@vess-id/ai-identity 0.3.0 → 0.3.1

package/dist/memory/memory-manager.d.ts

@@ -0,0 +1,71 @@
+import { VPManager } from '../vp/vp-manager';
+export interface MemoryDocument {
+    id: string;
+    namespace: string;
+    content: string;
+    metadata?: Record<string, any>;
+    embedding?: number[];
+    createdAt: string;
+    updatedAt: string;
+}
+export interface MemoryQuery {
+    query: string;
+    namespace?: string;
+    limit?: number;
+    filter?: Record<string, any>;
+    includeEmbedding?: boolean;
+}
+export interface MemoryQueryResult {
+    documents: MemoryDocument[];
+    scores?: number[];
+    total: number;
+}
+export declare class MemoryManager {
+    private vpManager;
+    private proxyApiUrl;
+    constructor(vpManager?: VPManager);
+    /**
+     * Write a document to memory
+     */
+    write(content: string, options: {
+        namespace: string;
+        metadata?: Record<string, any>;
+        vcs: string[];
+        holderDid: string;
+    }): Promise<MemoryDocument>;
+    /**
+     * Query memory with vector search
+     */
+    query(query: string, options: {
+        namespace?: string;
+        limit?: number;
+        filter?: Record<string, any>;
+        vcs: string[];
+        holderDid: string;
+    }): Promise<MemoryQueryResult>;
+    /**
+     * Delete a document from memory
+     */
+    delete(documentId: string, options: {
+        namespace: string;
+        vcs: string[];
+        holderDid: string;
+    }): Promise<void>;
+    /**
+     * List documents in a namespace
+     */
+    list(options: {
+        namespace: string;
+        limit?: number;
+        offset?: number;
+        vcs: string[];
+        holderDid: string;
+    }): Promise<MemoryQueryResult>;
+    /**
+     * Check if VCs authorize memory access
+     */
+    checkAuthorization(vcs: string[], action: 'read' | 'write' | 'delete', resource: string): Promise<boolean>;
+    private matchResource;
+    private generateChallenge;
+}
+//# sourceMappingURL=memory-manager.d.ts.map

package/dist/memory/memory-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-manager.d.ts","sourceRoot":"","sources":["../../src/memory/memory-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAG5C,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,cAAc,EAAE,CAAA;IAC3B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,SAAS,CAAW;IAC5B,OAAO,CAAC,WAAW,CAAQ;gBAEf,SAAS,CAAC,EAAE,SAAS;IAMjC;;OAEG;IACG,KAAK,CACT,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC9B,GAAG,EAAE,MAAM,EAAE,CAAA;QACb,SAAS,EAAE,MAAM,CAAA;KAClB,GACA,OAAO,CAAC,cAAc,CAAC;IAkC1B;;OAEG;IACG,KAAK,CACT,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;QACP,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC5B,GAAG,EAAE,MAAM,EAAE,CAAA;QACb,SAAS,EAAE,MAAM,CAAA;KAClB,GACA,OAAO,CAAC,iBAAiB,CAAC;IA0C7B;;OAEG;IACG,MAAM,CACV,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAA;QACjB,GAAG,EAAE,MAAM,EAAE,CAAA;QACb,SAAS,EAAE,MAAM,CAAA;KAClB,GACA,OAAO,CAAC,IAAI,CAAC;IA8BhB;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE;QAClB,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,GAAG,EAAE,MAAM,EAAE,CAAA;QACb,SAAS,EAAE,MAAM,CAAA;KAClB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAoC9B;;OAEG;IACG,kBAAkB,CACtB,GAAG,EAAE,MAAM,EAAE,EACb,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,EACnC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC;IAwBnB,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,iBAAiB;CAG1B"}

package/dist/monitoring/metrics-manager.d.ts

@@ -0,0 +1,74 @@
+export interface SDJWTMetrics {
+    issuanceCount: number;
+    verificationCount: number;
+    failedIssuances: number;
+    failedVerifications: number;
+    averageIssuanceTime: number;
+    averageVerificationTime: number;
+    cacheHitRate: number;
+    lastActivity: Date;
+}
+export interface OperationMetric {
+    operation: 'issue' | 'verify';
+    startTime: number;
+    endTime: number;
+    success: boolean;
+    error?: string;
+    issuerDid?: string;
+    credentialType?: string;
+}
+export declare class MetricsManager {
+    private metrics;
+    private operations;
+    private maxOperationHistory;
+    /**
+     * Start tracking an operation
+     */
+    startOperation(operation: 'issue' | 'verify', metadata?: Record<string, any>): string;
+    /**
+     * End tracking an operation
+     */
+    endOperation(_operationId: string, success: boolean, error?: string): void;
+    /**
+     * Update aggregated metrics
+     */
+    private updateMetrics;
+    /**
+     * Get metrics for a specific issuer or global
+     */
+    getMetrics(issuerDid?: string): SDJWTMetrics | null;
+    /**
+     * Get all metrics
+     */
+    getAllMetrics(): Map<string, SDJWTMetrics>;
+    /**
+     * Get recent operations
+     */
+    getRecentOperations(limit?: number): OperationMetric[];
+    /**
+     * Get operation statistics
+     */
+    getOperationStats(): {
+        totalOperations: number;
+        successRate: number;
+        averageResponseTime: number;
+        operationsPerMinute: number;
+    };
+    /**
+     * Update cache hit rate
+     */
+    updateCacheHitRate(issuerDid: string, hit: boolean): void;
+    /**
+     * Reset metrics
+     */
+    resetMetrics(issuerDid?: string): void;
+    /**
+     * Export metrics as JSON
+     */
+    exportMetrics(): {
+        aggregatedMetrics: Record<string, SDJWTMetrics>;
+        recentOperations: OperationMetric[];
+        summary: ReturnType<any>;
+    };
+}
+//# sourceMappingURL=metrics-manager.d.ts.map

package/dist/monitoring/metrics-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics-manager.d.ts","sourceRoot":"","sources":["../../src/monitoring/metrics-manager.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAA;IACrB,iBAAiB,EAAE,MAAM,CAAA;IACzB,eAAe,EAAE,MAAM,CAAA;IACvB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,mBAAmB,EAAE,MAAM,CAAA;IAC3B,uBAAuB,EAAE,MAAM,CAAA;IAC/B,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,IAAI,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,GAAG,QAAQ,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,OAAO,CAAuC;IACtD,OAAO,CAAC,UAAU,CAAwB;IAC1C,OAAO,CAAC,mBAAmB,CAAO;IAElC;;OAEG;IACH,cAAc,CAAC,SAAS,EAAE,OAAO,GAAG,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM;IAgBrF;;OAEG;IACH,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;IAmB1E;;OAEG;IACH,OAAO,CAAC,aAAa;IA2CrB;;OAEG;IACH,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAKnD;;OAEG;IACH,aAAa,IAAI,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC;IAI1C;;OAEG;IACH,mBAAmB,CAAC,KAAK,SAAM,GAAG,eAAe,EAAE;IAInD;;OAEG;IACH,iBAAiB,IAAI;QACnB,eAAe,EAAE,MAAM,CAAA;QACvB,WAAW,EAAE,MAAM,CAAA;QACnB,mBAAmB,EAAE,MAAM,CAAA;QAC3B,mBAAmB,EAAE,MAAM,CAAA;KAC5B;IAiBD;;OAEG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,IAAI;IA0BzD;;OAEG;IACH,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAStC;;OAEG;IACH,aAAa,IAAI;QACf,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;QAC/C,gBAAgB,EAAE,eAAe,EAAE,CAAA;QACnC,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAA;KACzB;CAOF"}

package/dist/organization/disclosure-config-manager.d.ts

@@ -0,0 +1,61 @@
+import { CredentialType } from '@vess-id/ai-identity-types';
+export interface OrganizationDisclosureConfig {
+    organizationDid: string;
+    defaultFields: string[];
+    credentialTypeConfigs: Map<CredentialType, CredentialDisclosureConfig>;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface CredentialDisclosureConfig {
+    type: CredentialType;
+    mandatoryFields: string[];
+    selectiveFields: string[];
+    neverDisclose: string[];
+    decoyFields?: number;
+}
+export declare class DisclosureConfigManager {
+    private configs;
+    /**
+     * Set disclosure configuration for an organization
+     */
+    setOrganizationConfig(organizationDid: string, config: Partial<OrganizationDisclosureConfig>): Promise<void>;
+    /**
+     * Get disclosure configuration for an organization
+     */
+    getOrganizationConfig(organizationDid: string): Promise<OrganizationDisclosureConfig | null>;
+    /**
+     * Set credential type specific disclosure configuration
+     */
+    setCredentialTypeConfig(organizationDid: string, credentialType: CredentialType, config: CredentialDisclosureConfig): Promise<void>;
+    /**
+     * Get selective disclosure fields for a specific credential type and organization
+     */
+    getSelectiveDisclosureFields(organizationDid: string, credentialType: CredentialType, requestedFields?: string[]): Promise<{
+        selectiveFields: string[];
+        mandatoryFields: string[];
+        neverDisclose: string[];
+        decoyCount: number;
+    }>;
+    /**
+     * Get default configuration for credential types
+     */
+    private getDefaultConfiguration;
+    /**
+     * Validate disclosure request against organization policy
+     */
+    validateDisclosureRequest(organizationDid: string, credentialType: CredentialType, requestedFields: string[]): Promise<{
+        valid: boolean;
+        allowedFields: string[];
+        rejectedFields: string[];
+        errors: string[];
+    }>;
+    /**
+     * Get all organization configurations (for admin purposes)
+     */
+    getAllConfigurations(): Promise<OrganizationDisclosureConfig[]>;
+    /**
+     * Delete organization configuration
+     */
+    deleteOrganizationConfig(organizationDid: string): Promise<boolean>;
+}
+//# sourceMappingURL=disclosure-config-manager.d.ts.map

package/dist/organization/disclosure-config-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"disclosure-config-manager.d.ts","sourceRoot":"","sources":["../../src/organization/disclosure-config-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAE3D,MAAM,WAAW,4BAA4B;IAC3C,eAAe,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,qBAAqB,EAAE,GAAG,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAA;IACtE,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,cAAc,CAAA;IACpB,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,qBAAa,uBAAuB;IAClC,OAAO,CAAC,OAAO,CAAuD;IAEtE;;OAEG;IACG,qBAAqB,CACzB,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,OAAO,CAAC,4BAA4B,CAAC,GAC5C,OAAO,CAAC,IAAI,CAAC;IAehB;;OAEG;IACG,qBAAqB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAIlG;;OAEG;IACG,uBAAuB,CAC3B,eAAe,EAAE,MAAM,EACvB,cAAc,EAAE,cAAc,EAC9B,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,IAAI,CAAC;IAoBhB;;OAEG;IACG,4BAA4B,CAChC,eAAe,EAAE,MAAM,EACvB,cAAc,EAAE,cAAc,EAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,GACzB,OAAO,CAAC;QACT,eAAe,EAAE,MAAM,EAAE,CAAA;QACzB,eAAe,EAAE,MAAM,EAAE,CAAA;QACzB,aAAa,EAAE,MAAM,EAAE,CAAA;QACvB,UAAU,EAAE,MAAM,CAAA;KACnB,CAAC;IAoCF;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAoD/B;;OAEG;IACG,yBAAyB,CAC7B,eAAe,EAAE,MAAM,EACvB,cAAc,EAAE,cAAc,EAC9B,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC;QACT,KAAK,EAAE,OAAO,CAAA;QACd,aAAa,EAAE,MAAM,EAAE,CAAA;QACvB,cAAc,EAAE,MAAM,EAAE,CAAA;QACxB,MAAM,EAAE,MAAM,EAAE,CAAA;KACjB,CAAC;IA2BF;;OAEG;IACG,oBAAoB,IAAI,OAAO,CAAC,4BAA4B,EAAE,CAAC;IAIrE;;OAEG;IACG,wBAAwB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAG1E"}

package/dist/organization/key-rotation-manager.d.ts

@@ -0,0 +1,63 @@
+import { KeyManager } from '../did/key-manager';
+export interface KeyRotationConfig {
+    /** How often keys should be rotated (in hours) */
+    rotationInterval: number;
+    /** How many old keys to keep for verification */
+    keepOldKeys: number;
+    /** Warning threshold before rotation (in hours) */
+    warningThreshold: number;
+}
+export interface KeyRotationInfo {
+    currentKeyId: string;
+    nextRotationDate: Date;
+    oldKeys: Array<{
+        keyId: string;
+        rotatedAt: Date;
+        expiresAt: Date;
+    }>;
+    needsRotation: boolean;
+    warningActive: boolean;
+}
+export declare class KeyRotationManager {
+    private keyManager;
+    private config;
+    constructor(keyManager: KeyManager, config?: Partial<KeyRotationConfig>);
+    /**
+     * Check if organization keys need rotation
+     */
+    checkRotationStatus(organizationDid: string): Promise<KeyRotationInfo>;
+    /**
+     * Rotate organization keys
+     * NOTE: Currently not implemented for did:jwk
+     */
+    rotateOrganizationKeys(organizationDid: string): Promise<{
+        newDid: string;
+        newPrivateKey: any;
+        rotationDate: Date;
+    }>;
+    /**
+     * Get old keys for verification (useful for grace periods)
+     */
+    getOldKeysForVerification(organizationDid: string): Promise<Array<{
+        keyId: string;
+        publicKey: any;
+        validUntil: Date;
+    }>>;
+    /**
+     * Plan future key rotation (for did:web or other mutable DID methods)
+     */
+    planKeyRotation(organizationDid: string): Promise<{
+        plannedRotationDate: Date;
+        currentKeyAge: number;
+        recommendedAction: 'none' | 'prepare' | 'rotate_now' | 'urgent';
+    }>;
+    /**
+     * Update rotation configuration
+     */
+    updateConfig(newConfig: Partial<KeyRotationConfig>): void;
+    /**
+     * Get current configuration
+     */
+    getConfig(): KeyRotationConfig;
+}
+//# sourceMappingURL=key-rotation-manager.d.ts.map

package/dist/organization/key-rotation-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-rotation-manager.d.ts","sourceRoot":"","sources":["../../src/organization/key-rotation-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAG/C,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,gBAAgB,EAAE,MAAM,CAAA;IACxB,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAA;IACnB,mDAAmD;IACnD,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,gBAAgB,EAAE,IAAI,CAAA;IACtB,OAAO,EAAE,KAAK,CAAC;QACb,KAAK,EAAE,MAAM,CAAA;QACb,SAAS,EAAE,IAAI,CAAA;QACf,SAAS,EAAE,IAAI,CAAA;KAChB,CAAC,CAAA;IACF,aAAa,EAAE,OAAO,CAAA;IACtB,aAAa,EAAE,OAAO,CAAA;CACvB;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,MAAM,CAAmB;gBAErB,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC;IAUvE;;OAEG;IACG,mBAAmB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAe5E;;;OAGG;IACG,sBAAsB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC;QAC7D,MAAM,EAAE,MAAM,CAAA;QACd,aAAa,EAAE,GAAG,CAAA;QAClB,YAAY,EAAE,IAAI,CAAA;KACnB,CAAC;IAQF;;OAEG;IACG,yBAAyB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QACtE,KAAK,EAAE,MAAM,CAAA;QACb,SAAS,EAAE,GAAG,CAAA;QACd,UAAU,EAAE,IAAI,CAAA;KACjB,CAAC,CAAC;IAKH;;OAEG;IACG,eAAe,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC;QACtD,mBAAmB,EAAE,IAAI,CAAA;QACzB,aAAa,EAAE,MAAM,CAAA;QACrB,iBAAiB,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,QAAQ,CAAA;KAChE,CAAC;IAcF;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI;IAOzD;;OAEG;IACH,SAAS,IAAI,iBAAiB;CAG/B"}

package/dist/organization/organization-manager.d.ts

@@ -0,0 +1,38 @@
+import { VPManager } from '../vp/vp-manager';
+import { VCManager } from '../vc/vc-manager';
+import { ToolPermissionRequest, OrganizationConfig } from '@vess-id/ai-identity-types';
+export declare class OrganizationManager {
+    private vpManager;
+    private vcManager;
+    private apiBaseUrl;
+    constructor(vpManager?: VPManager, vcManager?: VCManager);
+    /**
+     * Request tool permissions using employee VC
+     */
+    requestToolPermissions(employeeVCJWT: string, requestedTools: ToolPermissionRequest[], holderDid: string): Promise<{
+        permittedPermissions: ToolPermissionRequest[];
+        employee: any;
+    }>;
+    /**
+     * Issue tool permissions to AI Agent based on organization approval
+     */
+    issueOrganizationDelegatedPermissions(agentDid: string, employeeVCJWT: string, requestedTools: ToolPermissionRequest[], issuerDid: string): Promise<string[]>;
+    /**
+     * Create simplified workflow for employee to AI Agent delegation
+     */
+    delegateToAIAgent(employeeVCJWT: string, agentDid: string, tools: string[], // ['slack', 'gmail', 'github']
+    issuerDid: string, options?: {
+        duration?: string;
+        justification?: string;
+    }): Promise<{
+        issuedVCs: string[];
+        permissionSummary: Record<string, string[]>;
+    }>;
+    /**
+     * Register organization with AIdentity
+     */
+    registerOrganization(config: OrganizationConfig): Promise<void>;
+    private generateChallenge;
+    private extractActionFromVC;
+}
+//# sourceMappingURL=organization-manager.d.ts.map

package/dist/organization/organization-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization-manager.d.ts","sourceRoot":"","sources":["../../src/organization/organization-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAE5C,OAAO,EAGL,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,4BAA4B,CAAA;AAEnC,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,SAAS,CAAW;IAC5B,OAAO,CAAC,SAAS,CAAW;IAC5B,OAAO,CAAC,UAAU,CAAQ;gBAEd,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,SAAS;IAOxD;;OAEG;IACG,sBAAsB,CAC1B,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,qBAAqB,EAAE,EACvC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;QACT,oBAAoB,EAAE,qBAAqB,EAAE,CAAA;QAC7C,QAAQ,EAAE,GAAG,CAAA;KACd,CAAC;IAmCF;;OAEG;IACG,qCAAqC,CACzC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,qBAAqB,EAAE,EACvC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,EAAE,CAAC;IAmCpB;;OAEG;IACG,iBAAiB,CACrB,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EAAE,EAAE,+BAA+B;IAChD,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,aAAa,CAAC,EAAE,MAAM,CAAA;KACvB,GACA,OAAO,CAAC;QACT,SAAS,EAAE,MAAM,EAAE,CAAA;QACnB,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KAC5C,CAAC;IA8BF;;OAEG;IACG,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAYrE,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,mBAAmB;CAU5B"}

package/dist/registry/access-orchestrator.d.ts

@@ -0,0 +1,183 @@
+import { ActionRegistry, Relation, ResourceType } from './action-registry';
+/** ReBAC: 関係性チェック（SpiceDB/Zanzibar想定）。OR解釈で複数relationのいずれか成立でtrue */
+export interface ReBACChecker {
+    check(subjectDid: string, // User DID or Agent DID
+    relations: Relation[], // ["editor","act_as"] など
+    resourceRef: ResourceRef): Promise<boolean>;
+}
+/** ABAC: 条件判定（Cerbos/OPA想定）。trueなら許可。 */
+export interface ABACPolicyEngine {
+    evaluate(input: AbacInput): Promise<AbacDecision>;
+}
+export interface AbacInput {
+    principal: {
+        id: string;
+        roles?: string[];
+        claims?: Record<string, unknown>;
+    };
+    resource: {
+        kind: ResourceType;
+        id: string;
+        attr?: Record<string, unknown>;
+    };
+    action: string;
+    context?: Record<string, unknown>;
+}
+export interface AbacDecision {
+    allow: boolean;
+    ruleId?: string;
+    reason?: string;
+}
+/** Credential選択：最小スコープを満たす外部トークンを取得（Bot/Installation/OAuth） */
+export interface CredentialStore {
+    pickMinimal(provider: Provider, // "slack" | "github" | "google"
+    iaId: string, // IntegrationAccount ID
+    requiredScopes: string[], subjectDid: string): Promise<CredentialRef | null>;
+}
+export type Provider = 'slack' | 'github' | 'google';
+export interface CredentialRef {
+    id: string;
+    provider: Provider;
+    scopes: string[];
+}
+/** VP検証（SD-JWT/ISO 23220/mdoc/OID4VP）：成功時にVCクレームを返す */
+export interface VpVerifier {
+    verifyAndExtractClaims(vpToken: string): Promise<VerifiedVcClaims>;
+}
+/** 発行した Delegation VC に含めることを想定した最小構造 */
+export interface VerifiedVcClaims {
+    allowed_actions: string[];
+    resource_scope: ResourceScope[];
+    expires_at?: string;
+    actor?: string;
+    assurance_level?: number;
+    cnf?: {
+        jwk_thumbprint?: string;
+    };
+    [k: string]: unknown;
+}
+export interface ResourceRef {
+    /** プロバイダ別のリソース識別子（例：Slack channel id, GitHub repo full_name, Drive file id） */
+    id: string;
+    type: ResourceType;
+    /** 紐づくIntegrationAccountのID（どのSlackワークスペース/どのGitHub Orgか） */
+    iaId: string;
+    /** 追加属性（機密度など） */
+    attr?: Record<string, unknown>;
+}
+/** VCに刻む「スコープ」表現の一例（最小定義） */
+export type ResourceScope = {
+    kind: 'Workspace';
+    id: string;
+} | {
+    kind: 'IntegrationAccount';
+    id: string;
+} | {
+    kind: 'Resource';
+    type: ResourceType;
+    id: string;
+};
+/** 監査用の判定理由 */
+export interface DecisionTrace {
+    rebac?: {
+        ok: boolean;
+        relations: Relation[];
+    };
+    delegation?: {
+        ok: boolean;
+        matched_action?: boolean;
+        in_scope?: boolean;
+        notExpired?: boolean;
+    };
+    abac?: {
+        ok: boolean;
+        ruleId?: string;
+        reason?: string;
+    };
+    scope?: {
+        ok: boolean;
+        required: string[];
+        chosenCredentialId?: string;
+    };
+}
+/** Capability名やAction名（混在OK）から、実アクション配列に解決 */
+export declare function resolveActionsFromSelection(registry: ActionRegistry, selection: string[]): string[];
+export interface PlanDelegationInput {
+    registry: ActionRegistry;
+    issuerUserDid: string;
+    delegateAgentDid: string;
+    /** ユーザーが UI 等で選んだアクション/ケイパビリティ */
+    requested: string[];
+    /** この委任が及ぶスコープ（Workspace/IA/Resource） */
+    resourceScope: ResourceScope[];
+    /** 有効期限（ISO） */
+    expiresAt?: string;
+    /** ABAC前提で要求する最小アシュアランス等（必要なら） */
+    minAssuranceLevel?: number;
+    /** ABAC/Cerbos用のruntime context（時間帯/場所/リスク等） */
+    context?: Record<string, unknown>;
+    /** Provider 推測のためのヒント（Credential選択時に使う） */
+    providerByIa?: Record<string, Provider>;
+    /** 実行時に用いるReBAC/ABAC/Credentialのハンドラ */
+    rebac: ReBACChecker;
+    abac: ABACPolicyEngine;
+    creds: CredentialStore;
+}
+export interface PlanDelegationResult {
+    granted_actions: string[];
+    rejected_actions: string[];
+    traceByAction: Record<string, DecisionTrace>;
+}
+/**
+ * VC発行前に、リクエストされたアクション群を
+ * - Registryに存在
+ * - ReBAC（委任元=issuerUserDid が十分な関係を持つ）
+ * - ABACポリシー適合
+ * - 必要スコープを満たすクレデンシャルが存在
+ * の観点で絞り込み、発行して良いものだけ返す。
+ */
+export declare function planDelegationForVC(input: PlanDelegationInput): Promise<PlanDelegationResult>;
+export interface CheckPermissionInput {
+    registry: ActionRegistry;
+    actorDid: string;
+    onBehalfOfDid?: string;
+    action: string;
+    resource: ResourceRef;
+    vpToken: string;
+    context?: Record<string, unknown>;
+    rebac: ReBACChecker;
+    abac: ABACPolicyEngine;
+    creds: CredentialStore;
+    vpVerifier: VpVerifier;
+}
+export interface CheckPermissionResult {
+    allow: boolean;
+    reason?: string;
+    trace: DecisionTrace;
+    credential?: CredentialRef | null;
+}
+/**
+ * 実行直前のフル判定。
+ * 1) ReBAC: actor がresourceに対する 基本関係/act_as を満たすか
+ * 2) Delegation(VC): actionがallowedか / resourceがscope内か / 期限内か
+ * 3) ABAC: コンテキストやassurance levelに適合するか
+ * 4) Scope/Credential: 必要スコープを満たすクレデンシャルが取得できるか
+ */
+export declare function checkPermissionWithVP(input: CheckPermissionInput): Promise<CheckPermissionResult>;
+export declare class AllowAllAbac implements ABACPolicyEngine {
+    evaluate(): Promise<AbacDecision>;
+}
+export declare class SimpleRebac implements ReBACChecker {
+    private allowRelations;
+    constructor(allowRelations?: Relation[]);
+    check(_sub: string, relations: Relation[]): Promise<boolean>;
+}
+export declare class DummyCreds implements CredentialStore {
+    pickMinimal(provider: Provider, _iaId: string, requiredScopes: string[]): Promise<CredentialRef | null>;
+}
+export declare class DummyVpVerifier implements VpVerifier {
+    private vc;
+    constructor(vc: VerifiedVcClaims);
+    verifyAndExtractClaims(): Promise<VerifiedVcClaims>;
+}
+//# sourceMappingURL=access-orchestrator.d.ts.map

package/dist/registry/access-orchestrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-orchestrator.d.ts","sourceRoot":"","sources":["../../src/registry/access-orchestrator.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,cAAc,EAGd,QAAQ,EACR,YAAY,EAKb,MAAM,mBAAmB,CAAA;AAI1B,qEAAqE;AACrE,MAAM,WAAW,YAAY;IAC3B,KAAK,CACH,UAAU,EAAE,MAAM,EAAE,wBAAwB;IAC5C,SAAS,EAAE,QAAQ,EAAE,EAAE,yBAAyB;IAChD,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,OAAO,CAAC,CAAA;CACpB;AAED,yCAAyC;AACzC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;CAClD;AACD,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE;QACT,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KACjC,CAAA;IACD,QAAQ,EAAE;QACR,IAAI,EAAE,YAAY,CAAA;QAClB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAC/B,CAAA;IACD,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AACD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,WAAW,CACT,QAAQ,EAAE,QAAQ,EAAE,gCAAgC;IACpD,IAAI,EAAE,MAAM,EAAE,wBAAwB;IACtC,cAAc,EAAE,MAAM,EAAE,EACxB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;CACjC;AACD,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAA;AACpD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,EAAE,CAAA;CAEjB;AAED,uDAAuD;AACvD,MAAM,WAAW,UAAU;IACzB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;CACnE;AACD,yCAAyC;AACzC,MAAM,WAAW,gBAAgB;IAE/B,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,cAAc,EAAE,aAAa,EAAE,CAAA;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB,GAAG,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAEjC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CACrB;AAID,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,YAAY,CAAA;IAClB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAA;IACZ,kBAAkB;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B;AAED,6BAA6B;AAC7B,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAA;AAExD,eAAe;AACf,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,QAAQ,EAAE,CAAA;KAAE,CAAA;IAC9C,UAAU,CAAC,EAAE;QACX,EAAE,EAAE,OAAO,CAAA;QACX,cAAc,CAAC,EAAE,OAAO,CAAA;QACxB,QAAQ,CAAC,EAAE,OAAO,CAAA;QAClB,UAAU,CAAC,EAAE,OAAO,CAAA;KACrB,CAAA;IACD,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACxD,KAAK,CAAC,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CACzE;AAID,8CAA8C;AAC9C,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,cAAc,EACxB,SAAS,EAAE,MAAM,EAAE,GAClB,MAAM,EAAE,CAkBV;AAID,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,cAAc,CAAA;IACxB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,CAAA;IACxB,kCAAkC;IAClC,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,yCAAyC;IACzC,aAAa,EAAE,aAAa,EAAE,CAAA;IAC9B,gBAAgB;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kCAAkC;IAClC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACvC,wCAAwC;IACxC,KAAK,EAAE,YAAY,CAAA;IACnB,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,EAAE,eAAe,CAAA;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;CAC7C;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,oBAAoB,CAAC,CA6G/B;AAeD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,cAAc,CAAA;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,WAAW,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,KAAK,EAAE,YAAY,CAAA;IACnB,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,EAAE,eAAe,CAAA;IACtB,UAAU,EAAE,UAAU,CAAA;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,aAAa,CAAA;IACpB,UAAU,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;CAClC;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,qBAAqB,CAAC,CA2EhC;AAsBD,qBAAa,YAAa,YAAW,gBAAgB;IAC7C,QAAQ,IAAI,OAAO,CAAC,YAAY,CAAC;CAGxC;AACD,qBAAa,WAAY,YAAW,YAAY;IAE5C,OAAO,CAAC,cAAc;gBAAd,cAAc,GAAE,QAAQ,EAAqD;IAEjF,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAGnE;AACD,qBAAa,UAAW,YAAW,eAAe;IAC1C,WAAW,CACf,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,MAAM,EAAE,GACvB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;CAKjC;AACD,qBAAa,eAAgB,YAAW,UAAU;IACpC,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,gBAAgB;IAClC,sBAAsB,IAAI,OAAO,CAAC,gBAAgB,CAAC;CAG1D"}