@vess-id/ai-identity 0.19.0 → 0.21.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (93) hide show
  1. package/dist/agent/agent-did-manager.d.ts +48 -1
  2. package/dist/agent/agent-did-manager.d.ts.map +1 -1
  3. package/dist/client.d.ts +2 -2
  4. package/dist/client.d.ts.map +1 -1
  5. package/dist/config/index.d.ts +54 -0
  6. package/dist/config/index.d.ts.map +1 -1
  7. package/dist/did/agent.d.ts +7 -1
  8. package/dist/did/agent.d.ts.map +1 -1
  9. package/dist/identity/user-identity-manager.d.ts +55 -1
  10. package/dist/identity/user-identity-manager.d.ts.map +1 -1
  11. package/dist/index.d.mts +6583 -1822
  12. package/dist/index.d.ts +19 -13
  13. package/dist/index.d.ts.map +1 -1
  14. package/dist/index.js +10737 -2927
  15. package/dist/index.js.map +1 -1
  16. package/dist/index.mjs +10720 -2917
  17. package/dist/index.mjs.map +1 -1
  18. package/dist/registry/action-registry-json.d.ts +5371 -1325
  19. package/dist/registry/action-registry-json.d.ts.map +1 -1
  20. package/dist/registry/action-registry.d.ts +13 -0
  21. package/dist/registry/action-registry.d.ts.map +1 -1
  22. package/dist/registry/action-risk.d.ts +64 -18
  23. package/dist/registry/action-risk.d.ts.map +1 -1
  24. package/dist/registry/action-summary.d.ts.map +1 -1
  25. package/dist/registry/index.d.ts +3 -3
  26. package/dist/registry/index.d.ts.map +1 -1
  27. package/dist/resolver/approval-time-resolution.d.ts +72 -0
  28. package/dist/resolver/approval-time-resolution.d.ts.map +1 -0
  29. package/dist/resolver/salient-digest.d.ts +48 -0
  30. package/dist/resolver/salient-digest.d.ts.map +1 -0
  31. package/dist/types/grant.d.ts +13 -2
  32. package/dist/types/grant.d.ts.map +1 -1
  33. package/dist/types/intent.d.ts +1 -1
  34. package/dist/types/intent.d.ts.map +1 -1
  35. package/dist/types/permission-mode.d.ts +1 -1
  36. package/dist/types/permission-mode.d.ts.map +1 -1
  37. package/dist/types/permission-vc.d.ts +81 -0
  38. package/dist/types/permission-vc.d.ts.map +1 -1
  39. package/dist/types/vc.d.ts +11 -1
  40. package/dist/types/vc.d.ts.map +1 -1
  41. package/dist/utils/sdjwt-client.d.ts +242 -5
  42. package/dist/utils/sdjwt-client.d.ts.map +1 -1
  43. package/dist/utils/sdjwt-disclosure.d.ts.map +1 -1
  44. package/dist/vc/api-vc-manager.d.ts +5 -0
  45. package/dist/vc/api-vc-manager.d.ts.map +1 -1
  46. package/dist/vc/vc-manager.d.ts.map +1 -1
  47. package/dist/vp/vp-manager.d.ts +35 -0
  48. package/dist/vp/vp-manager.d.ts.map +1 -1
  49. package/package.json +3 -3
  50. package/dist/constraint/__tests__/fixtures/constraint.fixtures.d.ts +0 -56
  51. package/dist/constraint/__tests__/fixtures/constraint.fixtures.d.ts.map +0 -1
  52. package/dist/internal-signature/__tests__/canonical.spec.d.ts +0 -2
  53. package/dist/internal-signature/__tests__/canonical.spec.d.ts.map +0 -1
  54. package/dist/internal-signature/__tests__/signer-roundtrip.spec.d.ts +0 -2
  55. package/dist/internal-signature/__tests__/signer-roundtrip.spec.d.ts.map +0 -1
  56. package/dist/internal-signature/__tests__/signer.spec.d.ts +0 -2
  57. package/dist/internal-signature/__tests__/signer.spec.d.ts.map +0 -1
  58. package/dist/monitoring/metrics-manager.d.ts +0 -74
  59. package/dist/monitoring/metrics-manager.d.ts.map +0 -1
  60. package/dist/policy/__tests__/cedar-engine.spec.d.ts +0 -17
  61. package/dist/policy/__tests__/cedar-engine.spec.d.ts.map +0 -1
  62. package/dist/policy/__tests__/cedar-entities.spec.d.ts +0 -14
  63. package/dist/policy/__tests__/cedar-entities.spec.d.ts.map +0 -1
  64. package/dist/policy/__tests__/decision-enum.spec.d.ts +0 -16
  65. package/dist/policy/__tests__/decision-enum.spec.d.ts.map +0 -1
  66. package/dist/registry/__tests__/action-input-validator.spec.d.ts +0 -10
  67. package/dist/registry/__tests__/action-input-validator.spec.d.ts.map +0 -1
  68. package/dist/registry/__tests__/action-registry-freebusy.spec.d.ts +0 -13
  69. package/dist/registry/__tests__/action-registry-freebusy.spec.d.ts.map +0 -1
  70. package/dist/registry/__tests__/action-registry-inbox.spec.d.ts +0 -9
  71. package/dist/registry/__tests__/action-registry-inbox.spec.d.ts.map +0 -1
  72. package/dist/registry/__tests__/action-registry-scheduling.spec.d.ts +0 -13
  73. package/dist/registry/__tests__/action-registry-scheduling.spec.d.ts.map +0 -1
  74. package/dist/registry/__tests__/action-registry-validation.spec.d.ts +0 -13
  75. package/dist/registry/__tests__/action-registry-validation.spec.d.ts.map +0 -1
  76. package/dist/registry/__tests__/action-risk-registry-driven.spec.d.ts +0 -15
  77. package/dist/registry/__tests__/action-risk-registry-driven.spec.d.ts.map +0 -1
  78. package/dist/registry/__tests__/action-risk.spec.d.ts +0 -17
  79. package/dist/registry/__tests__/action-risk.spec.d.ts.map +0 -1
  80. package/dist/registry/__tests__/guidance-examples.spec.d.ts +0 -2
  81. package/dist/registry/__tests__/guidance-examples.spec.d.ts.map +0 -1
  82. package/dist/registry/__tests__/high-risk-resource-binding-invariant.spec.d.ts +0 -30
  83. package/dist/registry/__tests__/high-risk-resource-binding-invariant.spec.d.ts.map +0 -1
  84. package/dist/registry/__tests__/reauth-constants.spec.d.ts +0 -2
  85. package/dist/registry/__tests__/reauth-constants.spec.d.ts.map +0 -1
  86. package/dist/types/__tests__/cedar-policy.spec.d.ts +0 -8
  87. package/dist/types/__tests__/cedar-policy.spec.d.ts.map +0 -1
  88. package/dist/types/__tests__/permission-vc-v3.spec.d.ts +0 -9
  89. package/dist/types/__tests__/permission-vc-v3.spec.d.ts.map +0 -1
  90. package/dist/types/__tests__/phase1-vc-factory.spec.d.ts +0 -9
  91. package/dist/types/__tests__/phase1-vc-factory.spec.d.ts.map +0 -1
  92. package/dist/types/__tests__/policy-ref.spec.d.ts +0 -9
  93. package/dist/types/__tests__/policy-ref.spec.d.ts.map +0 -1
@@ -1,56 +0,0 @@
1
- import { GrantConstraints, TimeWindowConstraint, EvaluationContext } from '../../../types';
2
- export declare const mockExecutorDid = "did:key:z6MkiY62766b1LJkExWMsM3QG4WtX23zJpRgVLwZBKQhyt6d";
3
- /**
4
- * Create mock time window constraint
5
- */
6
- export declare const createMockTimeWindow: (overrides?: Partial<TimeWindowConstraint>) => TimeWindowConstraint;
7
- /**
8
- * Create mock constraints
9
- */
10
- export declare const createMockConstraints: (overrides?: Partial<GrantConstraints>) => GrantConstraints;
11
- /**
12
- * Create mock evaluation context
13
- */
14
- export declare const createMockContext: (overrides?: Partial<EvaluationContext>) => EvaluationContext;
15
- /**
16
- * Create constraints that should pass all checks
17
- */
18
- export declare const createPassingConstraints: () => GrantConstraints;
19
- /**
20
- * Create constraints that should fail time window check
21
- */
22
- export declare const createFailingTimeWindowConstraints: () => GrantConstraints;
23
- /**
24
- * Create constraints that should fail invocation limit
25
- */
26
- export declare const createExhaustedConstraints: () => GrantConstraints;
27
- /**
28
- * Create constraints that should fail IP check
29
- */
30
- export declare const createRestrictedIpConstraints: () => GrantConstraints;
31
- /**
32
- * Create overnight time window (e.g., 22:00-06:00)
33
- */
34
- export declare const createOvernightTimeWindow: () => TimeWindowConstraint;
35
- /**
36
- * Test IPs for various scenarios
37
- */
38
- export declare const testIps: {
39
- inRange192: string;
40
- inRange10: string;
41
- outOfRange: string;
42
- localhost: string;
43
- ipv6Localhost: string;
44
- ipv6Public: string;
45
- };
46
- /**
47
- * Test timestamps for various scenarios
48
- */
49
- export declare const createTestTimestamps: () => {
50
- weekdayMorning: Date;
51
- weekdayEvening: Date;
52
- weekendMorning: Date;
53
- midnight: Date;
54
- now: Date;
55
- };
56
- //# sourceMappingURL=constraint.fixtures.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"constraint.fixtures.d.ts","sourceRoot":"","sources":["../../../../src/constraint/__tests__/fixtures/constraint.fixtures.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,EAClB,MAAM,gBAAgB,CAAA;AAGvB,eAAO,MAAM,eAAe,6DAA6D,CAAA;AAEzF;;GAEG;AACH,eAAO,MAAM,oBAAoB,GAAI,YAAW,OAAO,CAAC,oBAAoB,CAAM,KAAG,oBAMnF,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAAI,YAAW,OAAO,CAAC,gBAAgB,CAAM,KAAG,gBAOhF,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,iBAAiB,GAAI,YAAW,OAAO,CAAC,iBAAiB,CAAM,KAAG,iBAc7E,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,QAAO,gBAW1C,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,kCAAkC,QAAO,gBAOpD,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,QAAO,gBAE5C,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,6BAA6B,QAAO,gBAE/C,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,yBAAyB,QAAO,oBAK3C,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,OAAO;;;;;;;CAOnB,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;CAchC,CAAA"}
@@ -1,2 +0,0 @@
1
- export {};
2
- //# sourceMappingURL=canonical.spec.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"canonical.spec.d.ts","sourceRoot":"","sources":["../../../src/internal-signature/__tests__/canonical.spec.ts"],"names":[],"mappings":""}
@@ -1,2 +0,0 @@
1
- export {};
2
- //# sourceMappingURL=signer-roundtrip.spec.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"signer-roundtrip.spec.d.ts","sourceRoot":"","sources":["../../../src/internal-signature/__tests__/signer-roundtrip.spec.ts"],"names":[],"mappings":""}
@@ -1,2 +0,0 @@
1
- export {};
2
- //# sourceMappingURL=signer.spec.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"signer.spec.d.ts","sourceRoot":"","sources":["../../../src/internal-signature/__tests__/signer.spec.ts"],"names":[],"mappings":""}
@@ -1,74 +0,0 @@
1
- export interface SDJWTMetrics {
2
- issuanceCount: number;
3
- verificationCount: number;
4
- failedIssuances: number;
5
- failedVerifications: number;
6
- averageIssuanceTime: number;
7
- averageVerificationTime: number;
8
- cacheHitRate: number;
9
- lastActivity: Date;
10
- }
11
- export interface OperationMetric {
12
- operation: 'issue' | 'verify';
13
- startTime: number;
14
- endTime: number;
15
- success: boolean;
16
- error?: string;
17
- issuerDid?: string;
18
- credentialType?: string;
19
- }
20
- export declare class MetricsManager {
21
- private metrics;
22
- private operations;
23
- private maxOperationHistory;
24
- /**
25
- * Start tracking an operation
26
- */
27
- startOperation(operation: 'issue' | 'verify', metadata?: Record<string, any>): string;
28
- /**
29
- * End tracking an operation
30
- */
31
- endOperation(_operationId: string, success: boolean, error?: string): void;
32
- /**
33
- * Update aggregated metrics
34
- */
35
- private updateMetrics;
36
- /**
37
- * Get metrics for a specific issuer or global
38
- */
39
- getMetrics(issuerDid?: string): SDJWTMetrics | null;
40
- /**
41
- * Get all metrics
42
- */
43
- getAllMetrics(): Map<string, SDJWTMetrics>;
44
- /**
45
- * Get recent operations
46
- */
47
- getRecentOperations(limit?: number): OperationMetric[];
48
- /**
49
- * Get operation statistics
50
- */
51
- getOperationStats(): {
52
- totalOperations: number;
53
- successRate: number;
54
- averageResponseTime: number;
55
- operationsPerMinute: number;
56
- };
57
- /**
58
- * Update cache hit rate
59
- */
60
- updateCacheHitRate(issuerDid: string, hit: boolean): void;
61
- /**
62
- * Reset metrics
63
- */
64
- resetMetrics(issuerDid?: string): void;
65
- /**
66
- * Export metrics as JSON
67
- */
68
- exportMetrics(): {
69
- aggregatedMetrics: Record<string, SDJWTMetrics>;
70
- recentOperations: OperationMetric[];
71
- summary: ReturnType<any>;
72
- };
73
- }
74
- //# sourceMappingURL=metrics-manager.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"metrics-manager.d.ts","sourceRoot":"","sources":["../../src/monitoring/metrics-manager.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAA;IACrB,iBAAiB,EAAE,MAAM,CAAA;IACzB,eAAe,EAAE,MAAM,CAAA;IACvB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,mBAAmB,EAAE,MAAM,CAAA;IAC3B,uBAAuB,EAAE,MAAM,CAAA;IAC/B,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,IAAI,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,GAAG,QAAQ,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,OAAO,CAAuC;IACtD,OAAO,CAAC,UAAU,CAAwB;IAC1C,OAAO,CAAC,mBAAmB,CAAO;IAElC;;OAEG;IACH,cAAc,CAAC,SAAS,EAAE,OAAO,GAAG,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM;IAgBrF;;OAEG;IACH,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;IAmB1E;;OAEG;IACH,OAAO,CAAC,aAAa;IA2CrB;;OAEG;IACH,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAKnD;;OAEG;IACH,aAAa,IAAI,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC;IAI1C;;OAEG;IACH,mBAAmB,CAAC,KAAK,SAAM,GAAG,eAAe,EAAE;IAInD;;OAEG;IACH,iBAAiB,IAAI;QACnB,eAAe,EAAE,MAAM,CAAA;QACvB,WAAW,EAAE,MAAM,CAAA;QACnB,mBAAmB,EAAE,MAAM,CAAA;QAC3B,mBAAmB,EAAE,MAAM,CAAA;KAC5B;IAiBD;;OAEG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,IAAI;IA0BzD;;OAEG;IACH,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAStC;;OAEG;IACH,aAAa,IAAI;QACf,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;QAC/C,gBAAgB,EAAE,eAAe,EAAE,CAAA;QACnC,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAA;KACzB;CAOF"}
@@ -1,17 +0,0 @@
1
- /**
2
- * CedarEngine wrapper tests (Phase 1 Step 1, Task 1.2).
3
- *
4
- * Design ref: docs/specs/2026-05-23-cedar-rar-permission-redesign.md Appendix C
5
- * Plan ref: docs/specs/2026-05-23-cedar-rar-implementation-plan-phase1.md §Step 1
6
- *
7
- * Scope of this spec:
8
- * - load wasm + evaluate basic permit / forbid
9
- * - default-deny when no policy matches
10
- * - I-Cedar-4 regression: forbid alone without paired permit → Deny
11
- * - structured errors (not throws) for malformed schema / policy
12
- * - conditional permit driven by request context.approval.granted
13
- * - C3 TOCTOU regression: concurrent loaders share the in-flight Promise
14
- * - load failure clears cached promise so retry can succeed
15
- */
16
- export {};
17
- //# sourceMappingURL=cedar-engine.spec.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"cedar-engine.spec.d.ts","sourceRoot":"","sources":["../../../src/policy/__tests__/cedar-engine.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}
@@ -1,14 +0,0 @@
1
- /**
2
- * Tests for buildCedarEntities (Cedar unification Step 1).
3
- *
4
- * Spec refs:
5
- * - docs/specs/2026-05-24-cedar-unification-design.md §7.1 (Action entity attrs)
6
- * - §7.2 (risk_level resolution rule, Phase 1 baseline)
7
- *
8
- * Phase 1 採用方針 (spec §7.1 rev 3 C1): entity attribute と context の
9
- * 二重 bind を採用する。本 helper は **entity 側のみ** を組み立て、
10
- * `context.action.risk_level` は CedarDecisionService 側で `buildCedarEvaluateRequest`
11
- * が別途注入する。
12
- */
13
- export {};
14
- //# sourceMappingURL=cedar-entities.spec.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"cedar-entities.spec.d.ts","sourceRoot":"","sources":["../../../src/policy/__tests__/cedar-entities.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}
@@ -1,16 +0,0 @@
1
- /**
2
- * Tests for the Decision 7-value enum (Cedar unification Step 1).
3
- *
4
- * Spec refs:
5
- * - docs/specs/2026-05-24-cedar-unification-design.md §3 (Decision 7 値 enum)
6
- * - §3.3 evaluation algorithm (fail-closed: indeterminate when errors[] > 0)
7
- *
8
- * Phase 1 Step 1 scope:
9
- * - Decision type literal accepts the 7 A2A-aligned states
10
- * - isDecision() runtime guard rejects unknown strings
11
- *
12
- * Note: Step 2 will wire the API layer (`CedarDecisionService`) to emit
13
- * these values. This Step 1 only introduces the SDK-side enum.
14
- */
15
- export {};
16
- //# sourceMappingURL=decision-enum.spec.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"decision-enum.spec.d.ts","sourceRoot":"","sources":["../../../src/policy/__tests__/decision-enum.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}
@@ -1,10 +0,0 @@
1
- /**
2
- * Tests for validateActionInput — lightweight registry-schema validation of
3
- * tool-call parameters, run at the callTool entry point (before approval / VC
4
- * gates) so malformed AI calls fail fast with self-correcting diagnostics
5
- * instead of minting an approval request that later fails on invoke.
6
- *
7
- * Task 20: 承認リクエスト発行前のパラメータ形状検証.
8
- */
9
- export {};
10
- //# sourceMappingURL=action-input-validator.spec.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"action-input-validator.spec.d.ts","sourceRoot":"","sources":["../../../src/registry/__tests__/action-input-validator.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}
@@ -1,13 +0,0 @@
1
- /**
2
- * Tests for the calendar.freebusy action in ACTION_REGISTRY.
3
- *
4
- * calendar.freebusy is a read-only availability probe used to check whether a
5
- * calendar is busy over a time window before proposing meeting slots. It never
6
- * returns event details (only busy/free intervals), so it stays in the
7
- * low-risk `calendar.read.basic` capability alongside calendar.event.list /
8
- * calendar.event.read.
9
- *
10
- * Spec: docs/specs/2026-07-03-scheduling-wow-phase1-design.md §4.1
11
- */
12
- export {};
13
- //# sourceMappingURL=action-registry-freebusy.spec.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"action-registry-freebusy.spec.d.ts","sourceRoot":"","sources":["../../../src/registry/__tests__/action-registry-freebusy.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}
@@ -1,9 +0,0 @@
1
- /**
2
- * Tests for the Agent Inbox actions registered in ACTION_REGISTRY.
3
- *
4
- * The 5 inbox.* actions back the Agent Inbox MCP tools so they can be
5
- * exposed and Cedar-evaluated. Risk levels are part of the security contract
6
- * (inbox.send sends a task request to another person → high).
7
- */
8
- export {};
9
- //# sourceMappingURL=action-registry-inbox.spec.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"action-registry-inbox.spec.d.ts","sourceRoot":"","sources":["../../../src/registry/__tests__/action-registry-inbox.spec.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}
@@ -1,13 +0,0 @@
1
- /**
2
- * Tests for the scheduling.request façade action in ACTION_REGISTRY.
3
- *
4
- * scheduling.request is a meeting-time negotiation façade over inbox.send.
5
- * Candidate slots are computed LLM-side; the server only validates. The
6
- * action is internal (no external OAuth), so it carries the single nominal
7
- * base scope `inbox`. Its tool name is auto-derived from the first action
8
- * segment ('scheduling').
9
- *
10
- * Spec: docs/specs/2026-06-10-inbox-intent-routing-design.md §2.1
11
- */
12
- export {};
13
- //# sourceMappingURL=action-registry-scheduling.spec.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"action-registry-scheduling.spec.d.ts","sourceRoot":"","sources":["../../../src/registry/__tests__/action-registry-scheduling.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}
@@ -1,13 +0,0 @@
1
- /**
2
- * Tests for actionMetaSchema validation — `risk` is a REQUIRED field.
3
- *
4
- * Spec ref:
5
- * - docs/specs/2026-05-27-action-risk-registry-driven.md §4.1
6
- *
7
- * Rationale: risk resolution is now registry-driven (RT1). An action added
8
- * without a `risk` field would silently fall back to the suffix heuristic in
9
- * Cedar (e.g. `os.secret.read` → low → auto-permit), a security regression.
10
- * Making `risk` schema-required turns that omission into a CI failure.
11
- */
12
- export {};
13
- //# sourceMappingURL=action-registry-validation.spec.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"action-registry-validation.spec.d.ts","sourceRoot":"","sources":["../../../src/registry/__tests__/action-registry-validation.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}
@@ -1,15 +0,0 @@
1
- /**
2
- * Tests for registry-driven resolveActionRisk (OpenQ-5 root fix).
3
- *
4
- * Spec ref:
5
- * - docs/specs/2026-05-27-action-risk-registry-driven.md §3, §4.2
6
- *
7
- * Contract: ACTION_REGISTRY is the single source of truth for risk.
8
- * - resolveActionRisk(name) returns the registry `risk` when the action
9
- * exists in ACTION_REGISTRY (authoritative).
10
- * - Falls back to the suffix heuristic only for unknown (non-registry)
11
- * actions.
12
- * - Lookup is case-insensitive (input lowercased before Map lookup).
13
- */
14
- export {};
15
- //# sourceMappingURL=action-risk-registry-driven.spec.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"action-risk-registry-driven.spec.d.ts","sourceRoot":"","sources":["../../../src/registry/__tests__/action-risk-registry-driven.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}
@@ -1,17 +0,0 @@
1
- /**
2
- * Tests for resolveActionRisk (Cedar unification Step 1).
3
- *
4
- * Spec refs:
5
- * - docs/specs/2026-05-24-cedar-unification-design.md §7.2 (risk_level
6
- * resolution rule, Phase 1 baseline)
7
- *
8
- * Phase 1 baseline rule (registry-free, deterministic):
9
- * - HIGH_RISK_SUFFIXES → 'high'
10
- * - LOW_RISK_SUFFIXES → 'low'
11
- * - everything else → 'medium' (fail-safe default)
12
- *
13
- * Classification is based on the **last dotted segment** of the action
14
- * name (case-insensitive).
15
- */
16
- export {};
17
- //# sourceMappingURL=action-risk.spec.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"action-risk.spec.d.ts","sourceRoot":"","sources":["../../../src/registry/__tests__/action-risk.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}
@@ -1,2 +0,0 @@
1
- export {};
2
- //# sourceMappingURL=guidance-examples.spec.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"guidance-examples.spec.d.ts","sourceRoot":"","sources":["../../../src/registry/__tests__/guidance-examples.spec.ts"],"names":[],"mappings":""}
@@ -1,30 +0,0 @@
1
- /**
2
- * Registry invariant — every HIGH-risk action must have a RESOLVABLE
3
- * resource_id binding (#883 class-killer).
4
- *
5
- * Why this exists (2026-07-04): Gate-2 enforcement
6
- * (`ToolExecutorService.validateVCResourceConstraint`, strict for high risk
7
- * post-#886) fail-closes any high-risk invocation whose runtime resource
8
- * cannot be canonicalized (`RESOURCE_UNRESOLVED`) — and issuance pins VC
9
- * delegates through the SAME function (`canonicalResourceId`, INV-1). An
10
- * action that is high-risk but has no resolvable binding is therefore
11
- * IMPOSSIBLE to execute end-to-end: approval succeeds, the VC is pinned, and
12
- * the invoke still dies at Gate-2. That failure mode shipped at least twice
13
- * (#883 github write actions; g7.6/7.7/7.13 gmail.message.send unpinned
14
- * permit-path issuance). This spec turns the class into a test failure at the
15
- * moment the registry entry is added.
16
- *
17
- * Contract per high-risk action:
18
- * (a) `canonicalResourceId(action, <schema-faithful params>)` resolves to a
19
- * non-empty string — i.e. the binding exists AND its param(s) actually
20
- * exist in the action's input_schema (a binding pointing at a param the
21
- * schema doesn't carry can never resolve at runtime), OR
22
- * (b) the action is on the explicit allowlist below, each entry justified.
23
- *
24
- * Adding a high-risk action? Give it `target_bindings.resource_id` bound to a
25
- * param that exists in `input_schema.properties` (for CREATE actions: the
26
- * container/parent that exists pre-execution — see the registry header
27
- * comment), or consciously extend the allowlist with a justification.
28
- */
29
- export {};
30
- //# sourceMappingURL=high-risk-resource-binding-invariant.spec.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"high-risk-resource-binding-invariant.spec.d.ts","sourceRoot":"","sources":["../../../src/registry/__tests__/high-risk-resource-binding-invariant.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG"}
@@ -1,2 +0,0 @@
1
- export {};
2
- //# sourceMappingURL=reauth-constants.spec.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"reauth-constants.spec.d.ts","sourceRoot":"","sources":["../../../src/registry/__tests__/reauth-constants.spec.ts"],"names":[],"mappings":""}
@@ -1,8 +0,0 @@
1
- /**
2
- * Tests for Cedar policy types (Phase 1 Step 2).
3
- *
4
- * These are opaque wire types — runtime tests only verify the literal values
5
- * for CedarDecisionValue + shape acceptance for diagnostics.
6
- */
7
- export {};
8
- //# sourceMappingURL=cedar-policy.spec.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"cedar-policy.spec.d.ts","sourceRoot":"","sources":["../../../src/types/__tests__/cedar-policy.spec.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}
@@ -1,9 +0,0 @@
1
- /**
2
- * Tests for PermissionVcClaims V2/V3 union (Phase 1 Step 2).
3
- *
4
- * Spec refs:
5
- * - docs/specs/2026-05-23-cedar-rar-permission-redesign.md §3.1
6
- * - docs/specs/2026-05-23-cedar-rar-implementation-plan-phase1.md Task 2.1
7
- */
8
- export {};
9
- //# sourceMappingURL=permission-vc-v3.spec.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"permission-vc-v3.spec.d.ts","sourceRoot":"","sources":["../../../src/types/__tests__/permission-vc-v3.spec.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}
@@ -1,9 +0,0 @@
1
- /**
2
- * Tests for Phase 1 VC factory (buildPhase1VcClaims).
3
- *
4
- * Spec refs:
5
- * - docs/specs/2026-05-23-cedar-rar-implementation-plan-phase1.md Task 2.5 (rev 5)
6
- * - docs/specs/2026-05-23-cedar-rar-permission-redesign.md §3.1 Phase 1 layer 固定 note
7
- */
8
- export {};
9
- //# sourceMappingURL=phase1-vc-factory.spec.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"phase1-vc-factory.spec.d.ts","sourceRoot":"","sources":["../../../src/types/__tests__/phase1-vc-factory.spec.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}
@@ -1,9 +0,0 @@
1
- /**
2
- * Tests for PolicyRef discriminated union (Phase 1 Step 2).
3
- *
4
- * Spec refs:
5
- * - docs/specs/2026-05-23-cedar-rar-permission-redesign.md §3.2
6
- * - docs/specs/2026-05-23-cedar-rar-implementation-plan-phase1.md Task 2.1
7
- */
8
- export {};
9
- //# sourceMappingURL=policy-ref.spec.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"policy-ref.spec.d.ts","sourceRoot":"","sources":["../../../src/types/__tests__/policy-ref.spec.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}