@vess-id/vess 0.0.0-dev-20260902121045

package/dist/policy/policy-evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-evaluator.js","sourceRoot":"","sources":["../../src/policy/policy-evaluator.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAwB;AAIxB;;;;;;;;;;;;;GAaG;AACH,MAAa,eAAe;IAEP;IACA;IAFnB,YACmB,WAAwB,EACxB,WAA6B,EAAE;QAD/B,gBAAW,GAAX,WAAW,CAAa;QACxB,aAAQ,GAAR,QAAQ,CAAuB;IAC/C,CAAC;IAEJ;;;;OAIG;IACH,QAAQ,CACN,QAAgB,EAChB,MAAc,EACd,QAA4B;QAE5B,kCAAkC;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QAClE,IAAI,CAAC,WAAW,CAAC,OAAO;YAAE,OAAO,WAAW,CAAA;QAE5C,gCAAgC;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC9D,IAAI,CAAC,SAAS,CAAC,OAAO;YAAE,OAAO,SAAS,CAAA;QAExC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC1B,CAAC;IAED,aAAa,CACX,QAAgB,EAChB,MAAc,EACd,QAA4B;QAE5B,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAA;IAC/F,CAAC;IAED,WAAW,CACT,QAAgB,EAChB,MAAc,EACd,QAA4B;QAE5B,yDAAyD;QACzD,oDAAoD;QACpD,2EAA2E;QAC3E,0DAA0D;QAC1D,MAAM,aAAa,GAAsB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC/D,GAAG,CAAC;YACJ,MAAM,EAAG,CAAC,CAAC,MAA2B,IAAI,OAAO;SAClD,CAAC,CAAC,CAAA;QAEH,OAAO,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;IACpF,CAAC;IAEO,aAAa,CACnB,KAAwB,EACxB,QAAgB,EAChB,MAAc,EACd,QAA4B,EAC5B,MAAc;QAEd,0BAA0B;QAC1B,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CACxC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC;YACpC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC;YAChC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CACrC,CAAA;QAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAC1B,CAAC;QAED,4CAA4C;QAC5C,gFAAgF;QAChF,MAAM,MAAM,GAAG,aAAa;aACzB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;aACnE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAA;QAEhD,iDAAiD;QACjD,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAA;QAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,cAAc,CAAC,CAAA;QAErE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,aAAa,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,EAAE;gBACrK,WAAW,EAAE,OAAO,CAAC,IAAI;aAC1B,CAAA;QACH,CAAC;QAED,wDAAwD;QACxD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC1B,CAAC;IAED;;;;;;;;;OASG;IACK,kBAAkB,CAAC,IAAqB;QAC9C,IAAI,KAAK,GAAG,CAAC,CAAA;QAEb,uBAAuB;QACvB,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG;YAAE,KAAK,IAAI,EAAE,CAAA;QAEvD,uBAAuB;QACvB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,GAAG;gBAAE,KAAK,IAAI,EAAE,CAAA;YAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG;gBAAE,KAAK,IAAI,EAAE,CAAA;iBACxD,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO;gBAAE,KAAK,IAAI,EAAE,CAAA;QAC7C,CAAC;QAED,qBAAqB;QACrB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAA;YACrD,IAAI,CAAC,WAAW;gBAAE,KAAK,IAAI,EAAE,CAAA;QAC/B,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,eAAe,CAAC,IAAqB,EAAE,QAAgB;QAC7D,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;QACxD,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAA;IACnC,CAAC;IAEO,aAAa,CAAC,IAAqB,EAAE,MAAc;QACzD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YAC3B,IAAI,CAAC,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAA;YAC1B,IAAI,CAAC,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAA;YAC7B,oDAAoD;YACpD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;YACxC,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC,CAAC,CAAA;IACJ,CAAC;IAEO,WAAW,CAAC,OAAe;QACjC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YAChD,OAAO,EAAE,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACxC,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAEO,eAAe,CAAC,IAAqB,EAAE,QAA4B;QACzE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC/B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;YAAE,OAAO,KAAK,CAAA;QAEpF,MAAM,mBAAmB,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACvG,MAAM,uBAAuB,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACjG,MAAM,kBAAkB,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAElF,mBAAmB;QACnB,IAAI,mBAAmB,IAAI,uBAAuB,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAA;QACrE,CAAC;QAED,gFAAgF;QAChF,IAAI,mBAAmB,IAAI,kBAAkB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CAAA;QAChE,CAAC;QAED,8EAA8E;QAC9E,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QAE5D,iBAAiB;QACjB,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACxF,IAAI,cAAc,IAAI,kBAAkB,EAAE,CAAC;YACzC,OAAO,cAAc,KAAK,kBAAkB,IAAI,cAAc,KAAK,GAAG,CAAA;QACxE,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,IAAiE;QAC3E,4CAA4C;QAC5C,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAM,CAAC,uCAAuC;QAC3E,CAAC;QAED,kEAAkE;QAClE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CACzD,QAAQ,CAAC,MAAM,KAAK,MAAM;YAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM;YAChD,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CACvD,CAAA;QACD,IAAI,WAAW;YAAE,OAAM;QAEvB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC;YAC1B,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG;YAC/C,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;OAMG;IACK,SAAS,CAAC,OAAe,EAAE,KAAa;QAC9C,wBAAwB;QACxB,IAAI,KAAK,GAAG,GAAG,CAAA;QACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;YACpB,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxC,KAAK,IAAI,IAAI,CAAA;gBACb,CAAC,EAAE,CAAA,CAAC,gBAAgB;gBACpB,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;oBAAE,CAAC,EAAE,CAAA,CAAC,kBAAkB;YACpD,CAAC;iBAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACrB,KAAK,IAAI,OAAO,CAAA;YAClB,CAAC;iBAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACrB,KAAK,IAAI,GAAG,CAAA;YACd,CAAC;iBAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACrK,KAAK,IAAI,IAAI,GAAG,CAAC,CAAA;YACnB,CAAC;iBAAM,CAAC;gBACN,KAAK,IAAI,CAAC,CAAA;YACZ,CAAC;QACH,CAAC;QACD,KAAK,IAAI,GAAG,CAAA;QAEZ,IAAI,CAAC;YACH,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;CACF;AAlPD,0CAkPC"}

package/dist/policy/policy-loader.d.ts

@@ -0,0 +1,10 @@
+import Database from 'better-sqlite3';
+import { LocalPolicy } from './types';
+import { PermissionRule } from '@vess-id/ai-identity';
+export declare function loadLocalPolicy(policyPath: string): LocalPolicy;
+/**
+ * Load synced org policies from SQLite synced_policies table.
+ * Returns PermissionRule[] (org policies are allow-only, like VCs).
+ */
+export declare function loadOrgPolicies(db: Database.Database, projectId: string): PermissionRule[];
+//# sourceMappingURL=policy-loader.d.ts.map

package/dist/policy/policy-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-loader.d.ts","sourceRoot":"","sources":["../../src/policy/policy-loader.ts"],"names":[],"mappings":"AACA,OAAO,QAAQ,MAAM,gBAAgB,CAAA;AACrC,OAAO,EAAE,WAAW,EAAmB,MAAM,SAAS,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAErD,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,CAU/D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,SAAS,EAAE,MAAM,GAChB,cAAc,EAAE,CAclB"}

package/dist/policy/policy-loader.js

@@ -0,0 +1,71 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadLocalPolicy = loadLocalPolicy;
+exports.loadOrgPolicies = loadOrgPolicies;
+const fs = __importStar(require("fs"));
+function loadLocalPolicy(policyPath) {
+    try {
+        if (!fs.existsSync(policyPath)) {
+            return { v: '1', rules: [] };
+        }
+        const raw = fs.readFileSync(policyPath, 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return { v: '1', rules: [] };
+    }
+}
+/**
+ * Load synced org policies from SQLite synced_policies table.
+ * Returns PermissionRule[] (org policies are allow-only, like VCs).
+ */
+function loadOrgPolicies(db, projectId) {
+    try {
+        const row = db.prepare('SELECT policy_json FROM synced_policies WHERE project_id = ? ORDER BY synced_at DESC LIMIT 1').get(projectId);
+        if (!row)
+            return [];
+        const parsed = JSON.parse(row.policy_json);
+        if (Array.isArray(parsed))
+            return parsed;
+        if (parsed.rules && Array.isArray(parsed.rules))
+            return parsed.rules;
+        return [];
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=policy-loader.js.map

package/dist/policy/policy-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-loader.js","sourceRoot":"","sources":["../../src/policy/policy-loader.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKA,0CAUC;AAMD,0CAiBC;AAtCD,uCAAwB;AAKxB,SAAgB,eAAe,CAAC,UAAkB;IAChD,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;QAC9B,CAAC;QACD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QAChD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAA;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IAC9B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAC7B,EAAqB,EACrB,SAAiB;IAEjB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CACpB,8FAA8F,CAC/F,CAAC,GAAG,CAAC,SAAS,CAAwC,CAAA;QAEvD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAA;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,MAA0B,CAAA;QAC5D,IAAI,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,KAAyB,CAAA;QACxF,OAAO,EAAE,CAAA;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC"}

package/dist/policy/types.d.ts

@@ -0,0 +1,21 @@
+import { PermissionRule } from '@vess-id/ai-identity';
+export type PolicySource = 'org' | 'user' | 'system';
+/**
+ * Local policy rule — extends PermissionRule with deny support.
+ * SDK PermissionRule is 'allow'-only because VCs only express positive permissions.
+ * Local policy needs 'deny' to block actions before they reach the Gateway.
+ */
+export interface LocalPolicyRule extends Omit<PermissionRule, 'effect'> {
+    effect: 'allow' | 'deny';
+    source?: PolicySource;
+}
+export interface LocalPolicy {
+    v: string;
+    rules: LocalPolicyRule[];
+}
+export interface PolicyEvaluationResult {
+    allowed: boolean;
+    reason?: string;
+    matchedRule?: LocalPolicyRule;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/policy/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/policy/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAsB,MAAM,sBAAsB,CAAA;AAEzE,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;AAEpD;;;;GAIG;AACH,MAAM,WAAW,eAAgB,SAAQ,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC;IACrE,MAAM,EAAE,OAAO,GAAG,MAAM,CAAA;IACxB,MAAM,CAAC,EAAE,YAAY,CAAA;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,MAAM,CAAA;IACT,KAAK,EAAE,eAAe,EAAE,CAAA;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,eAAe,CAAA;CAC9B"}

package/dist/policy/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/policy/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/policy/types.ts"],"names":[],"mappings":""}

package/dist/telemetry/claude-settings.d.ts

@@ -0,0 +1,67 @@
+/**
+ * 書き込む環境変数。**ここに列挙したキーだけを触る。**
+ * 利用者が自分で足した他の変数は残す。
+ */
+export declare const TELEMETRY_ENV_KEYS: readonly ["CLAUDE_CODE_ENABLE_TELEMETRY", "OTEL_METRICS_EXPORTER", "OTEL_LOGS_EXPORTER", "OTEL_LOG_USER_PROMPTS", "OTEL_LOG_TOOL_DETAILS", "OTEL_EXPORTER_OTLP_PROTOCOL", "OTEL_EXPORTER_OTLP_METRICS_ENDPOINT", "OTEL_EXPORTER_OTLP_LOGS_ENDPOINT", "OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE", "OTEL_EXPORTER_OTLP_HEADERS"];
+export interface ClaudeHook {
+    type: string;
+    command: string;
+}
+export interface ClaudeHookMatcher {
+    matcher?: string;
+    hooks?: ClaudeHook[];
+}
+export interface ClaudeHooks {
+    PostToolUse?: ClaudeHookMatcher[];
+    [event: string]: ClaudeHookMatcher[] | undefined;
+}
+export interface ClaudeSettings {
+    otelHeadersHelper?: string;
+    hooks?: ClaudeHooks;
+    env?: Record<string, string>;
+    [key: string]: unknown;
+}
+export interface ExporterConflict {
+    key: string;
+    current: string;
+}
+/**
+ * Claude Code のグローバル設定ファイルの場所。
+ *
+ * `CLAUDE_CONFIG_DIR` は複数プロファイル運用で使われる。homedir 決め打ちにすると、
+ * 書き込みは成功するのに Claude Code が読まない設定を作ってしまう
+ * (`cli/claude-config-path.ts` が `.claude.json` で踏んだのと同じ罠)。
+ */
+export declare function resolveGlobalSettingsPath(): string;
+/**
+ * 送信に必要な環境変数一式。
+ *
+ * API キーはここに入れない。設定ファイルは平文で、バックアップや共有に乗りやすい。
+ * キーはキーチェーンに置き、`vess otel-headers` が送信のたびに載せる。
+ */
+export declare function buildTelemetryEnv(options: {
+    endpoint: string;
+}): Record<string, string>;
+/**
+ * 既に別の送信先が設定されていないかを見る。
+ *
+ * **黙って上書きしない。** エージェントのテレメトリは送信先を 1 つしか持てないので、
+ * 上書きは相手先の監視を止めることと同じ。呼び出し側は利用者に確認する。
+ */
+export declare function detectExporterConflict(env: Record<string, string> | undefined, endpoint: string): ExporterConflict | null;
+/**
+ * 設定に送信設定を重ねた**新しいオブジェクト**を返す。入力は変更しない。
+ *
+ * 触るのは `TELEMETRY_ENV_KEYS` と `otelHeadersHelper` だけ。グローバル設定には
+ * 権限・フック・プラグインが同居しているので、丸ごと書き直すと利用者の環境が壊れる。
+ */
+export declare function applyTelemetrySettings(settings: ClaudeSettings, options: {
+    endpoint: string;
+    helperCommand: string;
+    hookCommand: string;
+}): ClaudeSettings & {
+    env: Record<string, string>;
+};
+/** `cli/index.ts` のサブコマンド名と対。片方だけ変えると登録済みの設定が孤児になる。 */
+export declare const PROJECT_HOOK_COMMAND = "usage-hook";
+//# sourceMappingURL=claude-settings.d.ts.map

package/dist/telemetry/claude-settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-settings.d.ts","sourceRoot":"","sources":["../../src/telemetry/claude-settings.ts"],"names":[],"mappings":"AAiBA;;;GAGG;AACH,eAAO,MAAM,kBAAkB,yUAWrB,CAAA;AAYV,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,UAAU,EAAE,CAAA;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,CAAC,EAAE,iBAAiB,EAAE,CAAA;IACjC,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,EAAE,GAAG,SAAS,CAAA;CACjD;AAED,MAAM,WAAW,cAAc;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAIlD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAyBvF;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACvC,QAAQ,EAAE,MAAM,GACf,gBAAgB,GAAG,IAAI,CAYzB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACxE,cAAc,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAelD;AAgCD,uDAAuD;AACvD,eAAO,MAAM,oBAAoB,eAAe,CAAA"}

package/dist/telemetry/claude-settings.js

@@ -0,0 +1,191 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROJECT_HOOK_COMMAND = exports.TELEMETRY_ENV_KEYS = void 0;
+exports.resolveGlobalSettingsPath = resolveGlobalSettingsPath;
+exports.buildTelemetryEnv = buildTelemetryEnv;
+exports.detectExporterConflict = detectExporterConflict;
+exports.applyTelemetrySettings = applyTelemetrySettings;
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/**
+ * Claude Code のグローバル設定に、aidentity へテレメトリを送る設定を書き込む部分。
+ *
+ * 純粋な組み立てと判定だけを持ち、ファイル I/O は `cli/telemetry-setup.ts` が扱う。
+ * 利用者の実設定を書き換える処理なので、壊さないことの確認をファイルシステム抜きで
+ * 回せるようにしてある。
+ *
+ * 設計: docs/specs/2026-08-28-agent-usage-analytics-design.md §9
+ */
+/** 受信口のパス。`telemetry-ingest.controller.ts` の `@Controller('telemetry/v1')` と対。 */
+const METRICS_PATH = '/api/telemetry/v1/metrics';
+const LOGS_PATH = '/api/telemetry/v1/logs';
+/**
+ * 書き込む環境変数。**ここに列挙したキーだけを触る。**
+ * 利用者が自分で足した他の変数は残す。
+ */
+exports.TELEMETRY_ENV_KEYS = [
+    'CLAUDE_CODE_ENABLE_TELEMETRY',
+    'OTEL_METRICS_EXPORTER',
+    'OTEL_LOGS_EXPORTER',
+    'OTEL_LOG_USER_PROMPTS',
+    'OTEL_LOG_TOOL_DETAILS',
+    'OTEL_EXPORTER_OTLP_PROTOCOL',
+    'OTEL_EXPORTER_OTLP_METRICS_ENDPOINT',
+    'OTEL_EXPORTER_OTLP_LOGS_ENDPOINT',
+    'OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE',
+    'OTEL_EXPORTER_OTLP_HEADERS',
+];
+/**
+ * 送信先が既に設定されていないかを見るキー。汎用の `OTEL_EXPORTER_OTLP_ENDPOINT` を
+ * 先に見るのは、シグナル別の指定より広く効くため。
+ */
+const EXPORTER_ENDPOINT_KEYS = [
+    'OTEL_EXPORTER_OTLP_ENDPOINT',
+    'OTEL_EXPORTER_OTLP_METRICS_ENDPOINT',
+    'OTEL_EXPORTER_OTLP_LOGS_ENDPOINT',
+];
+/**
+ * Claude Code のグローバル設定ファイルの場所。
+ *
+ * `CLAUDE_CONFIG_DIR` は複数プロファイル運用で使われる。homedir 決め打ちにすると、
+ * 書き込みは成功するのに Claude Code が読まない設定を作ってしまう
+ * (`cli/claude-config-path.ts` が `.claude.json` で踏んだのと同じ罠)。
+ */
+function resolveGlobalSettingsPath() {
+    const configDir = process.env.CLAUDE_CONFIG_DIR?.trim();
+    if (configDir)
+        return path.join(configDir, 'settings.json');
+    return path.join(os.homedir(), '.claude', 'settings.json');
+}
+/**
+ * 送信に必要な環境変数一式。
+ *
+ * API キーはここに入れない。設定ファイルは平文で、バックアップや共有に乗りやすい。
+ * キーはキーチェーンに置き、`vess otel-headers` が送信のたびに載せる。
+ */
+function buildTelemetryEnv(options) {
+    const base = options.endpoint.replace(/\/+$/, '');
+    return {
+        CLAUDE_CODE_ENABLE_TELEMETRY: '1',
+        OTEL_METRICS_EXPORTER: 'otlp',
+        // ツール利用はメトリクスに無くイベント側にしかないので、logs も必須
+        OTEL_LOGS_EXPORTER: 'otlp',
+        // 🔴 入力の本文を送る。既定は `<REDACTED>` で長さしか届かず、
+        // 「どのような入力でどのツールを使ったか」が読めないため有効にする
+        OTEL_LOG_USER_PROMPTS: '1',
+        // 🔴 ツールに渡した引数を送る。既定はサイズだけで、何をしたかが読めない。
+        //
+        // 🪤 `OTEL_LOG_TOOL_CONTENT` は**足さない**。あちらはツールの出力で、
+        // `cat .env` の結果が本人の自覚なく飛ぶ。受信側でも落としている (判断 5-3)
+        OTEL_LOG_TOOL_DETAILS: '1',
+        // 受信口は JSON しか解さない (protobuf は 415 で断る)
+        OTEL_EXPORTER_OTLP_PROTOCOL: 'http/json',
+        OTEL_EXPORTER_OTLP_METRICS_ENDPOINT: `${base}${METRICS_PATH}`,
+        OTEL_EXPORTER_OTLP_LOGS_ENDPOINT: `${base}${LOGS_PATH}`,
+        // 累積で送ると受信側が 400 で拒否する
+        OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE: 'delta',
+        // 静的ヘッダーは空にし、otelHeadersHelper の出力だけを使う
+        OTEL_EXPORTER_OTLP_HEADERS: '',
+    };
+}
+/**
+ * 既に別の送信先が設定されていないかを見る。
+ *
+ * **黙って上書きしない。** エージェントのテレメトリは送信先を 1 つしか持てないので、
+ * 上書きは相手先の監視を止めることと同じ。呼び出し側は利用者に確認する。
+ */
+function detectExporterConflict(env, endpoint) {
+    if (!env)
+        return null;
+    const ours = endpoint.replace(/\/+$/, '');
+    for (const key of EXPORTER_ENDPOINT_KEYS) {
+        const current = env[key]?.trim();
+        if (!current)
+            continue;
+        if (current.startsWith(ours))
+            continue;
+        return { key, current };
+    }
+    return null;
+}
+/**
+ * 設定に送信設定を重ねた**新しいオブジェクト**を返す。入力は変更しない。
+ *
+ * 触るのは `TELEMETRY_ENV_KEYS` と `otelHeadersHelper` だけ。グローバル設定には
+ * 権限・フック・プラグインが同居しているので、丸ごと書き直すと利用者の環境が壊れる。
+ */
+function applyTelemetrySettings(settings, options) {
+    const env = { ...(settings.env ?? {}) };
+    // 汎用の送信先を残すとシグナル別の指定と競合する。こちらへ切り替える以上、
+    // 前の送信先とその認証ヘッダーは消す (他所向けのキーが載ったまま飛ぶのを防ぐ)
+    delete env.OTEL_EXPORTER_OTLP_ENDPOINT;
+    Object.assign(env, buildTelemetryEnv({ endpoint: options.endpoint }));
+    return {
+        ...settings,
+        otelHeadersHelper: options.helperCommand,
+        hooks: applyProjectHook(settings.hooks, options.hookCommand),
+        env,
+    };
+}
+/**
+ * セッションの移動を申告するフックを `PostToolUse` に足す (判断 4-5)。
+ *
+ * 🔴 **利用者のフックを壊さない。** hooks はプロジェクト固有の検査や整形が
+ * 同居する場所で、丸ごと置き換えるとそれらが消える。自分の 1 件だけを
+ * 入れ替え、他はそのまま残す。
+ *
+ * matcher を `Bash` に絞るのは、作業ディレクトリを変えられるのが Bash だけで、
+ * かつフックがツール呼び出しごとにプロセスを 1 つ増やすため。
+ */
+function applyProjectHook(hooks, command) {
+    const next = { ...(hooks ?? {}) };
+    const existing = Array.isArray(next.PostToolUse) ? next.PostToolUse : [];
+    const others = existing
+        .map(matcher => ({
+        ...matcher,
+        hooks: (matcher.hooks ?? []).filter(hook => !isProjectHook(hook.command)),
+    }))
+        .filter(matcher => (matcher.hooks ?? []).length > 0);
+    next.PostToolUse = [...others, { matcher: 'Bash', hooks: [{ type: 'command', command }] }];
+    return next;
+}
+/** 自分が書いたフックかどうか。パスは端末ごとに違うのでコマンド名で見る。 */
+function isProjectHook(command) {
+    return typeof command === 'string' && command.includes(exports.PROJECT_HOOK_COMMAND);
+}
+/** `cli/index.ts` のサブコマンド名と対。片方だけ変えると登録済みの設定が孤児になる。 */
+exports.PROJECT_HOOK_COMMAND = 'usage-hook';
+//# sourceMappingURL=claude-settings.js.map

package/dist/telemetry/claude-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-settings.js","sourceRoot":"","sources":["../../src/telemetry/claude-settings.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8EA,8DAIC;AAQD,8CAyBC;AAQD,wDAeC;AAQD,wDAkBC;AApKD,uCAAwB;AACxB,2CAA4B;AAE5B;;;;;;;;GAQG;AAEH,kFAAkF;AAClF,MAAM,YAAY,GAAG,2BAA2B,CAAA;AAChD,MAAM,SAAS,GAAG,wBAAwB,CAAA;AAE1C;;;GAGG;AACU,QAAA,kBAAkB,GAAG;IAChC,8BAA8B;IAC9B,uBAAuB;IACvB,oBAAoB;IACpB,uBAAuB;IACvB,uBAAuB;IACvB,6BAA6B;IAC7B,qCAAqC;IACrC,kCAAkC;IAClC,mDAAmD;IACnD,4BAA4B;CACpB,CAAA;AAEV;;;GAGG;AACH,MAAM,sBAAsB,GAAG;IAC7B,6BAA6B;IAC7B,qCAAqC;IACrC,kCAAkC;CAC1B,CAAA;AA6BV;;;;;;GAMG;AACH,SAAgB,yBAAyB;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAA;IACvD,IAAI,SAAS;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;IAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAA;AAC5D,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,OAA6B;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAEjD,OAAO;QACL,4BAA4B,EAAE,GAAG;QACjC,qBAAqB,EAAE,MAAM;QAC7B,sCAAsC;QACtC,kBAAkB,EAAE,MAAM;QAC1B,yCAAyC;QACzC,mCAAmC;QACnC,qBAAqB,EAAE,GAAG;QAC1B,wCAAwC;QACxC,EAAE;QACF,oDAAoD;QACpD,gDAAgD;QAChD,qBAAqB,EAAE,GAAG;QAC1B,wCAAwC;QACxC,2BAA2B,EAAE,WAAW;QACxC,mCAAmC,EAAE,GAAG,IAAI,GAAG,YAAY,EAAE;QAC7D,gCAAgC,EAAE,GAAG,IAAI,GAAG,SAAS,EAAE;QACvD,uBAAuB;QACvB,iDAAiD,EAAE,OAAO;QAC1D,wCAAwC;QACxC,0BAA0B,EAAE,EAAE;KAC/B,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CACpC,GAAuC,EACvC,QAAgB;IAEhB,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAEzC,KAAK,MAAM,GAAG,IAAI,sBAAsB,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;QAChC,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAQ;QACtC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;IACzB,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CACpC,QAAwB,EACxB,OAAyE;IAEzE,MAAM,GAAG,GAA2B,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAA;IAE/D,uCAAuC;IACvC,0CAA0C;IAC1C,OAAO,GAAG,CAAC,2BAA2B,CAAA;IAEtC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAErE,OAAO;QACL,GAAG,QAAQ;QACX,iBAAiB,EAAE,OAAO,CAAC,aAAa;QACxC,KAAK,EAAE,gBAAgB,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC;QAC5D,GAAG;KACJ,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CAAC,KAA8B,EAAE,OAAe;IACvE,MAAM,IAAI,GAAgB,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAA;IAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAA;IAExE,MAAM,MAAM,GAAG,QAAQ;SACpB,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACf,GAAG,OAAO;QACV,KAAK,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;KAC1E,CAAC,CAAC;SACF,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAEtD,IAAI,CAAC,WAAW,GAAG,CAAC,GAAG,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAA;IAC1F,OAAO,IAAI,CAAA;AACb,CAAC;AAED,0CAA0C;AAC1C,SAAS,aAAa,CAAC,OAA2B;IAChD,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,4BAAoB,CAAC,CAAA;AAC9E,CAAC;AAED,uDAAuD;AAC1C,QAAA,oBAAoB,GAAG,YAAY,CAAA"}

package/dist/telemetry/otel-headers.d.ts

@@ -0,0 +1,27 @@
+/**
+ * テレメトリ送信に載せる HTTP ヘッダー。
+ *
+ * プロジェクト識別子をヘッダーで運ぶのは、コーディングエージェントのテレメトリに
+ * 作業ディレクトリやリポジトリを示す属性が無いため。サーバー側はここに載ってきた値を
+ * 読むだけで、推測しない。
+ *
+ * 設計: docs/specs/2026-08-28-agent-usage-analytics-design.md §4
+ */
+export declare const API_KEY_HEADER = "X-API-Key";
+/**
+ * 🔴 受信側の `PROJECT_HEADER`
+ * (`packages/api/src/telemetry-ingest/telemetry.constants.ts`) と**同じ名前**。
+ * パッケージが別なので定数は共有できず、両方を直す必要がある。
+ *
+ * HTTP ヘッダーは大文字小文字を問わないため綴りの違いは問題にならないが、
+ * **名前そのものを変えると片側だけ直したときに気づけない** — 送信は成功し続け、
+ * 受信側は識別子を読めないまま全データを「未分類」に落とす。
+ */
+export declare const PROJECT_HEADER = "X-Aidentity-Project";
+/** `vess otel-headers` が読む環境変数。CI や検証用の逃げ道として残す。 */
+export declare const TELEMETRY_API_KEY_ENV = "AIDENTITY_TELEMETRY_API_KEY";
+export declare function buildOtelHeaders(input: {
+    projectKey: string;
+    apiKey: string;
+}): Record<string, string>;
+//# sourceMappingURL=otel-headers.d.ts.map

package/dist/telemetry/otel-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel-headers.d.ts","sourceRoot":"","sources":["../../src/telemetry/otel-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,cAAc,CAAA;AAEzC;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,wBAAwB,CAAA;AAEnD,oDAAoD;AACpD,eAAO,MAAM,qBAAqB,gCAAgC,CAAA;AAElE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAKzB"}

package/dist/telemetry/otel-headers.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TELEMETRY_API_KEY_ENV = exports.PROJECT_HEADER = exports.API_KEY_HEADER = void 0;
+exports.buildOtelHeaders = buildOtelHeaders;
+/**
+ * テレメトリ送信に載せる HTTP ヘッダー。
+ *
+ * プロジェクト識別子をヘッダーで運ぶのは、コーディングエージェントのテレメトリに
+ * 作業ディレクトリやリポジトリを示す属性が無いため。サーバー側はここに載ってきた値を
+ * 読むだけで、推測しない。
+ *
+ * 設計: docs/specs/2026-08-28-agent-usage-analytics-design.md §4
+ */
+exports.API_KEY_HEADER = 'X-API-Key';
+/**
+ * 🔴 受信側の `PROJECT_HEADER`
+ * (`packages/api/src/telemetry-ingest/telemetry.constants.ts`) と**同じ名前**。
+ * パッケージが別なので定数は共有できず、両方を直す必要がある。
+ *
+ * HTTP ヘッダーは大文字小文字を問わないため綴りの違いは問題にならないが、
+ * **名前そのものを変えると片側だけ直したときに気づけない** — 送信は成功し続け、
+ * 受信側は識別子を読めないまま全データを「未分類」に落とす。
+ */
+exports.PROJECT_HEADER = 'X-Aidentity-Project';
+/** `vess otel-headers` が読む環境変数。CI や検証用の逃げ道として残す。 */
+exports.TELEMETRY_API_KEY_ENV = 'AIDENTITY_TELEMETRY_API_KEY';
+function buildOtelHeaders(input) {
+    return {
+        [exports.API_KEY_HEADER]: input.apiKey,
+        [exports.PROJECT_HEADER]: input.projectKey,
+    };
+}
+//# sourceMappingURL=otel-headers.js.map

package/dist/telemetry/otel-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel-headers.js","sourceRoot":"","sources":["../../src/telemetry/otel-headers.ts"],"names":[],"mappings":";;;AAyBA,4CAQC;AAjCD;;;;;;;;GAQG;AACU,QAAA,cAAc,GAAG,WAAW,CAAA;AAEzC;;;;;;;;GAQG;AACU,QAAA,cAAc,GAAG,qBAAqB,CAAA;AAEnD,oDAAoD;AACvC,QAAA,qBAAqB,GAAG,6BAA6B,CAAA;AAElE,SAAgB,gBAAgB,CAAC,KAGhC;IACC,OAAO;QACL,CAAC,sBAAc,CAAC,EAAE,KAAK,CAAC,MAAM;QAC9B,CAAC,sBAAc,CAAC,EAAE,KAAK,CAAC,UAAU;KACnC,CAAA;AACH,CAAC"}

package/dist/telemetry/project-key.d.ts

@@ -0,0 +1,12 @@
+/**
+ * 作業ディレクトリからプロジェクト識別子を決める。
+ *
+ * ディレクトリ名ではなく git remote を使うのは、worktree・クローン先のパス違い・
+ * ディレクトリ改名で同じリポジトリが別プロジェクトに割れるのを防ぐため。
+ *
+ * 設計: docs/specs/2026-08-28-agent-usage-analytics-design.md 判断 4-2
+ */
+export declare function resolveProjectKey(options?: {
+    cwd?: string;
+}): string;
+//# sourceMappingURL=project-key.d.ts.map

package/dist/telemetry/project-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-key.d.ts","sourceRoot":"","sources":["../../src/telemetry/project-key.ts"],"names":[],"mappings":"AAiEA;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,MAAM,CAQxE"}

package/dist/telemetry/project-key.js

@@ -0,0 +1,113 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveProjectKey = resolveProjectKey;
+const child_process_1 = require("child_process");
+const path = __importStar(require("path"));
+/**
+ * git 管理外の作業に付ける接頭辞。リポジトリ由来の識別子と混ざらないよう分けておき、
+ * console 側で「リポジトリに紐づかない作業」として別扱いできるようにする。
+ */
+const LOCAL_PREFIX = 'local:';
+/** `agent_usage_events.project_key` のカラム長に合わせる。 */
+const MAX_LENGTH = 255;
+/** helper は送信のたびに呼ばれるので、git が固まっても送信を止めない。 */
+const GIT_TIMEOUT_MS = 2000;
+/**
+ * remote URL から `owner/repo` を取り出す。
+ *
+ * 対応する書式:
+ *   git@github.com:owner/repo.git
+ *   https://github.com/owner/repo(.git)
+ *   https://user:token@github.com/owner/repo.git
+ *   ssh://git@host:2222/owner/repo.git
+ */
+function extractRepoPath(remote) {
+    const trimmed = remote.trim();
+    if (trimmed.length === 0)
+        return null;
+    let rest;
+    if (/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(trimmed)) {
+        // scheme://[userinfo@]host[:port]/path — 認証情報とポートは識別子に含めない
+        const afterScheme = trimmed.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//, '');
+        const slash = afterScheme.indexOf('/');
+        if (slash === -1)
+            return null;
+        rest = afterScheme.slice(slash + 1);
+    }
+    else {
+        // scp 形式 user@host:path。Windows のドライブレター (C:\...) と紛れないよう
+        // `@` を必須にしている
+        const match = /^[^/@]+@[^:/]+:(.*)$/.exec(trimmed);
+        if (!match)
+            return null;
+        rest = match[1];
+    }
+    const repoPath = rest
+        .replace(/\.git$/, '')
+        .replace(/^\/+/, '')
+        .replace(/\/+$/, '');
+    return repoPath.length > 0 ? repoPath : null;
+}
+function readOriginRemote(cwd) {
+    try {
+        return (0, child_process_1.execFileSync)('git', ['remote', 'get-url', 'origin'], {
+            cwd,
+            encoding: 'utf8',
+            timeout: GIT_TIMEOUT_MS,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+    }
+    catch {
+        // git が無い / リポジトリでない / origin が無い。いずれもフォールバックで扱う
+        return null;
+    }
+}
+/**
+ * 作業ディレクトリからプロジェクト識別子を決める。
+ *
+ * ディレクトリ名ではなく git remote を使うのは、worktree・クローン先のパス違い・
+ * ディレクトリ改名で同じリポジトリが別プロジェクトに割れるのを防ぐため。
+ *
+ * 設計: docs/specs/2026-08-28-agent-usage-analytics-design.md 判断 4-2
+ */
+function resolveProjectKey(options = {}) {
+    const cwd = options.cwd ?? process.cwd();
+    const remote = readOriginRemote(cwd);
+    const repoPath = remote ? extractRepoPath(remote) : null;
+    const key = repoPath ?? `${LOCAL_PREFIX}${path.basename(cwd)}`;
+    return key.slice(0, MAX_LENGTH);
+}
+//# sourceMappingURL=project-key.js.map

package/dist/telemetry/project-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-key.js","sourceRoot":"","sources":["../../src/telemetry/project-key.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyEA,8CAQC;AAjFD,iDAA4C;AAC5C,2CAA4B;AAE5B;;;GAGG;AACH,MAAM,YAAY,GAAG,QAAQ,CAAA;AAE7B,mDAAmD;AACnD,MAAM,UAAU,GAAG,GAAG,CAAA;AAEtB,8CAA8C;AAC9C,MAAM,cAAc,GAAG,IAAI,CAAA;AAE3B;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAErC,IAAI,IAAY,CAAA;IAChB,IAAI,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,2DAA2D;QAC3D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAA;QACxE,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACtC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;QAC7B,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IACrC,CAAC;SAAM,CAAC;QACN,0DAA0D;QAC1D,eAAe;QACf,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAClD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI;SAClB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;SACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAEtB,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;AAC9C,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,OAAO,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE;YAC1D,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,cAAc;YACvB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;QACjD,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,iBAAiB,CAAC,UAA4B,EAAE;IAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;IAExC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAExD,MAAM,GAAG,GAAG,QAAQ,IAAI,GAAG,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAA;IAC9D,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;AACjC,CAAC"}