type CedarError, type CedarEvaluateRequest, CedarParseError, type CedarPolicySetHandle, type CedarSchema, type CedarSchemaHandle, type CheckGrantPermissionRequest, type CheckGrantPermissionResult, type CheckPermissionInput, type CheckPermissionResult, type CollectContextRequest, type ConfirmGrantSuggestionRequest, type ConnectorAction, type ConnectorConfig, type ConnectorExecutionContext, type ConnectorResponse, type ConnectorResponseMetadata, type ConnectorTokenConfig, type ConstraintEvaluationResult, ConstraintEvaluator, type ConstraintEvaluatorOptions, type ConstraintViolation, type ConstraintWarning, type ContextBindingSource, type ContextProvider, type CreateGrantRequest, type CreateInvitationRequest, type CreateReceiptRequest, type CredentialRef, CredentialStatus, type CredentialStore, CredentialType, DECISION_VALUES, DEFAULT_CONSTRAINTS_BY_RISK, type DIDDocument, type DataAccessVC, type Decision, type DecisionTrace, type DelegationVC, DeviceEnrollManager, type DeviceEnrollPollResult, type DeviceEnrollServerSideParams, type DeviceEnrollStartParams, type DeviceEnrollStartResult, type DisclosureFields, DummyCreds, DummyVpVerifier, type EmployeeVPRequest, type EvaluateInput, type EvaluateResult, type EvaluationContext, type ExternalActionRequest, FREEMAIL_DOMAINS, FilesystemKeyStorage, GATEWAY_ERROR_CODE, GatewayClient, GatewayError, type GatewayErrorCode, type GatewayEvent, type GetEventsOptions, type GetEventsResponse, type GitHubConfig, type GoogleConfig, type Grant, type GrantConstraints, type GrantResource, GrantResourceType, GrantScope, GrantStatus, type GrantUsage, type IConnectorService, type IStateStore, type Intent, type IntentEvaluationResult, type IntentObligation, type IntentResource, type InternalHmacSignerKey, InvalidVPError, type Invitation, type InvitationRole, InvitationStatus, type IssueSDJWTVCRequest, type IssueSDJWTVCResult, type JiraBoard, type JiraConfig, type JiraIssue, type JiraIssueLink, type JiraIssueLinkType, type JiraIssueType, type JiraProject, type JiraSprint, type JiraStatus, type JiraUser, type JiraWorklog, type JsonSchema, JsonStateStore, KB_JWT_DEFAULT_LIFETIME_SECONDS, type KbJwtPayload, KeyManager, type KeyPairGenerationResult, type KeyStorageConfig, type KeyStorageProvider, LEGACY_RESOURCE_TYPE_MAP, MIN_SIGNER_KEY_BYTES, MemoryKeyStorage, NetworkError, type NormalizeIntentRequest, type NormalizedIntent, type OAuthAuthorizeRequest, type OAuthCallbackParams, type OAuthConnection, OAuthProvider, type OAuthToken, type OrganizationConfig, type OrganizationPermission, type OrganizationPolicy, type OrganizationVC, PHASE_1_VC_LAYER, PROVIDER_ALIASES, type ParamBindingSource, type ParsedResourceType, type ParsedSignature, type PermissionConstraints, type PermissionMode, type PermissionResource, type PermissionRule, type PermissionTimeConstraint, type PermissionVcClaims, type PermissionVcClaims_V2, type PermissionVcClaims_V3, type Phase1VcLayer, type PlanDelegationInput, type PlanDelegationResult, type PolicyCondition, type PolicyEvaluationResult, type PolicyInput, type PolicyRef, type PolicyRefInline, type PolicyRefReference, type PolicyRule, type PolicySetHandle, type PolicyTarget, type PolicyValidationError, type Provider, REAUTH_REQUIRED_ACTION, RESOLVED_PARAMS_KEY, RESOURCE_TYPES, RESOURCE_TYPE_LABELS, type ReBACChecker, type Receipt, type ReceiptListResult, type ReceiptOutcome, type ReceiptSearchQuery, ReceiptStatus, type Relation, type ResolvedTargets, type ResolverBackedField, type ResourceIdBinding, type ResourceMatch, type ResourceRef, type ResourceScope, type ResourceType, type RiskAssessmentResult, type RiskFactor, type RiskLevel, SDJwtClient, SIGNATURE_HEADER, SIGNATURE_VERSION_PREFIX, type SchemaHandle, ScopeUnmatchedError, type SecondaryBinding, type SignRequestArgs, SimpleRebac, type SlackConfig, StandardActionCategory, type SuggestGrantRequest, type SuggestedAction, type SuggestedConstraints, type SuggestedGrant, type SuggestedResource, type SuggestionRiskLevel, TIER_LIMITS, type TargetBindings, type TargetConstraint, TargetResolver, type TierLimits, type TimeWindowCheckResult, type TimeWindowConstraint, type ToolDefinition, type ToolInvocation, ToolManager, type ToolPermissionRequest, type ToolPermissionVC, UNCLASSIFIED_ACTION_RISK, type UnifiedResourceType, type UpdateGrantRequest, type UserIdentity, type UserIdentityConfig, type UserIdentityCreateOptions, UserIdentityManager, UserKeyPairManager, type UserTier, VALID_MCP_ACTIONS, VALID_MCP_TOOLS, VCExpiredError, VCManager, VCRevokedError, VCStatus, type VCTemplate, VCType, VPManager, type VPRequest, type ValidateActionInputResult, type VcApprovalClaim, type VcSchedulingDelegationClaim, type VerifiablePresentation, type VerificationMethod, type VerifiedVcClaims, type VerifyInvitationResponse, type VerifyReceiptRequest, type VerifyReceiptResult, type VerifySDJWTVCResult, type VpVerifier, WRITE_ACTION_NAMES, type WeeklyReportData, type WeeklyReportSummary, buildCanonicalString, buildCedarEntities, buildGrantIdFields, buildKbJwtPayload, buildPhase1VcClaims, buildValidationErrors, canonicalResourceId, canonicalizeAction, canonicalizeSalient, canonicalizeWithFields, checkPermissionWithVP, classifyCedarErrorMessage, compareResourceIds, configure, createAjv, createCedarEngine, createDidJwk, credentialStatusToVCStatus, defaultConstraintEvaluator, digestWithFields, evaluateConstraints, extractProjectKey, extractPublicKey, extractPublicKeyFromDid, formatSignatureHeader, generateActionParamsDisplay, generateActionSummary, generateKeyPair, generateNonce, getActionAliases, getAllActionForms, getAllValidMcpActionNames, getClient, getDefaultDisclosureFields, getKeyIdFromDid, getRequiredRelations, getRequiredScopes, getTierLimits, getValidMcpActionNames, grantConstraintsToPermissionConstraints, grantToPermissionRules, indexActions, indexCapabilities, isActionEquivalent, isCanonicalProvider, isDecision, isFreemailDomain, isPolicyRefInline, isPolicyRefReference, isUnlimited, isValidDidJwk, isValidProvider, isWriteAction, loadActionRegistryFromFile, loadActionRegistryFromObject, looksLikeNativeId, normalizeDomain, normalizeMcpActionName, parseGrantAction, parseGrantResourceType, parseSignatureHeader, planDelegationForVC, publicKeysMatch, readVcExpSeconds, resolveActionRisk, resolveActionsFromSelection, resolveProvider, resolveResourceType, resolveUserTier, resolverBackedFieldsFor, salientDigest, salientFieldsFor, sha256Hex, signJWT, signRequest, stripResolvedParams, validateActionInput, validateRegistryObject, vcStatusToCredentialStatus, verifyJWT, version };

package/dist/index.d.ts

@@ -48,7 +48,7 @@ export { buildValidationErrors, classifyCedarErrorMessage, } from './policy';
 export type { PolicyValidationError } from './policy';
 export { buildCedarEntities, DECISION_VALUES, isDecision } from './policy';
 export type { CedarEntitiesInput, CedarEntityDescriptor, Decision, } from './policy';
-export { resolveActionRisk } from './registry/action-risk';
+export { resolveActionRisk, UNCLASSIFIED_ACTION_RISK } from './registry/action-risk';
 export type { ActionRisk } from './registry/action-risk';
 export declare const version = "0.0.1";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAGrD,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAGrD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,YAAY,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAA;AAC/E,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EACL,iBAAiB,EACjB,+BAA+B,EAC/B,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEjE,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,mCAAmC,CAAA;AAG1C,cAAc,WAAW,CAAA;AAGzB,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAA;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAGzD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACtE,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,YAAY,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAErD,cAAc,YAAY,CAAA;AAG1B,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAA;AACtH,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAGnE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAGlD,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,uBAAuB,EACvB,aAAa,EACb,eAAe,EACf,eAAe,GAChB,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AACtE,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,gCAAgC,CAAA;AAEvC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,qCAAqC,CAAA;AAC5C,YAAY,EACV,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,qCAAqC,CAAA;AAC5C,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AAGnE,cAAc,SAAS,CAAA;AAKvB,YAAY,EACV,SAAS,EACT,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,aAAa,EACb,eAAe,EACf,2BAA2B,GAC5B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,WAAW,EACX,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAG7E,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAIhF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAK7E,cAAc,sBAAsB,CAAA;AAGpC,OAAO,EACL,iBAAiB,EACjB,2BAA2B,EAC3B,eAAe,GAChB,MAAM,UAAU,CAAA;AACjB,YAAY,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,UAAU,EACV,YAAY,EACZ,eAAe,GAChB,MAAM,UAAU,CAAA;AAKjB,OAAO,EACL,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAGrD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAC1E,YAAY,EACV,kBAAkB,EAClB,qBAAqB,EACrB,QAAQ,GACT,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGxD,eAAO,MAAM,OAAO,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAGrD,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAGrD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,YAAY,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAA;AAC/E,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EACL,iBAAiB,EACjB,+BAA+B,EAC/B,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEjE,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,mCAAmC,CAAA;AAG1C,cAAc,WAAW,CAAA;AAGzB,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAA;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAGzD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACtE,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,YAAY,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAErD,cAAc,YAAY,CAAA;AAG1B,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAA;AACtH,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAGnE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAGlD,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,uBAAuB,EACvB,aAAa,EACb,eAAe,EACf,eAAe,GAChB,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AACtE,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,gCAAgC,CAAA;AAEvC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,qCAAqC,CAAA;AAC5C,YAAY,EACV,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,qCAAqC,CAAA;AAC5C,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AAGnE,cAAc,SAAS,CAAA;AAKvB,YAAY,EACV,SAAS,EACT,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,aAAa,EACb,eAAe,EACf,2BAA2B,GAC5B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,WAAW,EACX,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAG7E,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAIhF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAK7E,cAAc,sBAAsB,CAAA;AAGpC,OAAO,EACL,iBAAiB,EACjB,2BAA2B,EAC3B,eAAe,GAChB,MAAM,UAAU,CAAA;AACjB,YAAY,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,UAAU,EACV,YAAY,EACZ,eAAe,GAChB,MAAM,UAAU,CAAA;AAKjB,OAAO,EACL,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAGrD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAC1E,YAAY,EACV,kBAAkB,EAClB,qBAAqB,EACrB,QAAQ,GACT,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AACpF,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGxD,eAAO,MAAM,OAAO,UAAU,CAAA"}

package/dist/index.js

@@ -89,6 +89,7 @@ __export(index_exports, {
   TIER_LIMITS: () => TIER_LIMITS,
   TargetResolver: () => TargetResolver,
   ToolManager: () => ToolManager,
+  UNCLASSIFIED_ACTION_RISK: () => UNCLASSIFIED_ACTION_RISK,
   UserIdentityManager: () => UserIdentityManager,
   UserKeyPairManager: () => UserKeyPairManager,
   VALID_MCP_ACTIONS: () => VALID_MCP_ACTIONS,
@@ -11337,6 +11338,7 @@ function parseEntityUid(uid) {
 }
 
 // src/registry/action-risk.ts
+var UNCLASSIFIED_ACTION_RISK = "high";
 var HIGH_RISK_SUFFIXES = /* @__PURE__ */ new Set([
   "send",
   "post",
@@ -11380,13 +11382,13 @@ var REGISTRY_RISK_BY_ACTION = (() => {
 function resolveActionRiskBySuffix(lowerAction) {
   const segments = lowerAction.split(".");
   const last = segments[segments.length - 1] ?? "";
-  if (!last) return "medium";
+  if (!last) return UNCLASSIFIED_ACTION_RISK;
   if (HIGH_RISK_SUFFIXES.has(last)) return "high";
   if (LOW_RISK_SUFFIXES.has(last)) return "low";
-  return "medium";
+  return UNCLASSIFIED_ACTION_RISK;
 }
 function resolveActionRisk(action) {
-  if (!action || typeof action !== "string") return "medium";
+  if (!action || typeof action !== "string") return UNCLASSIFIED_ACTION_RISK;
   const lower = action.toLowerCase();
   const registryRisk = REGISTRY_RISK_BY_ACTION.get(lower);
   if (registryRisk) return registryRisk;
@@ -11491,6 +11493,7 @@ var version = "0.0.1";
   TIER_LIMITS,
   TargetResolver,
   ToolManager,
+  UNCLASSIFIED_ACTION_RISK,
   UserIdentityManager,
   UserKeyPairManager,
   VALID_MCP_ACTIONS,