@coolwithakay/uatp 0.1.0

package/dist/index.mjs

@@ -0,0 +1,406 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/crypto.ts
+import * as ed from "@noble/ed25519";
+import { sha256 } from "@noble/hashes/sha256";
+import { pbkdf2 } from "@noble/hashes/pbkdf2";
+import { bytesToHex, hexToBytes } from "@noble/hashes/utils";
+ed.etc.sha512Sync = (...m) => {
+  const { sha512 } = __require("@noble/hashes/sha512");
+  return sha512(ed.etc.concatBytes(...m));
+};
+var PBKDF2_ITERATIONS = 48e4;
+var SALT_PREFIX = "uatp-v1-key-derivation";
+function deriveKeyPair(passphrase) {
+  const salt = new TextEncoder().encode(SALT_PREFIX);
+  const passphraseBytes = new TextEncoder().encode(passphrase);
+  const seed = pbkdf2(sha256, passphraseBytes, salt, {
+    c: PBKDF2_ITERATIONS,
+    dkLen: 32
+  });
+  const privateKey = seed;
+  const publicKey = ed.getPublicKey(privateKey);
+  return { privateKey, publicKey };
+}
+function deriveDevicePassphrase() {
+  const factors = [];
+  if (typeof window !== "undefined") {
+    factors.push(window.navigator.userAgent);
+    factors.push(window.navigator.language);
+    factors.push(String(window.screen.width));
+    factors.push(String(window.screen.height));
+    factors.push(window.location.hostname);
+  } else if (typeof process !== "undefined") {
+    factors.push(process.platform);
+    factors.push(process.arch);
+    factors.push(process.env.USER || process.env.USERNAME || "");
+    factors.push(__require("os").hostname());
+  }
+  const combined = factors.join(":");
+  const hash = sha256(new TextEncoder().encode(combined));
+  return `device_${bytesToHex(hash).slice(0, 32)}`;
+}
+function canonicalize(obj) {
+  return JSON.stringify(obj, Object.keys(obj).sort());
+}
+function hashContent(content) {
+  const canonical = canonicalize(content);
+  const hash = sha256(new TextEncoder().encode(canonical));
+  return bytesToHex(hash);
+}
+function sign2(content, privateKey) {
+  const canonical = canonicalize(content);
+  const messageBytes = new TextEncoder().encode(canonical);
+  const signature = ed.sign(messageBytes, privateKey);
+  return bytesToHex(signature);
+}
+function verify2(content, signature, publicKey) {
+  try {
+    const canonical = canonicalize(content);
+    const messageBytes = new TextEncoder().encode(canonical);
+    const signatureBytes = hexToBytes(signature);
+    const publicKeyBytes = hexToBytes(publicKey);
+    return ed.verify(signatureBytes, messageBytes, publicKeyBytes);
+  } catch {
+    return false;
+  }
+}
+function generateCapsuleId() {
+  const timestamp = Date.now().toString(36);
+  const randomBytes = new Uint8Array(8);
+  if (typeof crypto !== "undefined" && crypto.getRandomValues) {
+    crypto.getRandomValues(randomBytes);
+  } else {
+    const { randomBytes: nodeRandom } = __require("crypto");
+    const buf = nodeRandom(8);
+    randomBytes.set(buf);
+  }
+  const random = bytesToHex(randomBytes).slice(0, 8);
+  return `cap_${timestamp}_${random}`;
+}
+function createSignedCapsule(content, keyPair) {
+  const capsuleId = generateCapsuleId();
+  const contentHash = hashContent(content);
+  const signature = sign2(content, keyPair.privateKey);
+  const publicKey = bytesToHex(keyPair.publicKey);
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+  return {
+    capsuleId,
+    signature,
+    publicKey,
+    contentHash,
+    timestamp,
+    content
+  };
+}
+function verifyCapsule(capsule) {
+  const errors = [];
+  const computedHash = hashContent(capsule.content);
+  const hashValid = computedHash === capsule.contentHash;
+  if (!hashValid) {
+    errors.push("Content hash mismatch - capsule may have been tampered with");
+  }
+  const signatureValid = verify2(
+    capsule.content,
+    capsule.signature,
+    capsule.publicKey
+  );
+  if (!signatureValid) {
+    errors.push("Signature verification failed");
+  }
+  return {
+    valid: hashValid && signatureValid,
+    signatureValid,
+    hashValid,
+    errors
+  };
+}
+
+// src/client.ts
+var DEFAULT_BASE_URL = "http://localhost:8000";
+var DEFAULT_TIMEOUT = 3e4;
+var SDK_VERSION = "0.1.0";
+var UATP = class {
+  /**
+   * Initialize UATP client.
+   *
+   * @example
+   * ```typescript
+   * // Local development
+   * const client = new UATP();
+   *
+   * // Production
+   * const client = new UATP({
+   *   apiKey: 'your-api-key',
+   *   baseUrl: 'https://api.uatp.io'
+   * });
+   * ```
+   */
+  constructor(config = {}) {
+    this.apiKey = config.apiKey;
+    this.baseUrl = (config.baseUrl || DEFAULT_BASE_URL).replace(/\/$/, "");
+    this.timeout = config.timeout || DEFAULT_TIMEOUT;
+    if (this.baseUrl === DEFAULT_BASE_URL) {
+      console.warn("UATP client using localhost - set baseUrl for production");
+    }
+  }
+  /**
+   * Create a cryptographically certified capsule for an AI decision.
+   *
+   * ZERO-TRUST: Private key NEVER leaves your device.
+   * - All signing happens locally using Ed25519
+   * - Only the content hash is sent to UATP for timestamping
+   * - Capsules can be verified independently without UATP
+   *
+   * @example
+   * ```typescript
+   * const result = await client.certify({
+   *   task: 'Loan decision',
+   *   decision: 'Approved for $50,000 at 5.2% APR',
+   *   reasoning: [
+   *     { step: 1, thought: 'Credit score 720 (excellent)', confidence: 0.95 },
+   *     { step: 2, thought: 'Debt-to-income 0.28 (acceptable)', confidence: 0.90 }
+   *   ]
+   * });
+   *
+   * console.log(result.capsuleId);
+   * console.log(result.signature);
+   * ```
+   */
+  async certify(options) {
+    const {
+      task,
+      decision,
+      reasoning,
+      passphrase,
+      deviceBound = true,
+      confidence,
+      metadata = {},
+      requestTimestamp = true,
+      storeOnServer = false
+    } = options;
+    if (!task || typeof task !== "string") {
+      throw new Error("task must be a non-empty string");
+    }
+    if (!decision || typeof decision !== "string") {
+      throw new Error("decision must be a non-empty string");
+    }
+    if (!reasoning || !Array.isArray(reasoning) || reasoning.length === 0) {
+      throw new Error("reasoning must be a non-empty array");
+    }
+    let signingPassphrase;
+    if (passphrase) {
+      if (passphrase.length < 8) {
+        throw new Error("passphrase must be at least 8 characters");
+      }
+      signingPassphrase = passphrase;
+    } else if (deviceBound) {
+      console.warn(
+        "Using device-bound passphrase (DEVELOPMENT ONLY). For production, provide an explicit passphrase."
+      );
+      signingPassphrase = deriveDevicePassphrase();
+    } else {
+      throw new Error("Either provide a passphrase or set deviceBound=true");
+    }
+    const calculatedConfidence = confidence ?? reasoning.reduce((sum, step) => sum + (step.confidence || 0.5), 0) / reasoning.length;
+    const content = {
+      task,
+      decision,
+      reasoning_chain: reasoning,
+      confidence: calculatedConfidence,
+      metadata: {
+        ...metadata,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        sdk_version: SDK_VERSION,
+        signing_mode: "local"
+      }
+    };
+    const keyPair = deriveKeyPair(signingPassphrase);
+    const signed = createSignedCapsule(content, keyPair);
+    if (requestTimestamp) {
+      try {
+        const response = await this.fetch("/timestamp", {
+          method: "POST",
+          body: JSON.stringify({ hash: signed.contentHash })
+        });
+        if (response.ok) {
+          const tsData = await response.json();
+          signed.timestampToken = tsData.rfc3161;
+          signed.timestampTsa = tsData.tsa;
+        }
+      } catch (error) {
+        console.warn(
+          "Could not obtain timestamp. Capsule is still valid, just without external timestamp.",
+          error
+        );
+      }
+    }
+    if (storeOnServer) {
+      try {
+        const capsuleData = {
+          ...signed,
+          type: "reasoning_trace",
+          payload: content
+        };
+        const response = await this.fetch("/capsules/store", {
+          method: "POST",
+          body: JSON.stringify(capsuleData)
+        });
+        if (response.ok) {
+          signed.serverStored = true;
+          signed.proofUrl = `${this.baseUrl}/capsules/${signed.capsuleId}/verify`;
+        }
+      } catch (error) {
+        console.warn("Could not store on server. Capsule is still valid locally.", error);
+        signed.serverStored = false;
+      }
+    }
+    return signed;
+  }
+  /**
+   * Retrieve full cryptographic proof for a capsule.
+   *
+   * @example
+   * ```typescript
+   * const proof = await client.getProof('cap_abc123');
+   * console.log(proof.payload.task);
+   * ```
+   */
+  async getProof(capsuleId) {
+    const response = await this.fetch(`/capsules/${capsuleId}`);
+    if (!response.ok) {
+      if (response.status === 404) {
+        throw new Error(`Capsule ${capsuleId} not found`);
+      }
+      throw new Error(`Failed to retrieve proof: ${response.status}`);
+    }
+    const data = await response.json();
+    const capsule = data.capsule || data;
+    return {
+      capsuleId: capsule.capsule_id || capsule.id || capsuleId,
+      capsuleType: capsule.type || capsule.capsule_type || "unknown",
+      status: capsule.status || "unknown",
+      timestamp: new Date(capsule.timestamp),
+      payload: capsule.payload || {},
+      rawData: data
+    };
+  }
+  /**
+   * List capsules from the server.
+   *
+   * @example
+   * ```typescript
+   * const capsules = await client.listCapsules(10);
+   * for (const cap of capsules) {
+   *   console.log(cap.capsuleId, cap.status);
+   * }
+   * ```
+   */
+  async listCapsules(limit = 10) {
+    const response = await this.fetch(`/capsules?demo_mode=false&per_page=${limit}`);
+    if (!response.ok) {
+      throw new Error(`Failed to list capsules: ${response.status}`);
+    }
+    const data = await response.json();
+    return (data.capsules || []).slice(0, limit).map((item) => ({
+      capsuleId: item.capsule_id,
+      capsuleType: item.type || "unknown",
+      status: item.status || "unknown",
+      timestamp: new Date(item.timestamp),
+      payload: item.payload || {},
+      rawData: item
+    }));
+  }
+  /**
+   * Verify a capsule locally without server.
+   *
+   * This can be done by anyone - no UATP infrastructure required.
+   * Only uses cryptographic data embedded in the capsule.
+   *
+   * @example
+   * ```typescript
+   * const result = client.verifyLocal(capsule);
+   * if (result.valid) {
+   *   console.log('Capsule is authentic!');
+   * }
+   * ```
+   */
+  verifyLocal(capsule) {
+    return verifyCapsule(capsule);
+  }
+  /**
+   * Record the actual outcome of an AI decision (ground truth).
+   *
+   * @example
+   * ```typescript
+   * await client.recordOutcome('cap_abc123', {
+   *   result: 'successful',
+   *   aiWasCorrect: true,
+   *   financialImpact: 2500,
+   *   notes: 'Loan fully paid on time'
+   * });
+   * ```
+   */
+  async recordOutcome(capsuleId, outcome) {
+    const params = new URLSearchParams();
+    if (outcome.result) params.set("outcome_status", outcome.result);
+    if (outcome.notes) params.set("notes", outcome.notes);
+    if (outcome.customerSatisfaction) {
+      params.set("rating", String(outcome.customerSatisfaction));
+    }
+    const response = await this.fetch(
+      `/capsules/${capsuleId}/outcome?${params.toString()}`,
+      { method: "POST" }
+    );
+    if (response.status === 401) {
+      throw new Error("Authentication required. Outcome tracking requires a valid API key.");
+    }
+    if (response.status === 404) {
+      throw new Error(`Capsule ${capsuleId} not found`);
+    }
+    if (!response.ok) {
+      throw new Error(`Failed to record outcome: ${response.status}`);
+    }
+    return true;
+  }
+  /**
+   * Internal fetch wrapper with timeout and headers.
+   */
+  async fetch(path, options = {}) {
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), this.timeout);
+    try {
+      const response = await fetch(`${this.baseUrl}${path}`, {
+        ...options,
+        signal: controller.signal,
+        headers: {
+          "Content-Type": "application/json",
+          "User-Agent": `uatp-typescript-sdk/${SDK_VERSION}`,
+          ...this.apiKey ? { Authorization: `Bearer ${this.apiKey}` } : {},
+          ...options.headers
+        }
+      });
+      return response;
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+};
+export {
+  UATP,
+  bytesToHex,
+  canonicalize,
+  createSignedCapsule,
+  deriveDevicePassphrase,
+  deriveKeyPair,
+  hashContent,
+  hexToBytes,
+  sign2 as sign,
+  verify2 as verify,
+  verifyCapsule
+};

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@coolwithakay/uatp",
+  "version": "0.1.0",
+  "description": "Cryptographic audit trails for AI decisions",
+  "main": "dist/index.js",
+  "module": "dist/index.mjs",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "require": "./dist/index.js",
+      "import": "./dist/index.mjs",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsup src/index.ts --format cjs,esm --dts",
+    "dev": "tsup src/index.ts --format cjs,esm --dts --watch",
+    "test": "vitest",
+    "lint": "eslint src/",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "uatp",
+    "ai",
+    "audit",
+    "cryptography",
+    "ed25519",
+    "signatures",
+    "reasoning",
+    "compliance"
+  ],
+  "author": "UATP Team",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/KayronCalloway/uatp.git",
+    "directory": "sdk/typescript"
+  },
+  "homepage": "https://github.com/KayronCalloway/uatp#readme",
+  "bugs": {
+    "url": "https://github.com/KayronCalloway/uatp/issues"
+  },
+  "dependencies": {
+    "@noble/ed25519": "^2.1.0",
+    "@noble/hashes": "^1.4.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "tsup": "^8.0.0",
+    "typescript": "^5.0.0",
+    "vitest": "^1.0.0"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}