@vess-id/vess 0.2.0-alpha.1

package/dist/core/execution-engine.d.ts

@@ -0,0 +1,119 @@
+import { PolicyEvaluator } from '../policy/policy-evaluator';
+import { Wallet } from '../wallet/wallet';
+import { VPBuilder } from '../wallet/vp-builder';
+import { AuditLogger } from '../audit/audit-logger';
+import { AgentdGatewayClient } from '../gateway/gateway-client';
+import { ApprovalTokenService } from '../approval/approval-token';
+import { ExecuteRequest, ExecuteResult, ListToolsResult, ExecutionContext } from './types';
+import { SecretBackend } from '../env/secret-backend';
+export declare class ExecutionEngine {
+    private readonly policyEvaluator;
+    private readonly wallet;
+    private readonly vpBuilder;
+    private readonly auditLogger;
+    private readonly gatewayClient;
+    private readonly context;
+    private readonly tokenService;
+    private readonly secretBackend?;
+    private lastPolicySyncTime;
+    private clientInfo?;
+    private agentRegistered;
+    private recentOOBRequests;
+    private static readonly OOB_COOLDOWN_MS;
+    private static readonly OOB_MAP_MAX_SIZE;
+    constructor(policyEvaluator: PolicyEvaluator, wallet: Wallet, vpBuilder: VPBuilder, auditLogger: AuditLogger | null, gatewayClient: AgentdGatewayClient, context: ExecutionContext, tokenService: ApprovalTokenService, secretBackend?: SecretBackend | undefined);
+    /**
+     * Record a successful policy sync timestamp (called by SyncScheduler).
+     */
+    setLastPolicySyncTime(time: number): void;
+    /**
+     * Set MCP client info (from oninitialized callback).
+     * Used to derive a meaningful agent name for deferred registration.
+     */
+    setClientInfo(info: {
+        name: string;
+        version: string;
+    }): void;
+    /**
+     * Ensure the agent is registered in the API.
+     * Called lazily on first tool execution (fire-and-forget).
+     * Uses clientInfo from MCP initialize handshake if available.
+     */
+    private ensureAgentRegistered;
+    /**
+     * Execute an action request.
+     * This is the single entry point for all adapters (MCP, future IDE, SDK).
+     */
+    execute(request: ExecuteRequest): Promise<ExecuteResult>;
+    /**
+     * Ensure a valid VC exists for the requested action.
+     * Follows the 4-step acquisition flow from spec §6.1:
+     *
+     * Step 1: Check wallet for valid VC (verify revocation via Gateway using VC jti)
+     * Step 2: Check Gateway for approved requests
+     * Step 3: Try auto-issue via Gateway
+     * Step 4: Terminal approval prompt -> quick-approve via Gateway
+     */
+    private ensureVC;
+    private executeLocal;
+    /**
+     * Execute locally with an already-acquired VC (skips ensureVC).
+     * Used by both the normal path (after ensureVC) and handleApprovalResponse (after quickApprove).
+     */
+    private executeLocalWithVC;
+    /**
+     * Execute locally when Gateway is unreachable.
+     * All 4 conditions from spec §7.6 must be true:
+     * 1. Valid cached VC exists
+     * 2. VC not expired
+     * 3. Synced org policy not stale (30 min TTL)
+     * 4. Local policy does not deny
+     */
+    private executeLocalOffline;
+    private executeViaGateway;
+    private executeViaGatewayWithVC;
+    /**
+     * Handle a re-invocation with pendingRequestId (OOB approval polling).
+     */
+    private handlePendingApproval;
+    /**
+     * Create an OOB approval request for high/critical risk actions.
+     * Returns a URL for the user to approve in their browser.
+     */
+    private createOOBApprovalRequest;
+    /**
+     * Create an in-band approval response for low/medium risk actions.
+     * Generates an approval token for the MCP client to present back.
+     */
+    private createInBandApprovalResponse;
+    /**
+     * Pre-request permissions for multiple actions (batch).
+     * Triggers VC acquisition for each action without executing.
+     * This allows the user to approve multiple actions at once.
+     */
+    requestPermissions(actions: string[]): Promise<ExecuteResult>;
+    listAvailableTools(): Promise<ListToolsResult>;
+    /**
+     * Resolve env vars for os.process.run from .env file.
+     * Returns empty record if no env_profile specified or .env not found.
+     */
+    private resolveProcessEnv;
+    private getActionRiskLevel;
+    private getDefaultVCTTL;
+    private handleApprovalResponse;
+    private getResourceType;
+    /**
+     * Extract specific resource ID from action input using ACTION_REGISTRY target_bindings.
+     * For gateway (SaaS) actions, the resource ID (e.g., channel ID) is in the input parameters.
+     * Returns undefined for actions without param-sourced bindings or when the param is absent
+     * (e.g., target_bindings with required: false).
+     */
+    private extractResourceIdFromInput;
+    private isRecentOOBRequest;
+    private trackOOBRequest;
+    /** Verify a wallet VC: check revocation via Gateway, handle expiry. Returns the VC if valid, null if invalid. */
+    private verifyWalletVC;
+    private handleResourceMismatch;
+    private logAudit;
+}
+//# sourceMappingURL=execution-engine.d.ts.map

package/dist/core/execution-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-engine.d.ts","sourceRoot":"","sources":["../../src/core/execution-engine.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAC5D,OAAO,EAAE,MAAM,EAAuC,MAAM,kBAAkB,CAAA;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAuB,MAAM,2BAA2B,CAAA;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAKjE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,gBAAgB,EAA0E,MAAM,SAAS,CAAA;AAElK,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAmCrD,qBAAa,eAAe;IASxB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAfjC,OAAO,CAAC,kBAAkB,CAAsB;IAChD,OAAO,CAAC,UAAU,CAAC,CAAmC;IACtD,OAAO,CAAC,eAAe,CAAQ;IAC/B,OAAO,CAAC,iBAAiB,CAA4B;IACrD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAS;IAChD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAO;gBAG5B,eAAe,EAAE,eAAe,EAChC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,WAAW,GAAG,IAAI,EAC/B,aAAa,EAAE,mBAAmB,EAClC,OAAO,EAAE,gBAAgB,EACzB,YAAY,EAAE,oBAAoB,EAClC,aAAa,CAAC,EAAE,aAAa,YAAA;IAGhD;;OAEG;IACH,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIzC;;;OAGG;IACH,aAAa,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAI5D;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IA6B7B;;;OAGG;IACG,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAkF9D;;;;;;;;OAQG;YACW,QAAQ;YA8GR,YAAY;IAuC1B;;;OAGG;YACW,kBAAkB;IA4IhC;;;;;;;OAOG;YACW,mBAAmB;YA2GnB,iBAAiB;YAiDjB,uBAAuB;IAwFrC;;OAEG;YACW,qBAAqB;IA8HnC;;;OAGG;YACW,wBAAwB;IAyCtC;;;OAGG;IACH,OAAO,CAAC,4BAA4B;IAgDpC;;;;OAIG;IACG,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAmH7D,kBAAkB,IAAI,OAAO,CAAC,eAAe,CAAC;IAWpD;;;OAGG;YACW,iBAAiB;IA8B/B,OAAO,CAAC,kBAAkB;IAS1B,OAAO,CAAC,eAAe;YAUT,sBAAsB;IA0JpC,OAAO,CAAC,eAAe;IASvB;;;;;OAKG;IACH,OAAO,CAAC,0BAA0B;IAiBlC,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,eAAe;IAavB,iHAAiH;YACnG,cAAc;YA4Bd,sBAAsB;IAsCpC,OAAO,CAAC,QAAQ;CAqCjB"}