@kya-os/contracts 1.5.3-canary.10 → 1.5.3-canary.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/audit/index.d.ts +193 -0
- package/dist/audit/index.js +92 -0
- package/dist/index.d.ts +1 -0
- package/dist/index.js +2 -0
- package/package.json +6 -1
|
@@ -0,0 +1,193 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Audit Types and Schemas
|
|
3
|
+
*
|
|
4
|
+
* Types and Zod schemas for audit logging in the MCP-I framework.
|
|
5
|
+
* These types are platform-agnostic and used across all implementations.
|
|
6
|
+
*/
|
|
7
|
+
import { z } from "zod";
|
|
8
|
+
import type { AgentIdentity } from "../config/identity.js";
|
|
9
|
+
import type { SessionContext } from "../handshake.js";
|
|
10
|
+
/**
|
|
11
|
+
* Audit context schema for logging audit records
|
|
12
|
+
*
|
|
13
|
+
* Contains all metadata needed to generate an audit record.
|
|
14
|
+
* Privacy Note: Only metadata is extracted from these objects.
|
|
15
|
+
* The identity's private key, session's nonce, and other sensitive
|
|
16
|
+
* fields are NEVER included in the audit log.
|
|
17
|
+
*/
|
|
18
|
+
export declare const AuditContextSchema: z.ZodObject<{
|
|
19
|
+
/**
|
|
20
|
+
* Agent identity
|
|
21
|
+
* Only `did` and `keyId` are logged. Private key is NEVER logged.
|
|
22
|
+
*/
|
|
23
|
+
identity: z.ZodObject<{
|
|
24
|
+
did: z.ZodString;
|
|
25
|
+
kid: z.ZodString;
|
|
26
|
+
}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
|
|
27
|
+
did: z.ZodString;
|
|
28
|
+
kid: z.ZodString;
|
|
29
|
+
}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
|
|
30
|
+
did: z.ZodString;
|
|
31
|
+
kid: z.ZodString;
|
|
32
|
+
}, z.ZodTypeAny, "passthrough">>;
|
|
33
|
+
/**
|
|
34
|
+
* Session context
|
|
35
|
+
* Only `sessionId` and `audience` are logged. Nonce is NEVER logged.
|
|
36
|
+
*/
|
|
37
|
+
session: z.ZodObject<{
|
|
38
|
+
sessionId: z.ZodString;
|
|
39
|
+
audience: z.ZodString;
|
|
40
|
+
}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
|
|
41
|
+
sessionId: z.ZodString;
|
|
42
|
+
audience: z.ZodString;
|
|
43
|
+
}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
|
|
44
|
+
sessionId: z.ZodString;
|
|
45
|
+
audience: z.ZodString;
|
|
46
|
+
}, z.ZodTypeAny, "passthrough">>;
|
|
47
|
+
/**
|
|
48
|
+
* Request hash (SHA-256 with `sha256:` prefix)
|
|
49
|
+
*/
|
|
50
|
+
requestHash: z.ZodString;
|
|
51
|
+
/**
|
|
52
|
+
* Response hash (SHA-256 with `sha256:` prefix)
|
|
53
|
+
*/
|
|
54
|
+
responseHash: z.ZodString;
|
|
55
|
+
/**
|
|
56
|
+
* Verification result
|
|
57
|
+
* - 'yes': Proof was verified successfully
|
|
58
|
+
* - 'no': Proof verification failed
|
|
59
|
+
*/
|
|
60
|
+
verified: z.ZodEnum<["yes", "no"]>;
|
|
61
|
+
/**
|
|
62
|
+
* Optional scope identifier
|
|
63
|
+
* Application-level scope (e.g., 'orders.create', 'users.read').
|
|
64
|
+
* If not provided, '-' is used in the audit log.
|
|
65
|
+
*/
|
|
66
|
+
scopeId: z.ZodOptional<z.ZodString>;
|
|
67
|
+
}, "strip", z.ZodTypeAny, {
|
|
68
|
+
identity: {
|
|
69
|
+
did: string;
|
|
70
|
+
kid: string;
|
|
71
|
+
} & {
|
|
72
|
+
[k: string]: unknown;
|
|
73
|
+
};
|
|
74
|
+
session: {
|
|
75
|
+
sessionId: string;
|
|
76
|
+
audience: string;
|
|
77
|
+
} & {
|
|
78
|
+
[k: string]: unknown;
|
|
79
|
+
};
|
|
80
|
+
requestHash: string;
|
|
81
|
+
responseHash: string;
|
|
82
|
+
verified: "yes" | "no";
|
|
83
|
+
scopeId?: string | undefined;
|
|
84
|
+
}, {
|
|
85
|
+
identity: {
|
|
86
|
+
did: string;
|
|
87
|
+
kid: string;
|
|
88
|
+
} & {
|
|
89
|
+
[k: string]: unknown;
|
|
90
|
+
};
|
|
91
|
+
session: {
|
|
92
|
+
sessionId: string;
|
|
93
|
+
audience: string;
|
|
94
|
+
} & {
|
|
95
|
+
[k: string]: unknown;
|
|
96
|
+
};
|
|
97
|
+
requestHash: string;
|
|
98
|
+
responseHash: string;
|
|
99
|
+
verified: "yes" | "no";
|
|
100
|
+
scopeId?: string | undefined;
|
|
101
|
+
}>;
|
|
102
|
+
export type AuditContext = {
|
|
103
|
+
identity: AgentIdentity;
|
|
104
|
+
session: SessionContext;
|
|
105
|
+
requestHash: string;
|
|
106
|
+
responseHash: string;
|
|
107
|
+
verified: "yes" | "no";
|
|
108
|
+
scopeId?: string;
|
|
109
|
+
};
|
|
110
|
+
/**
|
|
111
|
+
* Event context schema for logging events that bypass session deduplication
|
|
112
|
+
*
|
|
113
|
+
* Used for consent events where multiple events occur in the same session.
|
|
114
|
+
* Unlike AuditContext, this allows multiple events per session.
|
|
115
|
+
*/
|
|
116
|
+
export declare const AuditEventContextSchema: z.ZodObject<{
|
|
117
|
+
/**
|
|
118
|
+
* Event type identifier
|
|
119
|
+
* @example "consent:page_viewed", "consent:approved", "runtime:initialized"
|
|
120
|
+
*/
|
|
121
|
+
eventType: z.ZodString;
|
|
122
|
+
/**
|
|
123
|
+
* Agent identity
|
|
124
|
+
* Only `did` and `keyId` are logged. Private key is NEVER logged.
|
|
125
|
+
*/
|
|
126
|
+
identity: z.ZodObject<{
|
|
127
|
+
did: z.ZodString;
|
|
128
|
+
kid: z.ZodString;
|
|
129
|
+
}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
|
|
130
|
+
did: z.ZodString;
|
|
131
|
+
kid: z.ZodString;
|
|
132
|
+
}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
|
|
133
|
+
did: z.ZodString;
|
|
134
|
+
kid: z.ZodString;
|
|
135
|
+
}, z.ZodTypeAny, "passthrough">>;
|
|
136
|
+
/**
|
|
137
|
+
* Session context
|
|
138
|
+
* Only `sessionId` and `audience` are logged. Nonce is NEVER logged.
|
|
139
|
+
*/
|
|
140
|
+
session: z.ZodObject<{
|
|
141
|
+
sessionId: z.ZodString;
|
|
142
|
+
audience: z.ZodString;
|
|
143
|
+
}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
|
|
144
|
+
sessionId: z.ZodString;
|
|
145
|
+
audience: z.ZodString;
|
|
146
|
+
}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
|
|
147
|
+
sessionId: z.ZodString;
|
|
148
|
+
audience: z.ZodString;
|
|
149
|
+
}, z.ZodTypeAny, "passthrough">>;
|
|
150
|
+
/**
|
|
151
|
+
* Optional event-specific data
|
|
152
|
+
* Used for generating event hash. Not logged directly.
|
|
153
|
+
*/
|
|
154
|
+
eventData: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
|
|
155
|
+
}, "strip", z.ZodTypeAny, {
|
|
156
|
+
identity: {
|
|
157
|
+
did: string;
|
|
158
|
+
kid: string;
|
|
159
|
+
} & {
|
|
160
|
+
[k: string]: unknown;
|
|
161
|
+
};
|
|
162
|
+
session: {
|
|
163
|
+
sessionId: string;
|
|
164
|
+
audience: string;
|
|
165
|
+
} & {
|
|
166
|
+
[k: string]: unknown;
|
|
167
|
+
};
|
|
168
|
+
eventType: string;
|
|
169
|
+
eventData?: Record<string, unknown> | undefined;
|
|
170
|
+
}, {
|
|
171
|
+
identity: {
|
|
172
|
+
did: string;
|
|
173
|
+
kid: string;
|
|
174
|
+
} & {
|
|
175
|
+
[k: string]: unknown;
|
|
176
|
+
};
|
|
177
|
+
session: {
|
|
178
|
+
sessionId: string;
|
|
179
|
+
audience: string;
|
|
180
|
+
} & {
|
|
181
|
+
[k: string]: unknown;
|
|
182
|
+
};
|
|
183
|
+
eventType: string;
|
|
184
|
+
eventData?: Record<string, unknown> | undefined;
|
|
185
|
+
}>;
|
|
186
|
+
export type AuditEventContext = {
|
|
187
|
+
eventType: string;
|
|
188
|
+
identity: AgentIdentity;
|
|
189
|
+
session: SessionContext;
|
|
190
|
+
eventData?: Record<string, any>;
|
|
191
|
+
};
|
|
192
|
+
export type { AuditRecord } from "../proof.js";
|
|
193
|
+
export { AuditRecordSchema } from "../proof.js";
|
|
@@ -0,0 +1,92 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
/**
|
|
3
|
+
* Audit Types and Schemas
|
|
4
|
+
*
|
|
5
|
+
* Types and Zod schemas for audit logging in the MCP-I framework.
|
|
6
|
+
* These types are platform-agnostic and used across all implementations.
|
|
7
|
+
*/
|
|
8
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
9
|
+
exports.AuditRecordSchema = exports.AuditEventContextSchema = exports.AuditContextSchema = void 0;
|
|
10
|
+
const zod_1 = require("zod");
|
|
11
|
+
/**
|
|
12
|
+
* Audit context schema for logging audit records
|
|
13
|
+
*
|
|
14
|
+
* Contains all metadata needed to generate an audit record.
|
|
15
|
+
* Privacy Note: Only metadata is extracted from these objects.
|
|
16
|
+
* The identity's private key, session's nonce, and other sensitive
|
|
17
|
+
* fields are NEVER included in the audit log.
|
|
18
|
+
*/
|
|
19
|
+
exports.AuditContextSchema = zod_1.z.object({
|
|
20
|
+
/**
|
|
21
|
+
* Agent identity
|
|
22
|
+
* Only `did` and `keyId` are logged. Private key is NEVER logged.
|
|
23
|
+
*/
|
|
24
|
+
identity: zod_1.z.object({
|
|
25
|
+
did: zod_1.z.string().min(1),
|
|
26
|
+
kid: zod_1.z.string().min(1),
|
|
27
|
+
}).passthrough(), // Allow additional fields but only did/kid are used
|
|
28
|
+
/**
|
|
29
|
+
* Session context
|
|
30
|
+
* Only `sessionId` and `audience` are logged. Nonce is NEVER logged.
|
|
31
|
+
*/
|
|
32
|
+
session: zod_1.z.object({
|
|
33
|
+
sessionId: zod_1.z.string().min(1),
|
|
34
|
+
audience: zod_1.z.string().min(1),
|
|
35
|
+
}).passthrough(), // Allow additional fields but only sessionId/audience are used
|
|
36
|
+
/**
|
|
37
|
+
* Request hash (SHA-256 with `sha256:` prefix)
|
|
38
|
+
*/
|
|
39
|
+
requestHash: zod_1.z.string().regex(/^sha256:[a-f0-9]{64}$/),
|
|
40
|
+
/**
|
|
41
|
+
* Response hash (SHA-256 with `sha256:` prefix)
|
|
42
|
+
*/
|
|
43
|
+
responseHash: zod_1.z.string().regex(/^sha256:[a-f0-9]{64}$/),
|
|
44
|
+
/**
|
|
45
|
+
* Verification result
|
|
46
|
+
* - 'yes': Proof was verified successfully
|
|
47
|
+
* - 'no': Proof verification failed
|
|
48
|
+
*/
|
|
49
|
+
verified: zod_1.z.enum(["yes", "no"]),
|
|
50
|
+
/**
|
|
51
|
+
* Optional scope identifier
|
|
52
|
+
* Application-level scope (e.g., 'orders.create', 'users.read').
|
|
53
|
+
* If not provided, '-' is used in the audit log.
|
|
54
|
+
*/
|
|
55
|
+
scopeId: zod_1.z.string().optional(),
|
|
56
|
+
});
|
|
57
|
+
/**
|
|
58
|
+
* Event context schema for logging events that bypass session deduplication
|
|
59
|
+
*
|
|
60
|
+
* Used for consent events where multiple events occur in the same session.
|
|
61
|
+
* Unlike AuditContext, this allows multiple events per session.
|
|
62
|
+
*/
|
|
63
|
+
exports.AuditEventContextSchema = zod_1.z.object({
|
|
64
|
+
/**
|
|
65
|
+
* Event type identifier
|
|
66
|
+
* @example "consent:page_viewed", "consent:approved", "runtime:initialized"
|
|
67
|
+
*/
|
|
68
|
+
eventType: zod_1.z.string().min(1),
|
|
69
|
+
/**
|
|
70
|
+
* Agent identity
|
|
71
|
+
* Only `did` and `keyId` are logged. Private key is NEVER logged.
|
|
72
|
+
*/
|
|
73
|
+
identity: zod_1.z.object({
|
|
74
|
+
did: zod_1.z.string().min(1),
|
|
75
|
+
kid: zod_1.z.string().min(1),
|
|
76
|
+
}).passthrough(), // Allow additional fields but only did/kid are used
|
|
77
|
+
/**
|
|
78
|
+
* Session context
|
|
79
|
+
* Only `sessionId` and `audience` are logged. Nonce is NEVER logged.
|
|
80
|
+
*/
|
|
81
|
+
session: zod_1.z.object({
|
|
82
|
+
sessionId: zod_1.z.string().min(1),
|
|
83
|
+
audience: zod_1.z.string().min(1),
|
|
84
|
+
}).passthrough(), // Allow additional fields but only sessionId/audience are used
|
|
85
|
+
/**
|
|
86
|
+
* Optional event-specific data
|
|
87
|
+
* Used for generating event hash. Not logged directly.
|
|
88
|
+
*/
|
|
89
|
+
eventData: zod_1.z.record(zod_1.z.unknown()).optional(),
|
|
90
|
+
});
|
|
91
|
+
var proof_js_1 = require("../proof.js");
|
|
92
|
+
Object.defineProperty(exports, "AuditRecordSchema", { enumerable: true, get: function () { return proof_js_1.AuditRecordSchema; } });
|
package/dist/index.d.ts
CHANGED
|
@@ -21,5 +21,6 @@ export * from "./test.js";
|
|
|
21
21
|
export * from "./utils/validation.js";
|
|
22
22
|
export * from "./vc/index.js";
|
|
23
23
|
export * from "./delegation/index.js";
|
|
24
|
+
export * from "./audit/index.js";
|
|
24
25
|
export declare const CONTRACTS_VERSION = "1.2.1";
|
|
25
26
|
export declare const SUPPORTED_XMCP_I_VERSION = "^1.0.0";
|
package/dist/index.js
CHANGED
|
@@ -40,6 +40,8 @@ __exportStar(require("./utils/validation.js"), exports);
|
|
|
40
40
|
// W3C VC and Delegation exports (for mcp-i-core compatibility)
|
|
41
41
|
__exportStar(require("./vc/index.js"), exports);
|
|
42
42
|
__exportStar(require("./delegation/index.js"), exports);
|
|
43
|
+
// Audit types (platform-agnostic)
|
|
44
|
+
__exportStar(require("./audit/index.js"), exports);
|
|
43
45
|
// Version information
|
|
44
46
|
exports.CONTRACTS_VERSION = "1.2.1";
|
|
45
47
|
exports.SUPPORTED_XMCP_I_VERSION = "^1.0.0";
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@kya-os/contracts",
|
|
3
|
-
"version": "1.5.3-canary.
|
|
3
|
+
"version": "1.5.3-canary.11",
|
|
4
4
|
"description": "Shared types and schemas for XMCP-I ecosystem",
|
|
5
5
|
"type": "commonjs",
|
|
6
6
|
"sideEffects": false,
|
|
@@ -77,6 +77,11 @@
|
|
|
77
77
|
"import": "./dist/agentshield-api/index.js",
|
|
78
78
|
"require": "./dist/agentshield-api/index.js"
|
|
79
79
|
},
|
|
80
|
+
"./audit": {
|
|
81
|
+
"types": "./dist/audit/index.d.ts",
|
|
82
|
+
"import": "./dist/audit/index.js",
|
|
83
|
+
"require": "./dist/audit/index.js"
|
|
84
|
+
},
|
|
80
85
|
"./tool-protection": {
|
|
81
86
|
"types": "./dist/tool-protection/index.d.ts",
|
|
82
87
|
"import": "./dist/tool-protection/index.js",
|