@vess-id/ai-identity 0.21.0 → 0.22.0

package/dist/index.js

@@ -140,6 +140,7 @@ __export(index_exports, {
   getKeyIdFromDid: () => getKeyIdFromDid,
   getRequiredRelations: () => getRequiredRelations,
   getRequiredScopes: () => getRequiredScopes,
+  getRequiredScopesForProvider: () => getRequiredScopesForProvider,
   getTierLimits: () => getTierLimits,
   getValidMcpActionNames: () => getValidMcpActionNames,
   grantConstraintsToPermissionConstraints: () => grantConstraintsToPermissionConstraints,
@@ -4877,6 +4878,19 @@ var actionMetaSchema = {
         minLength: 1
       }
     },
+    // OAuth provider 名 → その provider でのスコープ集合。
+    required_scopes_by_provider: {
+      type: "object",
+      minProperties: 1,
+      additionalProperties: {
+        type: "array",
+        minItems: 1,
+        items: {
+          type: "string",
+          minLength: 1
+        }
+      }
+    },
     capability: {
       type: "string"
     },
@@ -5108,6 +5122,15 @@ function getRequiredScopes(regIndex, action) {
   return regIndex.get(action)?.required_scopes ?? [];
 }
 __name(getRequiredScopes, "getRequiredScopes");
+function getRequiredScopesForProvider(regIndex, action, provider) {
+  const meta = regIndex.get(action);
+  if (!meta) return [];
+  const map = meta.required_scopes_by_provider;
+  const key = provider?.toLowerCase();
+  const byProvider = map && key && Object.prototype.hasOwnProperty.call(map, key) ? map[key] : void 0;
+  return Array.isArray(byProvider) ? byProvider : meta.required_scopes ?? [];
+}
+__name(getRequiredScopesForProvider, "getRequiredScopesForProvider");
 function getRequiredRelations(regIndex, action) {
   return regIndex.get(action)?.required_relations ?? [];
 }
@@ -10043,6 +10066,434 @@ var ACTION_REGISTRY = {
       ],
       version: "1.0.0"
     },
+    // ─── 🔴 #1209 Outlook Mail Actions (Graph; peer of the Gmail block) ───
+    // provider = microsoft; scopes = Mail.ReadWrite (read/draft) + Mail.Send
+    // (send). Shapes mirror the Gmail entries above so the policy / approval /
+    // target-binding engine treats Outlook mail identically.
+    {
+      action: "outlook.message.search",
+      resource_type: "outlook:message",
+      required_relations: [
+        "viewer",
+        "editor",
+        "admin",
+        "owner"
+      ],
+      required_scopes: [
+        "Mail.ReadWrite"
+      ],
+      capability: "outlook.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          query: {
+            type: "string",
+            minLength: 1
+          },
+          maxResults: {
+            type: "integer",
+            minimum: 1,
+            maximum: 50
+          }
+        },
+        required: [
+          "query"
+        ],
+        additionalProperties: false
+      },
+      constraints: {
+        rate_bucket: "outlook.read"
+      },
+      effects: [
+        "Read:MessageList"
+      ],
+      risk: "low",
+      target_bindings: {
+        resource_id: {
+          source: "param",
+          param: "query",
+          required: false
+        }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "outlook.message.read",
+      resource_type: "outlook:message",
+      required_relations: [
+        "viewer",
+        "editor",
+        "admin",
+        "owner"
+      ],
+      required_scopes: [
+        "Mail.ReadWrite"
+      ],
+      capability: "outlook.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          messageId: {
+            type: "string",
+            minLength: 1
+          }
+        },
+        required: [
+          "messageId"
+        ],
+        additionalProperties: false
+      },
+      constraints: {
+        rate_bucket: "outlook.read"
+      },
+      effects: [
+        "Read:Message"
+      ],
+      risk: "low",
+      target_bindings: {
+        resource_id: {
+          source: "param",
+          param: "messageId"
+        }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "outlook.message.send",
+      resource_type: "outlook:message",
+      required_relations: [
+        "editor",
+        "act_as"
+      ],
+      required_scopes: [
+        "Mail.Send"
+      ],
+      capability: "outlook.compose",
+      input_schema: {
+        type: "object",
+        properties: {
+          to: {
+            type: "string",
+            minLength: 1
+          },
+          subject: {
+            type: "string",
+            minLength: 1
+          },
+          body: {
+            type: "string",
+            minLength: 1
+          },
+          cc: {
+            type: "string"
+          },
+          bcc: {
+            type: "string"
+          }
+        },
+        required: [
+          "to",
+          "subject",
+          "body"
+        ],
+        additionalProperties: false
+      },
+      constraints: {
+        rate_bucket: "outlook.write"
+      },
+      effects: [
+        "Create:Email"
+      ],
+      risk: "high",
+      target_bindings: {
+        resource_id: {
+          source: "param",
+          param: "to",
+          multi: true,
+          separator: ","
+        },
+        secondary: [
+          {
+            name: "cc",
+            source: {
+              source: "param",
+              param: "cc"
+            },
+            type: "recipient"
+          },
+          {
+            name: "bcc",
+            source: {
+              source: "param",
+              param: "bcc"
+            },
+            type: "recipient"
+          }
+        ]
+      },
+      approval_salient_fields: [
+        "to",
+        "cc",
+        "bcc",
+        "subject",
+        "body"
+      ],
+      version: "1.0.0"
+    },
+    {
+      action: "outlook.draft.create",
+      resource_type: "outlook:message",
+      required_relations: [
+        "editor",
+        "act_as"
+      ],
+      required_scopes: [
+        "Mail.ReadWrite"
+      ],
+      capability: "outlook.compose",
+      input_schema: {
+        type: "object",
+        properties: {
+          to: {
+            type: "string",
+            minLength: 1
+          },
+          subject: {
+            type: "string",
+            minLength: 1
+          },
+          body: {
+            type: "string",
+            minLength: 1
+          },
+          cc: {
+            type: "string"
+          },
+          bcc: {
+            type: "string"
+          }
+        },
+        required: [
+          "to",
+          "subject",
+          "body"
+        ],
+        additionalProperties: false
+      },
+      constraints: {
+        rate_bucket: "outlook.write"
+      },
+      effects: [
+        "Create:Draft"
+      ],
+      risk: "high",
+      target_bindings: {
+        resource_id: {
+          source: "param",
+          param: "to",
+          multi: true,
+          separator: ","
+        },
+        secondary: [
+          {
+            name: "cc",
+            source: {
+              source: "param",
+              param: "cc"
+            },
+            type: "recipient"
+          },
+          {
+            name: "bcc",
+            source: {
+              source: "param",
+              param: "bcc"
+            },
+            type: "recipient"
+          }
+        ]
+      },
+      approval_salient_fields: [
+        "to",
+        "cc",
+        "bcc",
+        "subject",
+        "body"
+      ],
+      version: "1.0.0"
+    },
+    {
+      action: "outlook.folder.read",
+      resource_type: "outlook:folder",
+      required_relations: [
+        "viewer",
+        "editor",
+        "admin",
+        "owner"
+      ],
+      required_scopes: [
+        "Mail.ReadWrite"
+      ],
+      capability: "outlook.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          // Optional scope: a specific folder id, else the full folder list.
+          // Declared so the target_binding below references a real param.
+          folderId: {
+            type: "string"
+          }
+        },
+        additionalProperties: false
+      },
+      constraints: {
+        rate_bucket: "outlook.read"
+      },
+      effects: [
+        "Read:FolderList"
+      ],
+      risk: "low",
+      target_bindings: {
+        resource_id: {
+          source: "param",
+          param: "folderId",
+          required: false
+        }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "outlook.batch.read",
+      resource_type: "outlook:message",
+      required_relations: [
+        "viewer",
+        "editor",
+        "admin",
+        "owner"
+      ],
+      required_scopes: [
+        "Mail.ReadWrite"
+      ],
+      capability: "outlook.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          messageIds: {
+            type: "array",
+            items: {
+              type: "string",
+              minLength: 1
+            },
+            minItems: 1,
+            maxItems: 20
+          }
+        },
+        required: [
+          "messageIds"
+        ],
+        additionalProperties: false
+      },
+      constraints: {
+        rate_bucket: "outlook.read"
+      },
+      effects: [
+        "Read:MessageBatch"
+      ],
+      risk: "low",
+      target_bindings: {
+        resource_id: {
+          source: "param",
+          param: "messageIds",
+          required: false
+        }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "outlook.message.trash",
+      resource_type: "outlook:message",
+      required_relations: [
+        "editor",
+        "act_as"
+      ],
+      required_scopes: [
+        "Mail.ReadWrite"
+      ],
+      capability: "outlook.manage",
+      input_schema: {
+        type: "object",
+        properties: {
+          messageId: {
+            type: "string",
+            minLength: 1
+          }
+        },
+        required: [
+          "messageId"
+        ],
+        additionalProperties: false
+      },
+      constraints: {
+        rate_bucket: "outlook.write"
+      },
+      effects: [
+        "Update:Message"
+      ],
+      risk: "high",
+      target_bindings: {
+        resource_id: {
+          source: "param",
+          param: "messageId"
+        }
+      },
+      approval_salient_fields: [
+        "messageId"
+      ],
+      version: "1.0.0"
+    },
+    {
+      action: "outlook.message.delete",
+      resource_type: "outlook:message",
+      required_relations: [
+        "admin",
+        "owner",
+        "act_as"
+      ],
+      required_scopes: [
+        "Mail.ReadWrite"
+      ],
+      capability: "outlook.manage",
+      input_schema: {
+        type: "object",
+        properties: {
+          messageId: {
+            type: "string",
+            minLength: 1
+          }
+        },
+        required: [
+          "messageId"
+        ],
+        additionalProperties: false
+      },
+      constraints: {
+        rate_bucket: "outlook.write"
+      },
+      effects: [
+        "Delete:Message"
+      ],
+      risk: "high",
+      target_bindings: {
+        resource_id: {
+          source: "param",
+          param: "messageId"
+        }
+      },
+      approval_salient_fields: [
+        "messageId"
+      ],
+      version: "1.0.0"
+    },
     // ─── Calendar Actions ───
     {
       action: "calendar.event.list",
@@ -10056,6 +10507,16 @@ var ACTION_REGISTRY = {
       required_scopes: [
         "https://www.googleapis.com/auth/calendar.readonly"
       ],
+      // Microsoft 接続で同じ action を実行するときのスコープ。Calendars.Read は
+      // Calendars.ReadWrite に含意されるため、write 権限だけを付与された接続でも満たされる。
+      required_scopes_by_provider: {
+        google: [
+          "https://www.googleapis.com/auth/calendar.readonly"
+        ],
+        microsoft: [
+          "Calendars.Read"
+        ]
+      },
       capability: "calendar.read.basic",
       input_schema: {
         type: "object",
@@ -10110,6 +10571,16 @@ var ACTION_REGISTRY = {
       required_scopes: [
         "https://www.googleapis.com/auth/calendar.readonly"
       ],
+      // Microsoft 接続で同じ action を実行するときのスコープ。Calendars.Read は
+      // Calendars.ReadWrite に含意されるため、write 権限だけを付与された接続でも満たされる。
+      required_scopes_by_provider: {
+        google: [
+          "https://www.googleapis.com/auth/calendar.readonly"
+        ],
+        microsoft: [
+          "Calendars.Read"
+        ]
+      },
       capability: "calendar.read.basic",
       input_schema: {
         type: "object",
@@ -10154,6 +10625,16 @@ var ACTION_REGISTRY = {
       required_scopes: [
         "https://www.googleapis.com/auth/calendar.readonly"
       ],
+      // Microsoft 接続で同じ action を実行するときのスコープ。Calendars.Read は
+      // Calendars.ReadWrite に含意されるため、write 権限だけを付与された接続でも満たされる。
+      required_scopes_by_provider: {
+        google: [
+          "https://www.googleapis.com/auth/calendar.readonly"
+        ],
+        microsoft: [
+          "Calendars.Read"
+        ]
+      },
       capability: "calendar.read.basic",
       // Availability probe used to check a calendar's busy/free intervals before
       // proposing meeting slots. Returns only busy time ranges — never event
@@ -10207,6 +10688,14 @@ var ACTION_REGISTRY = {
       required_scopes: [
         "https://www.googleapis.com/auth/calendar"
       ],
+      required_scopes_by_provider: {
+        google: [
+          "https://www.googleapis.com/auth/calendar"
+        ],
+        microsoft: [
+          "Calendars.ReadWrite"
+        ]
+      },
       capability: "calendar.write",
       input_schema: {
         type: "object",
@@ -10278,11 +10767,11 @@ var ACTION_REGISTRY = {
           },
           addMeet: {
             type: "boolean",
-            description: "Opt-in: attach a Google Meet link (default: false)"
+            description: "Opt-in: attach an online-meeting link (default: false). Google Meet on a Google connection, Microsoft Teams on an Outlook one \u2014 the join URL comes back as conferenceUrl either way."
           },
           meetRequestId: {
             type: "string",
-            description: "Stable idempotency key for the Meet request (used only when addMeet is true)"
+            description: "Stable idempotency key for the online-meeting request (used only when addMeet is true)"
           }
         },
         required: [
@@ -10340,6 +10829,14 @@ var ACTION_REGISTRY = {
       required_scopes: [
         "https://www.googleapis.com/auth/calendar"
       ],
+      required_scopes_by_provider: {
+        google: [
+          "https://www.googleapis.com/auth/calendar"
+        ],
+        microsoft: [
+          "Calendars.ReadWrite"
+        ]
+      },
       capability: "calendar.write",
       input_schema: {
         type: "object",
@@ -10415,11 +10912,11 @@ var ACTION_REGISTRY = {
           },
           addMeet: {
             type: "boolean",
-            description: "Opt-in: attach a Google Meet link (default: false)"
+            description: "Opt-in: attach an online-meeting link (default: false). Google Meet on a Google connection, Microsoft Teams on an Outlook one \u2014 the join URL comes back as conferenceUrl either way."
           },
           meetRequestId: {
             type: "string",
-            description: "Stable idempotency key for the Meet request (used only when addMeet is true)"
+            description: "Stable idempotency key for the online-meeting request (used only when addMeet is true)"
           }
         },
         required: [
@@ -10477,6 +10974,14 @@ var ACTION_REGISTRY = {
       required_scopes: [
         "https://www.googleapis.com/auth/calendar"
       ],
+      required_scopes_by_provider: {
+        google: [
+          "https://www.googleapis.com/auth/calendar"
+        ],
+        microsoft: [
+          "Calendars.ReadWrite"
+        ]
+      },
       capability: "calendar.write",
       input_schema: {
         type: "object",
@@ -15068,7 +15573,7 @@ var ACTION_REGISTRY = {
             type: "array",
             minItems: 1,
             maxItems: 10,
-            description: "Explicit candidate slots computed by the agent from the user calendar. The server validates them AND (when Google Calendar is connected) filters out any that conflict with the sender's calendar. Mutually exclusive with candidateWindow \u2014 supply exactly one.",
+            description: "Explicit candidate slots computed by the agent from the user calendar. The server validates them AND (when a calendar is connected) filters out any that conflict with the sender's calendar. Mutually exclusive with candidateWindow \u2014 supply exactly one.",
             items: {
               type: "object",
               properties: {
@@ -15105,7 +15610,7 @@ var ACTION_REGISTRY = {
               "object",
               "array"
             ],
-            description: 'A search window OR an ARRAY of search windows the server fills with busy-free candidate slots from the sender\'s Google Calendar. Each range is `{ start, end }` (ISO 8601) \u2014 an independent contiguous interval the server searches within, spreading candidates across ranges. "\u5E73\u65E5\u5348\u5F8C" = one range per business day (Mon 13-18 / Tue 13-18 / \u2026); "\u6708\u66DC\u5348\u524D or \u6728\u66DC\u5348\u5F8C" = two ranges. A single contiguous span = one range. Max 5 ranges, total span \u2264 62 days. Mutually exclusive with candidates \u2014 supply exactly one. Requires a connected Google Calendar.',
+            description: 'A search window OR an ARRAY of search windows the server fills with busy-free candidate slots from the sender\'s connected calendar(s) (Google Calendar or Microsoft Outlook; busy time is the union of all of them). Each range is `{ start, end }` (ISO 8601) \u2014 an independent contiguous interval the server searches within, spreading candidates across ranges. "\u5E73\u65E5\u5348\u5F8C" = one range per business day (Mon 13-18 / Tue 13-18 / \u2026); "\u6708\u66DC\u5348\u524D or \u6728\u66DC\u5348\u5F8C" = two ranges. A single contiguous span = one range. Max 5 ranges, total span \u2264 62 days. Mutually exclusive with candidates \u2014 supply exactly one. Requires at least one connected calendar.',
             properties: {
               start: {
                 type: "string",
@@ -15989,9 +16494,39 @@ var ACTION_REGISTRY = {
       ],
       version: "1.0.0"
     },
+    // 🔴 #1209 Outlook mail capabilities (peer of the three Gmail ones above).
+    {
+      capability: "outlook.read.basic",
+      description: "Read and search Outlook mail messages and folders",
+      includes: [
+        "outlook.message.search",
+        "outlook.message.read",
+        "outlook.folder.read",
+        "outlook.batch.read"
+      ],
+      version: "1.0.0"
+    },
+    {
+      capability: "outlook.compose",
+      description: "Send emails and create drafts via Outlook",
+      includes: [
+        "outlook.message.send",
+        "outlook.draft.create"
+      ],
+      version: "1.0.0"
+    },
+    {
+      capability: "outlook.manage",
+      description: "Trash and permanently delete Outlook messages",
+      includes: [
+        "outlook.message.trash",
+        "outlook.message.delete"
+      ],
+      version: "1.0.0"
+    },
     {
       capability: "calendar.read.basic",
-      description: "Read and list Google Calendar events, and check free/busy availability",
+      description: "Read and list calendar events (Google Calendar or Microsoft Outlook), and check free/busy availability",
       includes: [
         "calendar.event.list",
         "calendar.event.read",
@@ -16001,7 +16536,7 @@ var ACTION_REGISTRY = {
     },
     {
       capability: "calendar.write",
-      description: "Create, update, and delete Google Calendar events",
+      description: "Create, update, and delete calendar events (Google Calendar or Microsoft Outlook)",
       includes: [
         "calendar.event.create",
         "calendar.event.update",
@@ -18951,6 +19486,7 @@ __name(isDecision, "isDecision");
   getKeyIdFromDid,
   getRequiredRelations,
   getRequiredScopes,
+  getRequiredScopesForProvider,
   getTierLimits,
   getValidMcpActionNames,
   grantConstraintsToPermissionConstraints,