@vess-id/ai-identity 0.16.0-alpha.12 → 0.16.0-alpha.14

package/dist/agent/agent-did-manager.d.ts

@@ -1,4 +1,28 @@
 import { KeyManager } from '../did/key-manager';
+export interface AgentDIDManagerOptions {
+    /**
+     * Directory holding the `<agentId>.did` files that map an agent ID to its DID.
+     *
+     * 🔴 Omit this and the default stays exactly what it has always been —
+     * `~/.vess-aidentity/agent-dids/`. Every mapping written so far lives there,
+     * so changing the default would make existing agents unresolvable.
+     *
+     * Supply it for either of two reasons:
+     *
+     * - **Tenant isolation.** With the path hard-coded to `os.homedir()`, one
+     *   process serving several tenants funnels all of them into a single shared
+     *   directory, where agent IDs can collide across tenants.
+     *
+     * - **Test isolation.** Tests could not otherwise steer this path away from
+     *   the developer's real home. Under jest, `process.env.HOME = x` does not
+     *   help: jest-environment-node replaces `process.env` with a plain object
+     *   behind a Proxy, so the assignment never reaches `setenv(3)`, while
+     *   `os.homedir()` goes through libuv to `getenv("HOME")` and reads the real
+     *   environ. Both reads and writes therefore escape to the real home and the
+     *   suite stays green while polluting it.
+     */
+    mappingDir?: string;
+}
 /**
  * Agent DID Manager
  * Manages DID generation and lifecycle for AI Agents specifically
@@ -6,7 +30,30 @@ import { KeyManager } from '../did/key-manager';
 export declare class AgentDIDManager {
     private keyManager;
     private agentDIDMap;
-    constructor(keyManager?: KeyManager);
+    private readonly mappingDirOverride?;
+    constructor(keyManager?: KeyManager, options?: AgentDIDManagerOptions);
+    /**
+     * 🔴 The one place the mapping directory is derived.
+     *
+     * It used to be derived independently in four methods, and two of them
+     * (`loadAgentDIDMapping` / `deleteAgentDIDMapping`) looked at `~/.vess/`
+     * while the writes went to `~/.vess-aidentity/`. Within a single process the
+     * in-memory Map answered first, so nobody noticed; across processes
+     * `getAgentDID` failed every time — whenever a long-lived host restarts, or
+     * on each Lambda invocation. The four copies are now one, so the paths
+     * cannot drift apart again.
+     *
+     * (An earlier version of this note named agentd as the example. It is not
+     * one: agentd resolves Agent DIDs through its own store — OS keychain plus
+     * SQLite, keyed by project × client — and takes only stateless primitives
+     * from this SDK. Nothing in this repo constructs an AgentDIDManager; the
+     * callers are SDK consumers.)
+     *
+     * The default resolves to `.vess-aidentity` because that is where the real
+     * files ended up; treating `.vess` as canonical would orphan every existing
+     * mapping.
+     */
+    private mappingDir;
     /**
      * Generate a new DID for an AI Agent
      */

package/dist/agent/agent-did-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-did-manager.d.ts","sourceRoot":"","sources":["../../src/agent/agent-did-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAI/C;;;GAGG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,WAAW,CAAiC;gBAExC,UAAU,CAAC,EAAE,UAAU;IAInC;;OAEG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBxD;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgBnD;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASpD;;OAEG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAcpD;;OAEG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBpD;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IA8BvE;;OAEG;YACW,mBAAmB;IAYjC;;OAEG;YACW,mBAAmB;IAcjC;;OAEG;YACW,qBAAqB;CAapC"}
+{"version":3,"file":"agent-did-manager.d.ts","sourceRoot":"","sources":["../../src/agent/agent-did-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAI/C,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;GAGG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,WAAW,CAAiC;IACpD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAQ;gBAEhC,UAAU,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,sBAAsB;IAKrE;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,UAAU;IASxB;;OAEG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBxD;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgBnD;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASpD;;OAEG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAcpD;;OAEG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBpD;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IA4BvE;;OAEG;YACW,mBAAmB;IAYjC;;OAEG;YACW,mBAAmB;IAcjC;;OAEG;YACW,qBAAqB;CAapC"}

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAa,MAAM,UAAU,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAElD,qBAAa,eAAe;IAC1B,SAAgB,KAAK,EAAE,YAAY,CAAA;IACnC,SAAgB,IAAI,EAAE,mBAAmB,CAAA;IACzC,SAAgB,EAAE,EAAE,SAAS,CAAA;IAC7B,SAAgB,EAAE,EAAE,SAAS,CAAA;IAC7B,SAAgB,IAAI,EAAE,WAAW,CAAA;IACjC,SAAgB,KAAK,EAAE,YAAY,CAAA;IAEnC,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,YAAY,CAAC,CAAO;gBAEhB,MAAM,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,MAAM;IAiBvD;;OAEG;IACG,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAWzC;;OAEG;IACH,eAAe,IAAI,KAAK,GAAG,SAAS;IAIpC;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI1C;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI1C;;;OAGG;IACG,mBAAmB,CACvB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;QACP,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACnC,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,GACA,OAAO,CAAC,MAAM,CAAC;IAiBlB;;;OAGG;IACG,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC,EAAE,EACxC,OAAO,EAAE;QACP,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,GACA,OAAO,CAAC,MAAM,CAAC;IAgBlB;;OAEG;IACG,UAAU,CAAC,CAAC,GAAG,GAAG,EACtB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,GAAG,EAAE,MAAM,EAAE,GACZ,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;CAYjC;AAKD,wBAAgB,SAAS,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,eAAe,CAKtF;AAED,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAa,MAAM,UAAU,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAElD,qBAAa,eAAe;IAC1B,SAAgB,KAAK,EAAE,YAAY,CAAA;IACnC,SAAgB,IAAI,EAAE,mBAAmB,CAAA;IACzC,SAAgB,EAAE,EAAE,SAAS,CAAA;IAC7B,SAAgB,EAAE,EAAE,SAAS,CAAA;IAC7B,SAAgB,IAAI,EAAE,WAAW,CAAA;IACjC,SAAgB,KAAK,EAAE,YAAY,CAAA;IAEnC,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,YAAY,CAAC,CAAO;gBAEhB,MAAM,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,MAAM;IAuBvD;;OAEG;IACG,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAWzC;;OAEG;IACH,eAAe,IAAI,KAAK,GAAG,SAAS;IAIpC;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI1C;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI1C;;;OAGG;IACG,mBAAmB,CACvB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;QACP,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACnC,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,GACA,OAAO,CAAC,MAAM,CAAC;IAiBlB;;;OAGG;IACG,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC,EAAE,EACxC,OAAO,EAAE;QACP,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,GACA,OAAO,CAAC,MAAM,CAAC;IAgBlB;;OAEG;IACG,UAAU,CAAC,CAAC,GAAG,GAAG,EACtB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,GAAG,EAAE,MAAM,EAAE,GACZ,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;CAWjC;AAKD,wBAAgB,SAAS,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,eAAe,CAKtF;AAED,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA"}

package/dist/config/index.d.ts

@@ -1,3 +1,4 @@
+import type { KeyStorageProvider } from '../storage/key-storage.interface';
 export interface AIdentityConfig {
     didApi?: {
         baseUrl: string;
@@ -20,6 +21,59 @@ export interface AIdentityConfig {
     storage?: {
         keyStorePath?: string;
     };
+    /**
+     * Where agentId → DID mappings are kept.
+     *
+     * 🔴 Leave it unset and the default is unchanged: `~/.vess-aidentity/agent-dids`.
+     * Every mapping written so far lives there, so moving the default would make
+     * existing agents unresolvable.
+     *
+     * Set it when a single process serves several tenants — otherwise they all
+     * share one directory and agent IDs can collide across them — or when a test
+     * must not touch the developer's real home.
+     *
+     * Reaches `AgentDIDManager` through `AgentManager`; without this field a
+     * caller could implement nothing and had no way to move the path, the same
+     * gap `keyStorage` closed for private keys.
+     */
+    agentMappingDir?: string;
+    /**
+     * Where the user DID (`user-did.txt`) is kept.
+     *
+     * 🔴 Leave it unset and the default is unchanged: `~/.vess-aidentity`. Note
+     * this is the config root itself, not a subdirectory — the user DID is one
+     * fixed filename sitting alongside `keys/` and `agent-dids/`. Moving the
+     * default would orphan the existing identity, and every VC issued so far
+     * names that DID as its issuer.
+     *
+     * Set it when a single process serves several tenants — the filename is
+     * fixed, so without it the last `createUserDID` overwrites every other
+     * tenant's issuer identity — or when a test must not touch the developer's
+     * real home.
+     *
+     * Reaches `UserIdentityManager` through `AIdentityClient`; separate from
+     * `agentMappingDir` because the two point at different directories and a
+     * caller may well want to move only one.
+     */
+    userMappingDir?: string;
+    /**
+     * Where private keys are kept.
+     *
+     * 🔴 Supply this when the filesystem is not durable. On AWS Lambda and
+     * similar, the default provider writes to a disk that is wiped between
+     * invocations, so keys fail to persist SILENTLY — nothing throws at
+     * construction, and the failure surfaces later as a key that cannot be
+     * found.
+     *
+     * `KeyManager` has always accepted a provider; what was missing was a way
+     * to reach it from here, so a client could implement the interface and had
+     * nowhere to put the result. Distinct from `storage.keyStorePath`, which
+     * only moves the filesystem provider's directory and cannot replace it.
+     *
+     * Implement `KeyStorageProvider` against S3, DynamoDB, Secrets Manager or
+     * anything else; `MemoryKeyStorage` is exported for the ephemeral case.
+     */
+    keyStorage?: KeyStorageProvider;
 }
 export declare function configure(config: AIdentityConfig): void;
 export declare function getConfig(): AIdentityConfig;

package/dist/config/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE;QACP,OAAO,EAAE,MAAM,CAAA;QACf,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB,CAAA;IACD,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,MAAM,CAAA;QACf,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB,CAAA;IACD,WAAW,CAAC,EAAE;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB,CAAA;IACD,QAAQ,CAAC,EAAE;QACT,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD,OAAO,CAAC,EAAE;QACR,YAAY,CAAC,EAAE,MAAM,CAAA;KACtB,CAAA;CACF;AAID,wBAAgB,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAEvD;AAED,wBAAgB,SAAS,IAAI,eAAe,CAE3C;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMjD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMpD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMtD;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,KAAK,GAAG,QAAQ,GAAG,UAAU,GAAG,GAAG,CA+BzE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AAE1E,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE;QACP,OAAO,EAAE,MAAM,CAAA;QACf,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB,CAAA;IACD,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,MAAM,CAAA;QACf,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB,CAAA;IACD,WAAW,CAAC,EAAE;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB,CAAA;IACD,QAAQ,CAAC,EAAE;QACT,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD,OAAO,CAAC,EAAE;QACR,YAAY,CAAC,EAAE,MAAM,CAAA;KACtB,CAAA;IAED;;;;;;;;;;;;;;OAcG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;;;;;;;;;;;;;;;;OAiBG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAA;CAChC;AAID,wBAAgB,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAEvD;AAED,wBAAgB,SAAS,IAAI,eAAe,CAE3C;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMjD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMpD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMtD;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,KAAK,GAAG,QAAQ,GAAG,UAAU,GAAG,GAAG,CA+BzE"}

package/dist/did/agent.d.ts

@@ -1,9 +1,15 @@
 import { Agent, DIDDocument } from '../types';
 import { KeyManager } from './key-manager';
+import { AgentDIDManagerOptions } from '../agent/agent-did-manager';
 export declare class AgentManager {
     private keyManager;
     private agentDIDManager;
-    constructor(keyManager?: KeyManager);
+    /**
+     * 🔴 `options` is what makes `config.agentMappingDir` mean anything: without
+     * forwarding it, a caller's directory is accepted by the config and then
+     * ignored, and every tenant lands back in the shared `~/.vess-aidentity`.
+     */
+    constructor(keyManager?: KeyManager, options?: AgentDIDManagerOptions);
     /**
      * Create a new AI agent with unique ID and DID
      */

package/dist/did/agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/did/agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAE7C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAI1C,qBAAa,YAAY;IACvB,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,eAAe,CAAiB;gBAE5B,UAAU,CAAC,EAAE,UAAU;IAKnC;;OAEG;IACG,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IA8B7E;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAInD;;OAEG;IACG,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAYhE;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD;;OAEG;IACG,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAuBhD;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,UAAU,EAAE,GAAG,CAAA;KAAE,CAAC;IAiBrE;;OAEG;IACG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1D;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAqBlD,OAAO,CAAC,iBAAiB;IAqB3B,OAAO,CAAC,oBAAoB;YAQd,WAAW;CAK1B"}
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/did/agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAE7C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAmB,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AAGpF,qBAAa,YAAY;IACvB,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,eAAe,CAAiB;IAExC;;;;OAIG;gBACS,UAAU,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,sBAAsB;IAKrE;;OAEG;IACG,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IA8B7E;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAInD;;OAEG;IACG,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAYhE;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD;;OAEG;IACG,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAuBhD;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,UAAU,EAAE,GAAG,CAAA;KAAE,CAAC;IAiBrE;;OAEG;IACG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1D;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAqBlD,OAAO,CAAC,iBAAiB;IAqB3B,OAAO,CAAC,oBAAoB;YAQd,WAAW;CAK1B"}

package/dist/identity/user-identity-manager.d.ts

@@ -1,5 +1,36 @@
 import { KeyManager } from '../did/key-manager';
 import { DIDDocument } from '../types';
+export interface UserIdentityManagerOptions {
+    /**
+     * Directory holding `user-did.txt`, the single file naming the DID this
+     * installation issues VCs as.
+     *
+     * 🔴 Omit this and the default stays exactly what it has always been —
+     * `~/.vess-aidentity/`. Note this is the config root itself, NOT a
+     * subdirectory: unlike `AgentDIDManager`, which owns the whole
+     * `agent-dids/` subtree, this manager owns one fixed filename inside a
+     * directory it shares with `keys/`, `agent-dids/` and `vc-cache.json`.
+     * Changing the default would orphan the existing user identity, and every
+     * VC already issued names that DID as its issuer.
+     *
+     * Supply it for either of two reasons:
+     *
+     * - **Tenant isolation.** With the path hard-coded to `os.homedir()`, one
+     *   process serving several tenants has a single user DID for all of them.
+     *   Worse than the agent case: agent IDs at least namespace the files, while
+     *   the user DID is one fixed filename, so the last tenant to call
+     *   `createUserDID` silently overwrites everyone else's issuer identity.
+     *
+     * - **Test isolation.** Tests could not otherwise steer this path away from
+     *   the developer's real home. Under jest, `process.env.HOME = x` does not
+     *   help: jest-environment-node replaces `process.env` with a plain object
+     *   behind a Proxy, so the assignment never reaches `setenv(3)`, while
+     *   `os.homedir()` goes through libuv to `getenv("HOME")` and reads the real
+     *   environ. Both reads and writes therefore escape to the real home and the
+     *   suite stays green while clobbering the developer's own user DID.
+     */
+    mappingDir?: string;
+}
 /**
  * User Identity Manager
  * Manages DID generation and lifecycle for Users (Issuers) specifically
@@ -8,7 +39,30 @@ import { DIDDocument } from '../types';
 export declare class UserIdentityManager {
     private keyManager;
     private currentUserDID;
-    constructor(keyManager?: KeyManager);
+    private readonly mappingDirOverride?;
+    constructor(keyManager?: KeyManager, options?: UserIdentityManagerOptions);
+    /**
+     * 🔴 The one place the user-DID directory is derived.
+     *
+     * It used to be derived independently in `saveUserDID` / `loadUserDID` /
+     * `clearUserDID`. That is the same shape `AgentDIDManager` was in before
+     * PR #1442, where the copies had actually drifted — load and delete looked
+     * at `~/.vess/` while save wrote to `~/.vess-aidentity/`. Nothing caught it
+     * in-process because the in-memory field answered first; across processes
+     * the load always missed. Here `currentUserDID` plays that same masking
+     * role, so a drift would likewise only show up after a restart.
+     *
+     * The default is the config root `~/.vess-aidentity/` and must stay that
+     * way — see the note on `UserIdentityManagerOptions.mappingDir`.
+     */
+    private userDidDir;
+    /**
+     * Absolute path of the file holding the user DID.
+     *
+     * Derived from `userDidDir()` so the filename cannot drift either — the
+     * three call sites used to spell `'user-did.txt'` out separately as well.
+     */
+    private userDidFile;
     /**
      * Get or create current user DID
      * This represents the user who will be the issuer of VCs

package/dist/identity/user-identity-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-identity-manager.d.ts","sourceRoot":"","sources":["../../src/identity/user-identity-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAG/C,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAEtC;;;;GAIG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,cAAc,CAAsB;gBAEhC,UAAU,CAAC,EAAE,UAAU;IAInC;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IAgB1C;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;IAiBtC;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC;IAcpC;;OAEG;IACG,cAAc,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAUxD;;OAEG;IACG,kBAAkB,IAAI,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,GAAG,CAAC;QAAC,WAAW,EAAE,WAAW,CAAA;KAAE,CAAC;IAY/F;;OAEG;IACG,kBAAkB,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IASjF;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IAY1C;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAK5B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAqBzB;;OAEG;YACW,WAAW;IAYzB;;OAEG;YACW,WAAW;IAczB;;OAEG;YACW,YAAY;CAa3B"}
+{"version":3,"file":"user-identity-manager.d.ts","sourceRoot":"","sources":["../../src/identity/user-identity-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAG/C,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAEtC,MAAM,WAAW,0BAA0B;IACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;;GAIG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,cAAc,CAAsB;IAC5C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAQ;gBAEhC,UAAU,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,0BAA0B;IAKzE;;;;;;;;;;;;;OAaG;YACW,UAAU;IASxB;;;;;OAKG;YACW,WAAW;IAMzB;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IAgB1C;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;IAiBtC;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC;IAcpC;;OAEG;IACG,cAAc,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAUxD;;OAEG;IACG,kBAAkB,IAAI,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,GAAG,CAAC;QAAC,WAAW,EAAE,WAAW,CAAA;KAAE,CAAC;IAY/F;;OAEG;IACG,kBAAkB,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IASjF;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IAY1C;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAK5B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAqBzB;;OAEG;YACW,WAAW;IAUzB;;OAEG;YACW,WAAW;IAazB;;OAEG;YACW,YAAY;CAY3B"}