@vess-id/ai-identity 0.19.0 → 0.21.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/agent/agent-did-manager.d.ts +48 -1
- package/dist/agent/agent-did-manager.d.ts.map +1 -1
- package/dist/client.d.ts +2 -2
- package/dist/client.d.ts.map +1 -1
- package/dist/config/index.d.ts +54 -0
- package/dist/config/index.d.ts.map +1 -1
- package/dist/did/agent.d.ts +7 -1
- package/dist/did/agent.d.ts.map +1 -1
- package/dist/identity/user-identity-manager.d.ts +55 -1
- package/dist/identity/user-identity-manager.d.ts.map +1 -1
- package/dist/index.d.mts +6583 -1822
- package/dist/index.d.ts +19 -13
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +10737 -2927
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +10720 -2917
- package/dist/index.mjs.map +1 -1
- package/dist/registry/action-registry-json.d.ts +5371 -1325
- package/dist/registry/action-registry-json.d.ts.map +1 -1
- package/dist/registry/action-registry.d.ts +13 -0
- package/dist/registry/action-registry.d.ts.map +1 -1
- package/dist/registry/action-risk.d.ts +64 -18
- package/dist/registry/action-risk.d.ts.map +1 -1
- package/dist/registry/action-summary.d.ts.map +1 -1
- package/dist/registry/index.d.ts +3 -3
- package/dist/registry/index.d.ts.map +1 -1
- package/dist/resolver/approval-time-resolution.d.ts +72 -0
- package/dist/resolver/approval-time-resolution.d.ts.map +1 -0
- package/dist/resolver/salient-digest.d.ts +48 -0
- package/dist/resolver/salient-digest.d.ts.map +1 -0
- package/dist/types/grant.d.ts +13 -2
- package/dist/types/grant.d.ts.map +1 -1
- package/dist/types/intent.d.ts +1 -1
- package/dist/types/intent.d.ts.map +1 -1
- package/dist/types/permission-mode.d.ts +1 -1
- package/dist/types/permission-mode.d.ts.map +1 -1
- package/dist/types/permission-vc.d.ts +81 -0
- package/dist/types/permission-vc.d.ts.map +1 -1
- package/dist/types/vc.d.ts +11 -1
- package/dist/types/vc.d.ts.map +1 -1
- package/dist/utils/sdjwt-client.d.ts +242 -5
- package/dist/utils/sdjwt-client.d.ts.map +1 -1
- package/dist/utils/sdjwt-disclosure.d.ts.map +1 -1
- package/dist/vc/api-vc-manager.d.ts +5 -0
- package/dist/vc/api-vc-manager.d.ts.map +1 -1
- package/dist/vc/vc-manager.d.ts.map +1 -1
- package/dist/vp/vp-manager.d.ts +35 -0
- package/dist/vp/vp-manager.d.ts.map +1 -1
- package/package.json +3 -3
- package/dist/constraint/__tests__/fixtures/constraint.fixtures.d.ts +0 -56
- package/dist/constraint/__tests__/fixtures/constraint.fixtures.d.ts.map +0 -1
- package/dist/internal-signature/__tests__/canonical.spec.d.ts +0 -2
- package/dist/internal-signature/__tests__/canonical.spec.d.ts.map +0 -1
- package/dist/internal-signature/__tests__/signer-roundtrip.spec.d.ts +0 -2
- package/dist/internal-signature/__tests__/signer-roundtrip.spec.d.ts.map +0 -1
- package/dist/internal-signature/__tests__/signer.spec.d.ts +0 -2
- package/dist/internal-signature/__tests__/signer.spec.d.ts.map +0 -1
- package/dist/monitoring/metrics-manager.d.ts +0 -74
- package/dist/monitoring/metrics-manager.d.ts.map +0 -1
- package/dist/policy/__tests__/cedar-engine.spec.d.ts +0 -17
- package/dist/policy/__tests__/cedar-engine.spec.d.ts.map +0 -1
- package/dist/policy/__tests__/cedar-entities.spec.d.ts +0 -14
- package/dist/policy/__tests__/cedar-entities.spec.d.ts.map +0 -1
- package/dist/policy/__tests__/decision-enum.spec.d.ts +0 -16
- package/dist/policy/__tests__/decision-enum.spec.d.ts.map +0 -1
- package/dist/registry/__tests__/action-input-validator.spec.d.ts +0 -10
- package/dist/registry/__tests__/action-input-validator.spec.d.ts.map +0 -1
- package/dist/registry/__tests__/action-registry-freebusy.spec.d.ts +0 -13
- package/dist/registry/__tests__/action-registry-freebusy.spec.d.ts.map +0 -1
- package/dist/registry/__tests__/action-registry-inbox.spec.d.ts +0 -9
- package/dist/registry/__tests__/action-registry-inbox.spec.d.ts.map +0 -1
- package/dist/registry/__tests__/action-registry-scheduling.spec.d.ts +0 -13
- package/dist/registry/__tests__/action-registry-scheduling.spec.d.ts.map +0 -1
- package/dist/registry/__tests__/action-registry-validation.spec.d.ts +0 -13
- package/dist/registry/__tests__/action-registry-validation.spec.d.ts.map +0 -1
- package/dist/registry/__tests__/action-risk-registry-driven.spec.d.ts +0 -15
- package/dist/registry/__tests__/action-risk-registry-driven.spec.d.ts.map +0 -1
- package/dist/registry/__tests__/action-risk.spec.d.ts +0 -17
- package/dist/registry/__tests__/action-risk.spec.d.ts.map +0 -1
- package/dist/registry/__tests__/guidance-examples.spec.d.ts +0 -2
- package/dist/registry/__tests__/guidance-examples.spec.d.ts.map +0 -1
- package/dist/registry/__tests__/high-risk-resource-binding-invariant.spec.d.ts +0 -30
- package/dist/registry/__tests__/high-risk-resource-binding-invariant.spec.d.ts.map +0 -1
- package/dist/registry/__tests__/reauth-constants.spec.d.ts +0 -2
- package/dist/registry/__tests__/reauth-constants.spec.d.ts.map +0 -1
- package/dist/types/__tests__/cedar-policy.spec.d.ts +0 -8
- package/dist/types/__tests__/cedar-policy.spec.d.ts.map +0 -1
- package/dist/types/__tests__/permission-vc-v3.spec.d.ts +0 -9
- package/dist/types/__tests__/permission-vc-v3.spec.d.ts.map +0 -1
- package/dist/types/__tests__/phase1-vc-factory.spec.d.ts +0 -9
- package/dist/types/__tests__/phase1-vc-factory.spec.d.ts.map +0 -1
- package/dist/types/__tests__/policy-ref.spec.d.ts +0 -9
- package/dist/types/__tests__/policy-ref.spec.d.ts.map +0 -1
|
@@ -1,56 +0,0 @@
|
|
|
1
|
-
import { GrantConstraints, TimeWindowConstraint, EvaluationContext } from '../../../types';
|
|
2
|
-
export declare const mockExecutorDid = "did:key:z6MkiY62766b1LJkExWMsM3QG4WtX23zJpRgVLwZBKQhyt6d";
|
|
3
|
-
/**
|
|
4
|
-
* Create mock time window constraint
|
|
5
|
-
*/
|
|
6
|
-
export declare const createMockTimeWindow: (overrides?: Partial<TimeWindowConstraint>) => TimeWindowConstraint;
|
|
7
|
-
/**
|
|
8
|
-
* Create mock constraints
|
|
9
|
-
*/
|
|
10
|
-
export declare const createMockConstraints: (overrides?: Partial<GrantConstraints>) => GrantConstraints;
|
|
11
|
-
/**
|
|
12
|
-
* Create mock evaluation context
|
|
13
|
-
*/
|
|
14
|
-
export declare const createMockContext: (overrides?: Partial<EvaluationContext>) => EvaluationContext;
|
|
15
|
-
/**
|
|
16
|
-
* Create constraints that should pass all checks
|
|
17
|
-
*/
|
|
18
|
-
export declare const createPassingConstraints: () => GrantConstraints;
|
|
19
|
-
/**
|
|
20
|
-
* Create constraints that should fail time window check
|
|
21
|
-
*/
|
|
22
|
-
export declare const createFailingTimeWindowConstraints: () => GrantConstraints;
|
|
23
|
-
/**
|
|
24
|
-
* Create constraints that should fail invocation limit
|
|
25
|
-
*/
|
|
26
|
-
export declare const createExhaustedConstraints: () => GrantConstraints;
|
|
27
|
-
/**
|
|
28
|
-
* Create constraints that should fail IP check
|
|
29
|
-
*/
|
|
30
|
-
export declare const createRestrictedIpConstraints: () => GrantConstraints;
|
|
31
|
-
/**
|
|
32
|
-
* Create overnight time window (e.g., 22:00-06:00)
|
|
33
|
-
*/
|
|
34
|
-
export declare const createOvernightTimeWindow: () => TimeWindowConstraint;
|
|
35
|
-
/**
|
|
36
|
-
* Test IPs for various scenarios
|
|
37
|
-
*/
|
|
38
|
-
export declare const testIps: {
|
|
39
|
-
inRange192: string;
|
|
40
|
-
inRange10: string;
|
|
41
|
-
outOfRange: string;
|
|
42
|
-
localhost: string;
|
|
43
|
-
ipv6Localhost: string;
|
|
44
|
-
ipv6Public: string;
|
|
45
|
-
};
|
|
46
|
-
/**
|
|
47
|
-
* Test timestamps for various scenarios
|
|
48
|
-
*/
|
|
49
|
-
export declare const createTestTimestamps: () => {
|
|
50
|
-
weekdayMorning: Date;
|
|
51
|
-
weekdayEvening: Date;
|
|
52
|
-
weekendMorning: Date;
|
|
53
|
-
midnight: Date;
|
|
54
|
-
now: Date;
|
|
55
|
-
};
|
|
56
|
-
//# sourceMappingURL=constraint.fixtures.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"constraint.fixtures.d.ts","sourceRoot":"","sources":["../../../../src/constraint/__tests__/fixtures/constraint.fixtures.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,EAClB,MAAM,gBAAgB,CAAA;AAGvB,eAAO,MAAM,eAAe,6DAA6D,CAAA;AAEzF;;GAEG;AACH,eAAO,MAAM,oBAAoB,GAAI,YAAW,OAAO,CAAC,oBAAoB,CAAM,KAAG,oBAMnF,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAAI,YAAW,OAAO,CAAC,gBAAgB,CAAM,KAAG,gBAOhF,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,iBAAiB,GAAI,YAAW,OAAO,CAAC,iBAAiB,CAAM,KAAG,iBAc7E,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,QAAO,gBAW1C,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,kCAAkC,QAAO,gBAOpD,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,QAAO,gBAE5C,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,6BAA6B,QAAO,gBAE/C,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,yBAAyB,QAAO,oBAK3C,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,OAAO;;;;;;;CAOnB,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;CAchC,CAAA"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"canonical.spec.d.ts","sourceRoot":"","sources":["../../../src/internal-signature/__tests__/canonical.spec.ts"],"names":[],"mappings":""}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"signer-roundtrip.spec.d.ts","sourceRoot":"","sources":["../../../src/internal-signature/__tests__/signer-roundtrip.spec.ts"],"names":[],"mappings":""}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"signer.spec.d.ts","sourceRoot":"","sources":["../../../src/internal-signature/__tests__/signer.spec.ts"],"names":[],"mappings":""}
|
|
@@ -1,74 +0,0 @@
|
|
|
1
|
-
export interface SDJWTMetrics {
|
|
2
|
-
issuanceCount: number;
|
|
3
|
-
verificationCount: number;
|
|
4
|
-
failedIssuances: number;
|
|
5
|
-
failedVerifications: number;
|
|
6
|
-
averageIssuanceTime: number;
|
|
7
|
-
averageVerificationTime: number;
|
|
8
|
-
cacheHitRate: number;
|
|
9
|
-
lastActivity: Date;
|
|
10
|
-
}
|
|
11
|
-
export interface OperationMetric {
|
|
12
|
-
operation: 'issue' | 'verify';
|
|
13
|
-
startTime: number;
|
|
14
|
-
endTime: number;
|
|
15
|
-
success: boolean;
|
|
16
|
-
error?: string;
|
|
17
|
-
issuerDid?: string;
|
|
18
|
-
credentialType?: string;
|
|
19
|
-
}
|
|
20
|
-
export declare class MetricsManager {
|
|
21
|
-
private metrics;
|
|
22
|
-
private operations;
|
|
23
|
-
private maxOperationHistory;
|
|
24
|
-
/**
|
|
25
|
-
* Start tracking an operation
|
|
26
|
-
*/
|
|
27
|
-
startOperation(operation: 'issue' | 'verify', metadata?: Record<string, any>): string;
|
|
28
|
-
/**
|
|
29
|
-
* End tracking an operation
|
|
30
|
-
*/
|
|
31
|
-
endOperation(_operationId: string, success: boolean, error?: string): void;
|
|
32
|
-
/**
|
|
33
|
-
* Update aggregated metrics
|
|
34
|
-
*/
|
|
35
|
-
private updateMetrics;
|
|
36
|
-
/**
|
|
37
|
-
* Get metrics for a specific issuer or global
|
|
38
|
-
*/
|
|
39
|
-
getMetrics(issuerDid?: string): SDJWTMetrics | null;
|
|
40
|
-
/**
|
|
41
|
-
* Get all metrics
|
|
42
|
-
*/
|
|
43
|
-
getAllMetrics(): Map<string, SDJWTMetrics>;
|
|
44
|
-
/**
|
|
45
|
-
* Get recent operations
|
|
46
|
-
*/
|
|
47
|
-
getRecentOperations(limit?: number): OperationMetric[];
|
|
48
|
-
/**
|
|
49
|
-
* Get operation statistics
|
|
50
|
-
*/
|
|
51
|
-
getOperationStats(): {
|
|
52
|
-
totalOperations: number;
|
|
53
|
-
successRate: number;
|
|
54
|
-
averageResponseTime: number;
|
|
55
|
-
operationsPerMinute: number;
|
|
56
|
-
};
|
|
57
|
-
/**
|
|
58
|
-
* Update cache hit rate
|
|
59
|
-
*/
|
|
60
|
-
updateCacheHitRate(issuerDid: string, hit: boolean): void;
|
|
61
|
-
/**
|
|
62
|
-
* Reset metrics
|
|
63
|
-
*/
|
|
64
|
-
resetMetrics(issuerDid?: string): void;
|
|
65
|
-
/**
|
|
66
|
-
* Export metrics as JSON
|
|
67
|
-
*/
|
|
68
|
-
exportMetrics(): {
|
|
69
|
-
aggregatedMetrics: Record<string, SDJWTMetrics>;
|
|
70
|
-
recentOperations: OperationMetric[];
|
|
71
|
-
summary: ReturnType<any>;
|
|
72
|
-
};
|
|
73
|
-
}
|
|
74
|
-
//# sourceMappingURL=metrics-manager.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"metrics-manager.d.ts","sourceRoot":"","sources":["../../src/monitoring/metrics-manager.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAA;IACrB,iBAAiB,EAAE,MAAM,CAAA;IACzB,eAAe,EAAE,MAAM,CAAA;IACvB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,mBAAmB,EAAE,MAAM,CAAA;IAC3B,uBAAuB,EAAE,MAAM,CAAA;IAC/B,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,IAAI,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,GAAG,QAAQ,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,OAAO,CAAuC;IACtD,OAAO,CAAC,UAAU,CAAwB;IAC1C,OAAO,CAAC,mBAAmB,CAAO;IAElC;;OAEG;IACH,cAAc,CAAC,SAAS,EAAE,OAAO,GAAG,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM;IAgBrF;;OAEG;IACH,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;IAmB1E;;OAEG;IACH,OAAO,CAAC,aAAa;IA2CrB;;OAEG;IACH,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAKnD;;OAEG;IACH,aAAa,IAAI,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC;IAI1C;;OAEG;IACH,mBAAmB,CAAC,KAAK,SAAM,GAAG,eAAe,EAAE;IAInD;;OAEG;IACH,iBAAiB,IAAI;QACnB,eAAe,EAAE,MAAM,CAAA;QACvB,WAAW,EAAE,MAAM,CAAA;QACnB,mBAAmB,EAAE,MAAM,CAAA;QAC3B,mBAAmB,EAAE,MAAM,CAAA;KAC5B;IAiBD;;OAEG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,IAAI;IA0BzD;;OAEG;IACH,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAStC;;OAEG;IACH,aAAa,IAAI;QACf,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;QAC/C,gBAAgB,EAAE,eAAe,EAAE,CAAA;QACnC,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAA;KACzB;CAOF"}
|
|
@@ -1,17 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* CedarEngine wrapper tests (Phase 1 Step 1, Task 1.2).
|
|
3
|
-
*
|
|
4
|
-
* Design ref: docs/specs/2026-05-23-cedar-rar-permission-redesign.md Appendix C
|
|
5
|
-
* Plan ref: docs/specs/2026-05-23-cedar-rar-implementation-plan-phase1.md §Step 1
|
|
6
|
-
*
|
|
7
|
-
* Scope of this spec:
|
|
8
|
-
* - load wasm + evaluate basic permit / forbid
|
|
9
|
-
* - default-deny when no policy matches
|
|
10
|
-
* - I-Cedar-4 regression: forbid alone without paired permit → Deny
|
|
11
|
-
* - structured errors (not throws) for malformed schema / policy
|
|
12
|
-
* - conditional permit driven by request context.approval.granted
|
|
13
|
-
* - C3 TOCTOU regression: concurrent loaders share the in-flight Promise
|
|
14
|
-
* - load failure clears cached promise so retry can succeed
|
|
15
|
-
*/
|
|
16
|
-
export {};
|
|
17
|
-
//# sourceMappingURL=cedar-engine.spec.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"cedar-engine.spec.d.ts","sourceRoot":"","sources":["../../../src/policy/__tests__/cedar-engine.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}
|
|
@@ -1,14 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Tests for buildCedarEntities (Cedar unification Step 1).
|
|
3
|
-
*
|
|
4
|
-
* Spec refs:
|
|
5
|
-
* - docs/specs/2026-05-24-cedar-unification-design.md §7.1 (Action entity attrs)
|
|
6
|
-
* - §7.2 (risk_level resolution rule, Phase 1 baseline)
|
|
7
|
-
*
|
|
8
|
-
* Phase 1 採用方針 (spec §7.1 rev 3 C1): entity attribute と context の
|
|
9
|
-
* 二重 bind を採用する。本 helper は **entity 側のみ** を組み立て、
|
|
10
|
-
* `context.action.risk_level` は CedarDecisionService 側で `buildCedarEvaluateRequest`
|
|
11
|
-
* が別途注入する。
|
|
12
|
-
*/
|
|
13
|
-
export {};
|
|
14
|
-
//# sourceMappingURL=cedar-entities.spec.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"cedar-entities.spec.d.ts","sourceRoot":"","sources":["../../../src/policy/__tests__/cedar-entities.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}
|
|
@@ -1,16 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Tests for the Decision 7-value enum (Cedar unification Step 1).
|
|
3
|
-
*
|
|
4
|
-
* Spec refs:
|
|
5
|
-
* - docs/specs/2026-05-24-cedar-unification-design.md §3 (Decision 7 値 enum)
|
|
6
|
-
* - §3.3 evaluation algorithm (fail-closed: indeterminate when errors[] > 0)
|
|
7
|
-
*
|
|
8
|
-
* Phase 1 Step 1 scope:
|
|
9
|
-
* - Decision type literal accepts the 7 A2A-aligned states
|
|
10
|
-
* - isDecision() runtime guard rejects unknown strings
|
|
11
|
-
*
|
|
12
|
-
* Note: Step 2 will wire the API layer (`CedarDecisionService`) to emit
|
|
13
|
-
* these values. This Step 1 only introduces the SDK-side enum.
|
|
14
|
-
*/
|
|
15
|
-
export {};
|
|
16
|
-
//# sourceMappingURL=decision-enum.spec.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"decision-enum.spec.d.ts","sourceRoot":"","sources":["../../../src/policy/__tests__/decision-enum.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}
|
|
@@ -1,10 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Tests for validateActionInput — lightweight registry-schema validation of
|
|
3
|
-
* tool-call parameters, run at the callTool entry point (before approval / VC
|
|
4
|
-
* gates) so malformed AI calls fail fast with self-correcting diagnostics
|
|
5
|
-
* instead of minting an approval request that later fails on invoke.
|
|
6
|
-
*
|
|
7
|
-
* Task 20: 承認リクエスト発行前のパラメータ形状検証.
|
|
8
|
-
*/
|
|
9
|
-
export {};
|
|
10
|
-
//# sourceMappingURL=action-input-validator.spec.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"action-input-validator.spec.d.ts","sourceRoot":"","sources":["../../../src/registry/__tests__/action-input-validator.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}
|
|
@@ -1,13 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Tests for the calendar.freebusy action in ACTION_REGISTRY.
|
|
3
|
-
*
|
|
4
|
-
* calendar.freebusy is a read-only availability probe used to check whether a
|
|
5
|
-
* calendar is busy over a time window before proposing meeting slots. It never
|
|
6
|
-
* returns event details (only busy/free intervals), so it stays in the
|
|
7
|
-
* low-risk `calendar.read.basic` capability alongside calendar.event.list /
|
|
8
|
-
* calendar.event.read.
|
|
9
|
-
*
|
|
10
|
-
* Spec: docs/specs/2026-07-03-scheduling-wow-phase1-design.md §4.1
|
|
11
|
-
*/
|
|
12
|
-
export {};
|
|
13
|
-
//# sourceMappingURL=action-registry-freebusy.spec.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"action-registry-freebusy.spec.d.ts","sourceRoot":"","sources":["../../../src/registry/__tests__/action-registry-freebusy.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}
|
|
@@ -1,9 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Tests for the Agent Inbox actions registered in ACTION_REGISTRY.
|
|
3
|
-
*
|
|
4
|
-
* The 5 inbox.* actions back the Agent Inbox MCP tools so they can be
|
|
5
|
-
* exposed and Cedar-evaluated. Risk levels are part of the security contract
|
|
6
|
-
* (inbox.send sends a task request to another person → high).
|
|
7
|
-
*/
|
|
8
|
-
export {};
|
|
9
|
-
//# sourceMappingURL=action-registry-inbox.spec.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"action-registry-inbox.spec.d.ts","sourceRoot":"","sources":["../../../src/registry/__tests__/action-registry-inbox.spec.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}
|
|
@@ -1,13 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Tests for the scheduling.request façade action in ACTION_REGISTRY.
|
|
3
|
-
*
|
|
4
|
-
* scheduling.request is a meeting-time negotiation façade over inbox.send.
|
|
5
|
-
* Candidate slots are computed LLM-side; the server only validates. The
|
|
6
|
-
* action is internal (no external OAuth), so it carries the single nominal
|
|
7
|
-
* base scope `inbox`. Its tool name is auto-derived from the first action
|
|
8
|
-
* segment ('scheduling').
|
|
9
|
-
*
|
|
10
|
-
* Spec: docs/specs/2026-06-10-inbox-intent-routing-design.md §2.1
|
|
11
|
-
*/
|
|
12
|
-
export {};
|
|
13
|
-
//# sourceMappingURL=action-registry-scheduling.spec.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"action-registry-scheduling.spec.d.ts","sourceRoot":"","sources":["../../../src/registry/__tests__/action-registry-scheduling.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}
|
|
@@ -1,13 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Tests for actionMetaSchema validation — `risk` is a REQUIRED field.
|
|
3
|
-
*
|
|
4
|
-
* Spec ref:
|
|
5
|
-
* - docs/specs/2026-05-27-action-risk-registry-driven.md §4.1
|
|
6
|
-
*
|
|
7
|
-
* Rationale: risk resolution is now registry-driven (RT1). An action added
|
|
8
|
-
* without a `risk` field would silently fall back to the suffix heuristic in
|
|
9
|
-
* Cedar (e.g. `os.secret.read` → low → auto-permit), a security regression.
|
|
10
|
-
* Making `risk` schema-required turns that omission into a CI failure.
|
|
11
|
-
*/
|
|
12
|
-
export {};
|
|
13
|
-
//# sourceMappingURL=action-registry-validation.spec.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"action-registry-validation.spec.d.ts","sourceRoot":"","sources":["../../../src/registry/__tests__/action-registry-validation.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}
|
|
@@ -1,15 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Tests for registry-driven resolveActionRisk (OpenQ-5 root fix).
|
|
3
|
-
*
|
|
4
|
-
* Spec ref:
|
|
5
|
-
* - docs/specs/2026-05-27-action-risk-registry-driven.md §3, §4.2
|
|
6
|
-
*
|
|
7
|
-
* Contract: ACTION_REGISTRY is the single source of truth for risk.
|
|
8
|
-
* - resolveActionRisk(name) returns the registry `risk` when the action
|
|
9
|
-
* exists in ACTION_REGISTRY (authoritative).
|
|
10
|
-
* - Falls back to the suffix heuristic only for unknown (non-registry)
|
|
11
|
-
* actions.
|
|
12
|
-
* - Lookup is case-insensitive (input lowercased before Map lookup).
|
|
13
|
-
*/
|
|
14
|
-
export {};
|
|
15
|
-
//# sourceMappingURL=action-risk-registry-driven.spec.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"action-risk-registry-driven.spec.d.ts","sourceRoot":"","sources":["../../../src/registry/__tests__/action-risk-registry-driven.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}
|
|
@@ -1,17 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Tests for resolveActionRisk (Cedar unification Step 1).
|
|
3
|
-
*
|
|
4
|
-
* Spec refs:
|
|
5
|
-
* - docs/specs/2026-05-24-cedar-unification-design.md §7.2 (risk_level
|
|
6
|
-
* resolution rule, Phase 1 baseline)
|
|
7
|
-
*
|
|
8
|
-
* Phase 1 baseline rule (registry-free, deterministic):
|
|
9
|
-
* - HIGH_RISK_SUFFIXES → 'high'
|
|
10
|
-
* - LOW_RISK_SUFFIXES → 'low'
|
|
11
|
-
* - everything else → 'medium' (fail-safe default)
|
|
12
|
-
*
|
|
13
|
-
* Classification is based on the **last dotted segment** of the action
|
|
14
|
-
* name (case-insensitive).
|
|
15
|
-
*/
|
|
16
|
-
export {};
|
|
17
|
-
//# sourceMappingURL=action-risk.spec.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"action-risk.spec.d.ts","sourceRoot":"","sources":["../../../src/registry/__tests__/action-risk.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"guidance-examples.spec.d.ts","sourceRoot":"","sources":["../../../src/registry/__tests__/guidance-examples.spec.ts"],"names":[],"mappings":""}
|
|
@@ -1,30 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Registry invariant — every HIGH-risk action must have a RESOLVABLE
|
|
3
|
-
* resource_id binding (#883 class-killer).
|
|
4
|
-
*
|
|
5
|
-
* Why this exists (2026-07-04): Gate-2 enforcement
|
|
6
|
-
* (`ToolExecutorService.validateVCResourceConstraint`, strict for high risk
|
|
7
|
-
* post-#886) fail-closes any high-risk invocation whose runtime resource
|
|
8
|
-
* cannot be canonicalized (`RESOURCE_UNRESOLVED`) — and issuance pins VC
|
|
9
|
-
* delegates through the SAME function (`canonicalResourceId`, INV-1). An
|
|
10
|
-
* action that is high-risk but has no resolvable binding is therefore
|
|
11
|
-
* IMPOSSIBLE to execute end-to-end: approval succeeds, the VC is pinned, and
|
|
12
|
-
* the invoke still dies at Gate-2. That failure mode shipped at least twice
|
|
13
|
-
* (#883 github write actions; g7.6/7.7/7.13 gmail.message.send unpinned
|
|
14
|
-
* permit-path issuance). This spec turns the class into a test failure at the
|
|
15
|
-
* moment the registry entry is added.
|
|
16
|
-
*
|
|
17
|
-
* Contract per high-risk action:
|
|
18
|
-
* (a) `canonicalResourceId(action, <schema-faithful params>)` resolves to a
|
|
19
|
-
* non-empty string — i.e. the binding exists AND its param(s) actually
|
|
20
|
-
* exist in the action's input_schema (a binding pointing at a param the
|
|
21
|
-
* schema doesn't carry can never resolve at runtime), OR
|
|
22
|
-
* (b) the action is on the explicit allowlist below, each entry justified.
|
|
23
|
-
*
|
|
24
|
-
* Adding a high-risk action? Give it `target_bindings.resource_id` bound to a
|
|
25
|
-
* param that exists in `input_schema.properties` (for CREATE actions: the
|
|
26
|
-
* container/parent that exists pre-execution — see the registry header
|
|
27
|
-
* comment), or consciously extend the allowlist with a justification.
|
|
28
|
-
*/
|
|
29
|
-
export {};
|
|
30
|
-
//# sourceMappingURL=high-risk-resource-binding-invariant.spec.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"high-risk-resource-binding-invariant.spec.d.ts","sourceRoot":"","sources":["../../../src/registry/__tests__/high-risk-resource-binding-invariant.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"reauth-constants.spec.d.ts","sourceRoot":"","sources":["../../../src/registry/__tests__/reauth-constants.spec.ts"],"names":[],"mappings":""}
|
|
@@ -1,8 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Tests for Cedar policy types (Phase 1 Step 2).
|
|
3
|
-
*
|
|
4
|
-
* These are opaque wire types — runtime tests only verify the literal values
|
|
5
|
-
* for CedarDecisionValue + shape acceptance for diagnostics.
|
|
6
|
-
*/
|
|
7
|
-
export {};
|
|
8
|
-
//# sourceMappingURL=cedar-policy.spec.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"cedar-policy.spec.d.ts","sourceRoot":"","sources":["../../../src/types/__tests__/cedar-policy.spec.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}
|
|
@@ -1,9 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Tests for PermissionVcClaims V2/V3 union (Phase 1 Step 2).
|
|
3
|
-
*
|
|
4
|
-
* Spec refs:
|
|
5
|
-
* - docs/specs/2026-05-23-cedar-rar-permission-redesign.md §3.1
|
|
6
|
-
* - docs/specs/2026-05-23-cedar-rar-implementation-plan-phase1.md Task 2.1
|
|
7
|
-
*/
|
|
8
|
-
export {};
|
|
9
|
-
//# sourceMappingURL=permission-vc-v3.spec.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"permission-vc-v3.spec.d.ts","sourceRoot":"","sources":["../../../src/types/__tests__/permission-vc-v3.spec.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}
|
|
@@ -1,9 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Tests for Phase 1 VC factory (buildPhase1VcClaims).
|
|
3
|
-
*
|
|
4
|
-
* Spec refs:
|
|
5
|
-
* - docs/specs/2026-05-23-cedar-rar-implementation-plan-phase1.md Task 2.5 (rev 5)
|
|
6
|
-
* - docs/specs/2026-05-23-cedar-rar-permission-redesign.md §3.1 Phase 1 layer 固定 note
|
|
7
|
-
*/
|
|
8
|
-
export {};
|
|
9
|
-
//# sourceMappingURL=phase1-vc-factory.spec.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"phase1-vc-factory.spec.d.ts","sourceRoot":"","sources":["../../../src/types/__tests__/phase1-vc-factory.spec.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}
|
|
@@ -1,9 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Tests for PolicyRef discriminated union (Phase 1 Step 2).
|
|
3
|
-
*
|
|
4
|
-
* Spec refs:
|
|
5
|
-
* - docs/specs/2026-05-23-cedar-rar-permission-redesign.md §3.2
|
|
6
|
-
* - docs/specs/2026-05-23-cedar-rar-implementation-plan-phase1.md Task 2.1
|
|
7
|
-
*/
|
|
8
|
-
export {};
|
|
9
|
-
//# sourceMappingURL=policy-ref.spec.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"policy-ref.spec.d.ts","sourceRoot":"","sources":["../../../src/types/__tests__/policy-ref.spec.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}
|