@kya-os/contracts 1.9.1 → 1.10.0

package/dist/audit/index.d.ts

@@ -1,25 +1,16 @@
 /**
- * Audit Types and Schemas
+ * Legacy diagnostic-audit contracts.
  *
- * Types and Zod schemas for audit logging in the MCP-I framework.
- * These types are platform-agnostic and used across all implementations.
+ * @deprecated New integrations must use the canonical protocol from
+ * `@kya-os/mcp/audit`. This compatibility module intentionally contains no
+ * recorder or assurance logic; it preserves the published type/schema import
+ * path until the next major release.
  */
 import { z } from "zod";
 import type { AgentIdentity } from "../config/identity.js";
 import type { SessionContext } from "../handshake.js";
-/**
- * Audit context schema for logging audit records
- *
- * Contains all metadata needed to generate an audit record.
- * Privacy Note: Only metadata is extracted from these objects.
- * The identity's private key, session's nonce, and other sensitive
- * fields are NEVER included in the audit log.
- */
+/** @deprecated Use canonical `@kya-os/mcp/audit` event inputs. */
 export declare const AuditContextSchema: z.ZodObject<{
-    /**
-     * Agent identity
-     * Only `did` and `keyId` are logged. Private key is NEVER logged.
-     */
     identity: z.ZodObject<{
         did: z.ZodString;
         kid: z.ZodString;
@@ -30,10 +21,6 @@ export declare const AuditContextSchema: z.ZodObject<{
         did: z.ZodString;
         kid: z.ZodString;
     }, z.ZodTypeAny, "passthrough">>;
-    /**
-     * Session context
-     * Only `sessionId` and `audience` are logged. Nonce is NEVER logged.
-     */
     session: z.ZodObject<{
         sessionId: z.ZodString;
         audience: z.ZodString;
@@ -44,25 +31,9 @@ export declare const AuditContextSchema: z.ZodObject<{
         sessionId: z.ZodString;
         audience: z.ZodString;
     }, z.ZodTypeAny, "passthrough">>;
-    /**
-     * Request hash (SHA-256 with `sha256:` prefix)
-     */
     requestHash: z.ZodString;
-    /**
-     * Response hash (SHA-256 with `sha256:` prefix)
-     */
     responseHash: z.ZodString;
-    /**
-     * Verification result
-     * - 'yes': Proof was verified successfully
-     * - 'no': Proof verification failed
-     */
     verified: z.ZodEnum<["yes", "no"]>;
-    /**
-     * Optional scope identifier
-     * Application-level scope (e.g., 'orders.create', 'users.read').
-     * If not provided, '-' is used in the audit log.
-     */
     scopeId: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     requestHash: string;
@@ -99,6 +70,7 @@ export declare const AuditContextSchema: z.ZodObject<{
     };
     scopeId?: string | undefined;
 }>;
+/** @deprecated Use canonical `@kya-os/mcp/audit` event inputs. */
 export type AuditContext = {
     identity: AgentIdentity;
     session: SessionContext;
@@ -107,22 +79,9 @@ export type AuditContext = {
     verified: "yes" | "no";
     scopeId?: string;
 };
-/**
- * Event context schema for logging events that bypass session deduplication
- *
- * Used for consent events where multiple events occur in the same session.
- * Unlike AuditContext, this allows multiple events per session.
- */
+/** @deprecated Use canonical `@kya-os/mcp/audit` event inputs. */
 export declare const AuditEventContextSchema: z.ZodObject<{
-    /**
-     * Event type identifier
-     * @example "consent:page_viewed", "consent:approved", "runtime:initialized"
-     */
     eventType: z.ZodString;
-    /**
-     * Agent identity
-     * Only `did` and `keyId` are logged. Private key is NEVER logged.
-     */
     identity: z.ZodObject<{
         did: z.ZodString;
         kid: z.ZodString;
@@ -133,10 +92,6 @@ export declare const AuditEventContextSchema: z.ZodObject<{
         did: z.ZodString;
         kid: z.ZodString;
     }, z.ZodTypeAny, "passthrough">>;
-    /**
-     * Session context
-     * Only `sessionId` and `audience` are logged. Nonce is NEVER logged.
-     */
     session: z.ZodObject<{
         sessionId: z.ZodString;
         audience: z.ZodString;
@@ -147,10 +102,6 @@ export declare const AuditEventContextSchema: z.ZodObject<{
         sessionId: z.ZodString;
         audience: z.ZodString;
     }, z.ZodTypeAny, "passthrough">>;
-    /**
-     * Optional event-specific data
-     * Used for generating event hash. Not logged directly.
-     */
     eventData: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, "strip", z.ZodTypeAny, {
     session: {
@@ -159,13 +110,13 @@ export declare const AuditEventContextSchema: z.ZodObject<{
     } & {
         [k: string]: unknown;
     };
+    eventType: string;
     identity: {
         did: string;
         kid: string;
     } & {
         [k: string]: unknown;
     };
-    eventType: string;
     eventData?: Record<string, unknown> | undefined;
 }, {
     session: {
@@ -174,20 +125,23 @@ export declare const AuditEventContextSchema: z.ZodObject<{
     } & {
         [k: string]: unknown;
     };
+    eventType: string;
     identity: {
         did: string;
         kid: string;
     } & {
         [k: string]: unknown;
     };
-    eventType: string;
     eventData?: Record<string, unknown> | undefined;
 }>;
+/** @deprecated Use canonical `@kya-os/mcp/audit` event inputs. */
 export type AuditEventContext = {
     eventType: string;
     identity: AgentIdentity;
     session: SessionContext;
     eventData?: Record<string, any>;
 };
+/** @deprecated Use canonical `@kya-os/mcp/audit` receipt and event types. */
 export type { AuditRecord } from "../proof.js";
+/** @deprecated Use canonical `@kya-os/mcp/audit` schemas. */
 export { AuditRecordSchema } from "../proof.js";

package/dist/audit/index.js

@@ -1,100 +1,51 @@
 "use strict";
 /**
- * Audit Types and Schemas
+ * Legacy diagnostic-audit contracts.
  *
- * Types and Zod schemas for audit logging in the MCP-I framework.
- * These types are platform-agnostic and used across all implementations.
+ * @deprecated New integrations must use the canonical protocol from
+ * `@kya-os/mcp/audit`. This compatibility module intentionally contains no
+ * recorder or assurance logic; it preserves the published type/schema import
+ * path until the next major release.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuditRecordSchema = exports.AuditEventContextSchema = exports.AuditContextSchema = void 0;
 const zod_1 = require("zod");
-/**
- * Audit context schema for logging audit records
- *
- * Contains all metadata needed to generate an audit record.
- * Privacy Note: Only metadata is extracted from these objects.
- * The identity's private key, session's nonce, and other sensitive
- * fields are NEVER included in the audit log.
- */
+/** @deprecated Use canonical `@kya-os/mcp/audit` event inputs. */
 exports.AuditContextSchema = zod_1.z.object({
-    /**
-     * Agent identity
-     * Only `did` and `keyId` are logged. Private key is NEVER logged.
-     */
     identity: zod_1.z
         .object({
         did: zod_1.z.string().min(1),
         kid: zod_1.z.string().min(1),
     })
-        .passthrough(), // Allow additional fields but only did/kid are used
-    /**
-     * Session context
-     * Only `sessionId` and `audience` are logged. Nonce is NEVER logged.
-     */
+        .passthrough(),
     session: zod_1.z
         .object({
         sessionId: zod_1.z.string().min(1),
         audience: zod_1.z.string().min(1),
     })
-        .passthrough(), // Allow additional fields but only sessionId/audience are used
-    /**
-     * Request hash (SHA-256 with `sha256:` prefix)
-     */
+        .passthrough(),
     requestHash: zod_1.z.string().regex(/^sha256:[a-f0-9]{64}$/),
-    /**
-     * Response hash (SHA-256 with `sha256:` prefix)
-     */
     responseHash: zod_1.z.string().regex(/^sha256:[a-f0-9]{64}$/),
-    /**
-     * Verification result
-     * - 'yes': Proof was verified successfully
-     * - 'no': Proof verification failed
-     */
     verified: zod_1.z.enum(["yes", "no"]),
-    /**
-     * Optional scope identifier
-     * Application-level scope (e.g., 'orders.create', 'users.read').
-     * If not provided, '-' is used in the audit log.
-     */
     scopeId: zod_1.z.string().optional(),
 });
-/**
- * Event context schema for logging events that bypass session deduplication
- *
- * Used for consent events where multiple events occur in the same session.
- * Unlike AuditContext, this allows multiple events per session.
- */
+/** @deprecated Use canonical `@kya-os/mcp/audit` event inputs. */
 exports.AuditEventContextSchema = zod_1.z.object({
-    /**
-     * Event type identifier
-     * @example "consent:page_viewed", "consent:approved", "runtime:initialized"
-     */
     eventType: zod_1.z.string().min(1),
-    /**
-     * Agent identity
-     * Only `did` and `keyId` are logged. Private key is NEVER logged.
-     */
     identity: zod_1.z
         .object({
         did: zod_1.z.string().min(1),
         kid: zod_1.z.string().min(1),
     })
-        .passthrough(), // Allow additional fields but only did/kid are used
-    /**
-     * Session context
-     * Only `sessionId` and `audience` are logged. Nonce is NEVER logged.
-     */
+        .passthrough(),
     session: zod_1.z
         .object({
         sessionId: zod_1.z.string().min(1),
         audience: zod_1.z.string().min(1),
     })
-        .passthrough(), // Allow additional fields but only sessionId/audience are used
-    /**
-     * Optional event-specific data
-     * Used for generating event hash. Not logged directly.
-     */
+        .passthrough(),
     eventData: zod_1.z.record(zod_1.z.unknown()).optional(),
 });
+/** @deprecated Use canonical `@kya-os/mcp/audit` schemas. */
 var proof_js_1 = require("../proof.js");
 Object.defineProperty(exports, "AuditRecordSchema", { enumerable: true, get: function () { return proof_js_1.AuditRecordSchema; } });

package/dist/config/base.d.ts

@@ -44,34 +44,6 @@ export interface MCPIBaseConfig {
          */
         absoluteLifetime?: number;
     };
-    /**
-     * Audit logging configuration
-     * Controls what gets logged for security and compliance
-     */
-    audit?: {
-        /**
-         * Enable audit logging
-         * @default true in production, false in development
-         */
-        enabled: boolean;
-        /**
-         * Include proof hashes in audit logs
-         * Useful for cryptographic verification but increases log size
-         * @default false
-         */
-        includeProofHashes?: boolean;
-        /**
-         * Include full payloads in audit logs
-         * WARNING: May include sensitive data
-         * @default false
-         */
-        includePayloads?: boolean;
-        /**
-         * Custom log function for audit records
-         * If not provided, uses console.log
-         */
-        logFunction?: (record: string) => void;
-    };
     /**
      * Well-known endpoints configuration
      * Controls the /.well-known/* endpoints for identity discovery

package/dist/config/builder.d.ts

@@ -25,7 +25,7 @@ export interface MCPIConfig extends MCPIBaseConfig {
  * Build base MCPIConfig that works across all platforms
  *
  * Creates a platform-agnostic configuration object with sensible defaults
- * for identity, proofing, delegation, audit, and session management.
+ * for identity, proofing, delegation, and session management.
  *
  * @param env - Environment variables object (works with process.env or Cloudflare env)
  * @returns Complete MCPIConfig object

package/dist/config/builder.js

@@ -13,7 +13,7 @@ exports.buildBaseConfig = buildBaseConfig;
  * Build base MCPIConfig that works across all platforms
  *
  * Creates a platform-agnostic configuration object with sensible defaults
- * for identity, proofing, delegation, audit, and session management.
+ * for identity, proofing, delegation, and session management.
  *
  * @param env - Environment variables object (works with process.env or Cloudflare env)
  * @returns Complete MCPIConfig object
@@ -60,11 +60,6 @@ function buildBaseConfig(env) {
                 minReputationScore: 76
             }
         },
-        audit: {
-            enabled: true,
-            includeProofHashes: false,
-            includePayloads: false
-        },
         session: {
             timestampSkewSeconds: 120,
             ttlMinutes: 30

package/dist/dashboard-config/default-config.js

@@ -61,11 +61,6 @@ const defaultConfigJson = {
         },
         fallback: {},
     },
-    audit: {
-        enabled: true,
-        includeProofHashes: false,
-        includePayloads: false,
-    },
     session: {
         timestampSkewSeconds: 120,
         ttlMinutes: 30,

package/dist/dashboard-config/index.d.ts

@@ -6,5 +6,5 @@
  * @package @kya-os/contracts/dashboard-config
  */
 export type { MCPIServerConfig, MergedMCPIServerConfig, GetServerConfigRequest, GetServerConfigResponse, GetMergedServerConfigResponse, UpdateServerConfigRequest, UpdateServerConfigResponse, ValidateServerConfigRequest, ValidateServerConfigResponse, } from './types.js';
-export { identityConfigSchema, proofingConfigSchema, delegationConfigSchema, toolProtectionConfigSchema, mergedToolProtectionConfigSchema, auditConfigSchema, sessionConfigSchema, platformConfigSchema, cloudflarePlatformConfigSchema, nodePlatformConfigSchema, vercelPlatformConfigSchema, configMetadataSchema, mcpIServerConfigSchema, mergedMcpIServerConfigSchema, getServerConfigRequestSchema, getServerConfigResponseSchema, getMergedServerConfigResponseSchema, updateServerConfigRequestSchema, updateServerConfigResponseSchema, validateServerConfigRequestSchema, validateServerConfigResponseSchema, } from './schemas.js';
+export { identityConfigSchema, proofingConfigSchema, delegationConfigSchema, toolProtectionConfigSchema, mergedToolProtectionConfigSchema, sessionConfigSchema, platformConfigSchema, cloudflarePlatformConfigSchema, nodePlatformConfigSchema, vercelPlatformConfigSchema, configMetadataSchema, mcpIServerConfigSchema, mergedMcpIServerConfigSchema, getServerConfigRequestSchema, getServerConfigResponseSchema, getMergedServerConfigResponseSchema, updateServerConfigRequestSchema, updateServerConfigResponseSchema, validateServerConfigRequestSchema, validateServerConfigResponseSchema, } from './schemas.js';
 export { defaultConfig, getDefaultConfigForPlatform, mergeWithDefaults, } from './default-config.js';

package/dist/dashboard-config/index.js

@@ -7,7 +7,7 @@
  * @package @kya-os/contracts/dashboard-config
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.mergeWithDefaults = exports.getDefaultConfigForPlatform = exports.defaultConfig = exports.validateServerConfigResponseSchema = exports.validateServerConfigRequestSchema = exports.updateServerConfigResponseSchema = exports.updateServerConfigRequestSchema = exports.getMergedServerConfigResponseSchema = exports.getServerConfigResponseSchema = exports.getServerConfigRequestSchema = exports.mergedMcpIServerConfigSchema = exports.mcpIServerConfigSchema = exports.configMetadataSchema = exports.vercelPlatformConfigSchema = exports.nodePlatformConfigSchema = exports.cloudflarePlatformConfigSchema = exports.platformConfigSchema = exports.sessionConfigSchema = exports.auditConfigSchema = exports.mergedToolProtectionConfigSchema = exports.toolProtectionConfigSchema = exports.delegationConfigSchema = exports.proofingConfigSchema = exports.identityConfigSchema = void 0;
+exports.mergeWithDefaults = exports.getDefaultConfigForPlatform = exports.defaultConfig = exports.validateServerConfigResponseSchema = exports.validateServerConfigRequestSchema = exports.updateServerConfigResponseSchema = exports.updateServerConfigRequestSchema = exports.getMergedServerConfigResponseSchema = exports.getServerConfigResponseSchema = exports.getServerConfigRequestSchema = exports.mergedMcpIServerConfigSchema = exports.mcpIServerConfigSchema = exports.configMetadataSchema = exports.vercelPlatformConfigSchema = exports.nodePlatformConfigSchema = exports.cloudflarePlatformConfigSchema = exports.platformConfigSchema = exports.sessionConfigSchema = exports.mergedToolProtectionConfigSchema = exports.toolProtectionConfigSchema = exports.delegationConfigSchema = exports.proofingConfigSchema = exports.identityConfigSchema = void 0;
 // Schema exports
 var schemas_js_1 = require("./schemas.js");
 Object.defineProperty(exports, "identityConfigSchema", { enumerable: true, get: function () { return schemas_js_1.identityConfigSchema; } });
@@ -15,7 +15,6 @@ Object.defineProperty(exports, "proofingConfigSchema", { enumerable: true, get:
 Object.defineProperty(exports, "delegationConfigSchema", { enumerable: true, get: function () { return schemas_js_1.delegationConfigSchema; } });
 Object.defineProperty(exports, "toolProtectionConfigSchema", { enumerable: true, get: function () { return schemas_js_1.toolProtectionConfigSchema; } });
 Object.defineProperty(exports, "mergedToolProtectionConfigSchema", { enumerable: true, get: function () { return schemas_js_1.mergedToolProtectionConfigSchema; } });
-Object.defineProperty(exports, "auditConfigSchema", { enumerable: true, get: function () { return schemas_js_1.auditConfigSchema; } });
 Object.defineProperty(exports, "sessionConfigSchema", { enumerable: true, get: function () { return schemas_js_1.sessionConfigSchema; } });
 Object.defineProperty(exports, "platformConfigSchema", { enumerable: true, get: function () { return schemas_js_1.platformConfigSchema; } });
 Object.defineProperty(exports, "cloudflarePlatformConfigSchema", { enumerable: true, get: function () { return schemas_js_1.cloudflarePlatformConfigSchema; } });

package/dist/dashboard-config/schemas.d.ts

@@ -1164,22 +1164,6 @@ export declare const mergedToolProtectionConfigSchema: z.ZodObject<{
         oauthProvider?: string | undefined;
     }> | undefined;
 }>;
-/**
- * Audit configuration schema
- */
-export declare const auditConfigSchema: z.ZodObject<{
-    enabled: z.ZodBoolean;
-    includeProofHashes: z.ZodBoolean;
-    includePayloads: z.ZodBoolean;
-}, "strip", z.ZodTypeAny, {
-    enabled: boolean;
-    includeProofHashes: boolean;
-    includePayloads: boolean;
-}, {
-    enabled: boolean;
-    includeProofHashes: boolean;
-    includePayloads: boolean;
-}>;
 /**
  * Session configuration schema
  */
@@ -2175,19 +2159,6 @@ export declare const mcpIServerConfigSchema: z.ZodObject<{
             oauthProvider?: string | undefined;
         }> | undefined;
     }>;
-    audit: z.ZodObject<{
-        enabled: z.ZodBoolean;
-        includeProofHashes: z.ZodBoolean;
-        includePayloads: z.ZodBoolean;
-    }, "strip", z.ZodTypeAny, {
-        enabled: boolean;
-        includeProofHashes: boolean;
-        includePayloads: boolean;
-    }, {
-        enabled: boolean;
-        includeProofHashes: boolean;
-        includePayloads: boolean;
-    }>;
     session: z.ZodObject<{
         timestampSkewSeconds: z.ZodDefault<z.ZodNumber>;
         ttlMinutes: z.ZodDefault<z.ZodNumber>;
@@ -2644,11 +2615,6 @@ export declare const mcpIServerConfigSchema: z.ZodObject<{
             maxRetries: number;
         };
     };
-    audit: {
-        enabled: boolean;
-        includeProofHashes: boolean;
-        includePayloads: boolean;
-    };
 }, {
     metadata: {
         version: string;
@@ -2796,11 +2762,6 @@ export declare const mcpIServerConfigSchema: z.ZodObject<{
             maxRetries?: number | undefined;
         };
     };
-    audit: {
-        enabled: boolean;
-        includeProofHashes: boolean;
-        includePayloads: boolean;
-    };
 }>;
 /** Merged MCP-I Server Configuration schema @since 1.6.0 */
 export declare const mergedMcpIServerConfigSchema: z.ZodObject<{
@@ -2937,19 +2898,6 @@ export declare const mergedMcpIServerConfigSchema: z.ZodObject<{
             cacheTtl?: number | undefined;
         };
     }>;
-    audit: z.ZodObject<{
-        enabled: z.ZodBoolean;
-        includeProofHashes: z.ZodBoolean;
-        includePayloads: z.ZodBoolean;
-    }, "strip", z.ZodTypeAny, {
-        enabled: boolean;
-        includeProofHashes: boolean;
-        includePayloads: boolean;
-    }, {
-        enabled: boolean;
-        includeProofHashes: boolean;
-        includePayloads: boolean;
-    }>;
     session: z.ZodObject<{
         timestampSkewSeconds: z.ZodDefault<z.ZodNumber>;
         ttlMinutes: z.ZodDefault<z.ZodNumber>;
@@ -4121,11 +4069,6 @@ export declare const mergedMcpIServerConfigSchema: z.ZodObject<{
             maxRetries: number;
         };
     };
-    audit: {
-        enabled: boolean;
-        includeProofHashes: boolean;
-        includePayloads: boolean;
-    };
 }, {
     metadata: {
         version: string;
@@ -4321,11 +4264,6 @@ export declare const mergedMcpIServerConfigSchema: z.ZodObject<{
             maxRetries?: number | undefined;
         };
     };
-    audit: {
-        enabled: boolean;
-        includeProofHashes: boolean;
-        includePayloads: boolean;
-    };
 }>;
 /**
  * Get server config request schema
@@ -4822,19 +4760,6 @@ export declare const getServerConfigResponseSchema: z.ZodObject<{
                     oauthProvider?: string | undefined;
                 }> | undefined;
             }>;
-            audit: z.ZodObject<{
-                enabled: z.ZodBoolean;
-                includeProofHashes: z.ZodBoolean;
-                includePayloads: z.ZodBoolean;
-            }, "strip", z.ZodTypeAny, {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            }, {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            }>;
             session: z.ZodObject<{
                 timestampSkewSeconds: z.ZodDefault<z.ZodNumber>;
                 ttlMinutes: z.ZodDefault<z.ZodNumber>;
@@ -5291,11 +5216,6 @@ export declare const getServerConfigResponseSchema: z.ZodObject<{
                     maxRetries: number;
                 };
             };
-            audit: {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            };
         }, {
             metadata: {
                 version: string;
@@ -5443,11 +5363,6 @@ export declare const getServerConfigResponseSchema: z.ZodObject<{
                     maxRetries?: number | undefined;
                 };
             };
-            audit: {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            };
         }>;
     }, "strip", z.ZodTypeAny, {
         config: {
@@ -5597,11 +5512,6 @@ export declare const getServerConfigResponseSchema: z.ZodObject<{
                     maxRetries: number;
                 };
             };
-            audit: {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            };
         };
     }, {
         config: {
@@ -5751,11 +5661,6 @@ export declare const getServerConfigResponseSchema: z.ZodObject<{
                     maxRetries?: number | undefined;
                 };
             };
-            audit: {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            };
         };
     }>;
     metadata: z.ZodOptional<z.ZodObject<{
@@ -5918,11 +5823,6 @@ export declare const getServerConfigResponseSchema: z.ZodObject<{
                     maxRetries: number;
                 };
             };
-            audit: {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            };
         };
     };
     metadata?: {
@@ -6079,11 +5979,6 @@ export declare const getServerConfigResponseSchema: z.ZodObject<{
                     maxRetries?: number | undefined;
                 };
             };
-            audit: {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            };
         };
     };
     metadata?: {
@@ -6229,19 +6124,6 @@ export declare const getMergedServerConfigResponseSchema: z.ZodObject<{
                     cacheTtl?: number | undefined;
                 };
             }>;
-            audit: z.ZodObject<{
-                enabled: z.ZodBoolean;
-                includeProofHashes: z.ZodBoolean;
-                includePayloads: z.ZodBoolean;
-            }, "strip", z.ZodTypeAny, {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            }, {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            }>;
             session: z.ZodObject<{
                 timestampSkewSeconds: z.ZodDefault<z.ZodNumber>;
                 ttlMinutes: z.ZodDefault<z.ZodNumber>;
@@ -7413,11 +7295,6 @@ export declare const getMergedServerConfigResponseSchema: z.ZodObject<{
                     maxRetries: number;
                 };
             };
-            audit: {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            };
         }, {
             metadata: {
                 version: string;
@@ -7613,11 +7490,6 @@ export declare const getMergedServerConfigResponseSchema: z.ZodObject<{
                     maxRetries?: number | undefined;
                 };
             };
-            audit: {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            };
         }>;
         /** @deprecated Use config.toolProtection.tools instead */
         toolProtections: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -8040,11 +7912,6 @@ export declare const getMergedServerConfigResponseSchema: z.ZodObject<{
                     maxRetries: number;
                 };
             };
-            audit: {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            };
         };
         toolProtections?: Record<string, {
             requiresDelegation: boolean;
@@ -8290,11 +8157,6 @@ export declare const getMergedServerConfigResponseSchema: z.ZodObject<{
                     maxRetries?: number | undefined;
                 };
             };
-            audit: {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            };
         };
         toolProtections?: Record<string, {
             requiresDelegation: boolean;
@@ -8556,11 +8418,6 @@ export declare const getMergedServerConfigResponseSchema: z.ZodObject<{
                     maxRetries: number;
                 };
             };
-            audit: {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            };
         };
         toolProtections?: Record<string, {
             requiresDelegation: boolean;
@@ -8814,11 +8671,6 @@ export declare const getMergedServerConfigResponseSchema: z.ZodObject<{
                     maxRetries?: number | undefined;
                 };
             };
-            audit: {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            };
         };
         toolProtections?: Record<string, {
             requiresDelegation: boolean;
@@ -9359,19 +9211,6 @@ export declare const updateServerConfigRequestSchema: z.ZodObject<{
                 oauthProvider?: string | undefined;
             }> | undefined;
         }>>;
-        audit: z.ZodOptional<z.ZodObject<{
-            enabled: z.ZodBoolean;
-            includeProofHashes: z.ZodBoolean;
-            includePayloads: z.ZodBoolean;
-        }, "strip", z.ZodTypeAny, {
-            enabled: boolean;
-            includeProofHashes: boolean;
-            includePayloads: boolean;
-        }, {
-            enabled: boolean;
-            includeProofHashes: boolean;
-            includePayloads: boolean;
-        }>>;
         session: z.ZodOptional<z.ZodObject<{
             timestampSkewSeconds: z.ZodDefault<z.ZodNumber>;
             ttlMinutes: z.ZodDefault<z.ZodNumber>;
@@ -9828,11 +9667,6 @@ export declare const updateServerConfigRequestSchema: z.ZodObject<{
                 maxRetries: number;
             };
         } | undefined;
-        audit?: {
-            enabled: boolean;
-            includeProofHashes: boolean;
-            includePayloads: boolean;
-        } | undefined;
     }, {
         metadata?: {
             version: string;
@@ -9980,11 +9814,6 @@ export declare const updateServerConfigRequestSchema: z.ZodObject<{
                 maxRetries?: number | undefined;
             };
         } | undefined;
-        audit?: {
-            enabled: boolean;
-            includeProofHashes: boolean;
-            includePayloads: boolean;
-        } | undefined;
     }>;
 }, "strip", z.ZodTypeAny, {
     projectId: string;
@@ -10135,11 +9964,6 @@ export declare const updateServerConfigRequestSchema: z.ZodObject<{
                 maxRetries: number;
             };
         } | undefined;
-        audit?: {
-            enabled: boolean;
-            includeProofHashes: boolean;
-            includePayloads: boolean;
-        } | undefined;
     };
 }, {
     projectId: string;
@@ -10290,11 +10114,6 @@ export declare const updateServerConfigRequestSchema: z.ZodObject<{
                 maxRetries?: number | undefined;
             };
         } | undefined;
-        audit?: {
-            enabled: boolean;
-            includeProofHashes: boolean;
-            includePayloads: boolean;
-        } | undefined;
     };
 }>;
 /**
@@ -10782,19 +10601,6 @@ export declare const updateServerConfigResponseSchema: z.ZodObject<{
                     oauthProvider?: string | undefined;
                 }> | undefined;
             }>;
-            audit: z.ZodObject<{
-                enabled: z.ZodBoolean;
-                includeProofHashes: z.ZodBoolean;
-                includePayloads: z.ZodBoolean;
-            }, "strip", z.ZodTypeAny, {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            }, {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            }>;
             session: z.ZodObject<{
                 timestampSkewSeconds: z.ZodDefault<z.ZodNumber>;
                 ttlMinutes: z.ZodDefault<z.ZodNumber>;
@@ -11251,11 +11057,6 @@ export declare const updateServerConfigResponseSchema: z.ZodObject<{
                     maxRetries: number;
                 };
             };
-            audit: {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            };
         }, {
             metadata: {
                 version: string;
@@ -11403,11 +11204,6 @@ export declare const updateServerConfigResponseSchema: z.ZodObject<{
                     maxRetries?: number | undefined;
                 };
             };
-            audit: {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            };
         }>;
         changes: z.ZodArray<z.ZodObject<{
             path: z.ZodString;
@@ -11575,11 +11371,6 @@ export declare const updateServerConfigResponseSchema: z.ZodObject<{
                     maxRetries: number;
                 };
             };
-            audit: {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            };
         };
     }, {
         changes: {
@@ -11734,11 +11525,6 @@ export declare const updateServerConfigResponseSchema: z.ZodObject<{
                     maxRetries?: number | undefined;
                 };
             };
-            audit: {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            };
         };
     }>;
     metadata: z.ZodOptional<z.ZodObject<{
@@ -11906,11 +11692,6 @@ export declare const updateServerConfigResponseSchema: z.ZodObject<{
                     maxRetries: number;
                 };
             };
-            audit: {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            };
         };
     };
     metadata?: {
@@ -12072,11 +11853,6 @@ export declare const updateServerConfigResponseSchema: z.ZodObject<{
                     maxRetries?: number | undefined;
                 };
             };
-            audit: {
-                enabled: boolean;
-                includeProofHashes: boolean;
-                includePayloads: boolean;
-            };
         };
     };
     metadata?: {
@@ -12568,19 +12344,6 @@ export declare const validateServerConfigRequestSchema: z.ZodObject<{
                 oauthProvider?: string | undefined;
             }> | undefined;
         }>>;
-        audit: z.ZodOptional<z.ZodObject<{
-            enabled: z.ZodBoolean;
-            includeProofHashes: z.ZodBoolean;
-            includePayloads: z.ZodBoolean;
-        }, "strip", z.ZodTypeAny, {
-            enabled: boolean;
-            includeProofHashes: boolean;
-            includePayloads: boolean;
-        }, {
-            enabled: boolean;
-            includeProofHashes: boolean;
-            includePayloads: boolean;
-        }>>;
         session: z.ZodOptional<z.ZodObject<{
             timestampSkewSeconds: z.ZodDefault<z.ZodNumber>;
             ttlMinutes: z.ZodDefault<z.ZodNumber>;
@@ -13037,11 +12800,6 @@ export declare const validateServerConfigRequestSchema: z.ZodObject<{
                 maxRetries: number;
             };
         } | undefined;
-        audit?: {
-            enabled: boolean;
-            includeProofHashes: boolean;
-            includePayloads: boolean;
-        } | undefined;
     }, {
         metadata?: {
             version: string;
@@ -13189,11 +12947,6 @@ export declare const validateServerConfigRequestSchema: z.ZodObject<{
                 maxRetries?: number | undefined;
             };
         } | undefined;
-        audit?: {
-            enabled: boolean;
-            includeProofHashes: boolean;
-            includePayloads: boolean;
-        } | undefined;
     }>;
 }, "strip", z.ZodTypeAny, {
     projectId: string;
@@ -13344,11 +13097,6 @@ export declare const validateServerConfigRequestSchema: z.ZodObject<{
                 maxRetries: number;
             };
         } | undefined;
-        audit?: {
-            enabled: boolean;
-            includeProofHashes: boolean;
-            includePayloads: boolean;
-        } | undefined;
     };
 }, {
     projectId: string;
@@ -13499,11 +13247,6 @@ export declare const validateServerConfigRequestSchema: z.ZodObject<{
                 maxRetries?: number | undefined;
             };
         } | undefined;
-        audit?: {
-            enabled: boolean;
-            includeProofHashes: boolean;
-            includePayloads: boolean;
-        } | undefined;
     };
 }>;
 /**

package/dist/dashboard-config/schemas.js

@@ -8,7 +8,7 @@
  * @package @kya-os/contracts/dashboard-config
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateServerConfigResponseSchema = exports.validateServerConfigRequestSchema = exports.updateServerConfigResponseSchema = exports.updateServerConfigRequestSchema = exports.getMergedServerConfigResponseSchema = exports.getServerConfigResponseSchema = exports.getServerConfigRequestSchema = exports.mergedMcpIServerConfigSchema = exports.mcpIServerConfigSchema = exports.configMetadataSchema = exports.platformConfigSchema = exports.vercelPlatformConfigSchema = exports.nodePlatformConfigSchema = exports.cloudflarePlatformConfigSchema = exports.sessionConfigSchema = exports.auditConfigSchema = exports.mergedToolProtectionConfigSchema = exports.toolProtectionConfigSchema = exports.delegationConfigSchema = exports.proofingConfigSchema = exports.identityConfigSchema = void 0;
+exports.validateServerConfigResponseSchema = exports.validateServerConfigRequestSchema = exports.updateServerConfigResponseSchema = exports.updateServerConfigRequestSchema = exports.getMergedServerConfigResponseSchema = exports.getServerConfigResponseSchema = exports.getServerConfigRequestSchema = exports.mergedMcpIServerConfigSchema = exports.mcpIServerConfigSchema = exports.configMetadataSchema = exports.platformConfigSchema = exports.vercelPlatformConfigSchema = exports.nodePlatformConfigSchema = exports.cloudflarePlatformConfigSchema = exports.sessionConfigSchema = exports.mergedToolProtectionConfigSchema = exports.toolProtectionConfigSchema = exports.delegationConfigSchema = exports.proofingConfigSchema = exports.identityConfigSchema = void 0;
 const zod_1 = require("zod");
 const index_js_1 = require("../tool-protection/index.js");
 /**
@@ -84,14 +84,6 @@ exports.toolProtectionConfigSchema = zod_1.z.object({
 exports.mergedToolProtectionConfigSchema = exports.toolProtectionConfigSchema.extend({
     tools: index_js_1.ToolProtectionMapSchema,
 });
-/**
- * Audit configuration schema
- */
-exports.auditConfigSchema = zod_1.z.object({
-    enabled: zod_1.z.boolean(),
-    includeProofHashes: zod_1.z.boolean(),
-    includePayloads: zod_1.z.boolean(),
-});
 /**
  * Session configuration schema
  */
@@ -178,7 +170,6 @@ exports.mcpIServerConfigSchema = zod_1.z.object({
     proofing: exports.proofingConfigSchema,
     delegation: exports.delegationConfigSchema,
     toolProtection: exports.toolProtectionConfigSchema,
-    audit: exports.auditConfigSchema,
     session: exports.sessionConfigSchema,
     platform: exports.platformConfigSchema,
     metadata: exports.configMetadataSchema,

package/dist/dashboard-config/types.d.ts

@@ -120,21 +120,6 @@ export interface MCPIServerConfig {
          */
         fallback?: ToolProtectionMap;
     };
-    audit: {
-        /**
-         * Enable audit logging
-         */
-        enabled: boolean;
-        /**
-         * Include proof hashes in logs
-         */
-        includeProofHashes: boolean;
-        /**
-         * Include full payloads in logs
-         * WARNING: May include sensitive data
-         */
-        includePayloads: boolean;
-    };
     session: {
         /**
          * Maximum time skew allowed (seconds)

package/dist/fleet/index.d.ts

@@ -0,0 +1,17 @@
+export interface FleetPrincipal {
+    orgId: string;
+    subject: string;
+}
+export type FleetAuthenticator = (authorization: string | undefined) => FleetPrincipal | null;
+export interface FleetAgentIdentity {
+    did: string;
+    name: string;
+    capabilities?: readonly string[];
+}
+/**
+ * Build a fail-closed authenticator from deployment-managed credential hashes.
+ * Plaintext bearer tokens are never stored in configuration or logs.
+ */
+export declare function createFleetAuthenticator(rawConfiguration: string | undefined): FleetAuthenticator;
+/** Resolve a target only within an already tenant-filtered agent collection. */
+export declare function resolveFleetAgent(agents: readonly FleetAgentIdentity[], target: string): string | null;

package/dist/fleet/index.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createFleetAuthenticator = createFleetAuthenticator;
+exports.resolveFleetAgent = resolveFleetAgent;
+const node_crypto_1 = require("node:crypto");
+/**
+ * Build a fail-closed authenticator from deployment-managed credential hashes.
+ * Plaintext bearer tokens are never stored in configuration or logs.
+ */
+function createFleetAuthenticator(rawConfiguration) {
+    if (!rawConfiguration) {
+        throw new Error("FLEET_MCP_CREDENTIALS_JSON is required");
+    }
+    let decoded;
+    try {
+        decoded = JSON.parse(rawConfiguration);
+    }
+    catch {
+        throw new Error("FLEET_MCP_CREDENTIALS_JSON must be valid JSON");
+    }
+    if (!Array.isArray(decoded) || decoded.length === 0) {
+        throw new Error("FLEET_MCP_CREDENTIALS_JSON must contain at least one credential");
+    }
+    const credentials = new Map();
+    for (const [index, candidate] of decoded.entries()) {
+        if (!isRecord(candidate)) {
+            throw new Error(`Fleet credential ${index} must be an object`);
+        }
+        const tokenSha256 = candidate.tokenSha256;
+        const orgId = candidate.orgId;
+        const subject = candidate.subject;
+        if (typeof tokenSha256 !== "string" ||
+            !/^[a-f0-9]{64}$/.test(tokenSha256)) {
+            throw new Error(`Fleet credential ${index} tokenSha256 must be lowercase SHA-256 hex`);
+        }
+        if (typeof orgId !== "string" || orgId.trim().length === 0) {
+            throw new Error(`Fleet credential ${index} orgId must be non-empty`);
+        }
+        if (typeof subject !== "string" || subject.trim().length === 0) {
+            throw new Error(`Fleet credential ${index} subject must be non-empty`);
+        }
+        if (credentials.has(tokenSha256)) {
+            throw new Error("Duplicate Fleet credential hash");
+        }
+        credentials.set(tokenSha256, {
+            orgId: orgId.trim(),
+            subject: subject.trim(),
+        });
+    }
+    return (authorization) => {
+        const match = authorization?.match(/^Bearer ([^\s]+)$/);
+        if (!match || match[1].length < 32 || match[1].length > 512)
+            return null;
+        const digest = (0, node_crypto_1.createHash)("sha256").update(match[1], "utf8").digest("hex");
+        const principal = credentials.get(digest);
+        return principal ? { ...principal } : null;
+    };
+}
+/** Resolve a target only within an already tenant-filtered agent collection. */
+function resolveFleetAgent(agents, target) {
+    const normalized = target.toLowerCase();
+    return (agents.find((agent) => agent.did === target)?.did ??
+        agents.find((agent) => agent.name.toLowerCase() === normalized)?.did ??
+        agents.find((agent) => agent.capabilities?.some((capability) => capability.toLowerCase() === normalized))?.did ??
+        null);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/index.d.ts

@@ -21,7 +21,6 @@ export * from "./test.js";
 export * from "./utils/validation.js";
 export * from "./vc/index.js";
 export * from "./delegation/index.js";
-export * from "./audit/index.js";
 export * from "./policy/index.js";
 export * from "./pairing/index.js";
 export declare const CONTRACTS_VERSION = "1.2.1";

package/dist/index.js

@@ -40,8 +40,6 @@ __exportStar(require("./utils/validation.js"), exports);
 // W3C VC and Delegation exports (for mcp-i-core compatibility)
 __exportStar(require("./vc/index.js"), exports);
 __exportStar(require("./delegation/index.js"), exports);
-// Audit types (platform-agnostic)
-__exportStar(require("./audit/index.js"), exports);
 // Policy types (for mcp-i-core compatibility with webpack alias)
 __exportStar(require("./policy/index.js"), exports);
 // Pairing WS event types (compute → dashboard)

package/dist/vault/index.d.ts

@@ -7,4 +7,3 @@
  */
 export { ENV_VAR_PATTERN, envVarNameSchema, upsertSecretSchema, resolveSecretsRequestSchema, resolveSecretsResponseSchema } from './schemas';
 export type { UpsertSecretInput, ResolveSecretsRequest, ResolveSecretsResponse } from './types';
-export { VAULT_AUDIT_EVENTS, type VaultAuditEvent } from './audit-events';

package/dist/vault/index.js

@@ -7,12 +7,10 @@
  * @module @kya-os/contracts/vault
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VAULT_AUDIT_EVENTS = exports.resolveSecretsResponseSchema = exports.resolveSecretsRequestSchema = exports.upsertSecretSchema = exports.envVarNameSchema = exports.ENV_VAR_PATTERN = void 0;
+exports.resolveSecretsResponseSchema = exports.resolveSecretsRequestSchema = exports.upsertSecretSchema = exports.envVarNameSchema = exports.ENV_VAR_PATTERN = void 0;
 var schemas_1 = require("./schemas");
 Object.defineProperty(exports, "ENV_VAR_PATTERN", { enumerable: true, get: function () { return schemas_1.ENV_VAR_PATTERN; } });
 Object.defineProperty(exports, "envVarNameSchema", { enumerable: true, get: function () { return schemas_1.envVarNameSchema; } });
 Object.defineProperty(exports, "upsertSecretSchema", { enumerable: true, get: function () { return schemas_1.upsertSecretSchema; } });
 Object.defineProperty(exports, "resolveSecretsRequestSchema", { enumerable: true, get: function () { return schemas_1.resolveSecretsRequestSchema; } });
 Object.defineProperty(exports, "resolveSecretsResponseSchema", { enumerable: true, get: function () { return schemas_1.resolveSecretsResponseSchema; } });
-var audit_events_1 = require("./audit-events");
-Object.defineProperty(exports, "VAULT_AUDIT_EVENTS", { enumerable: true, get: function () { return audit_events_1.VAULT_AUDIT_EVENTS; } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/contracts",
-  "version": "1.9.1",
+  "version": "1.10.0",
   "description": "Shared contracts, types, and schemas for MCP-I framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -25,6 +25,10 @@
       "types": "./dist/runtime/index.d.ts",
       "default": "./dist/runtime/index.js"
     },
+    "./fleet": {
+      "types": "./dist/fleet/index.d.ts",
+      "default": "./dist/fleet/index.js"
+    },
     "./proof": {
       "types": "./dist/proof/index.d.ts",
       "default": "./dist/proof/index.js"

package/dist/vault/audit-events.d.ts

@@ -1,21 +0,0 @@
-/**
- * Vault Audit Event Taxonomy
- *
- * Constants for audit logging of vault operations.
- *
- * @module @kya-os/contracts/vault
- */
-/** Audit events emitted by the vault system */
-export declare const VAULT_AUDIT_EVENTS: {
-    /** A secret was created or updated */
-    readonly SECRET_UPSERTED: "vault.secret.upserted";
-    /** A secret was deleted */
-    readonly SECRET_DELETED: "vault.secret.deleted";
-    /** A runtime secret resolution was requested */
-    readonly RESOLVE_REQUESTED: "vault.secret.resolve.requested";
-    /** A runtime secret resolution was granted */
-    readonly RESOLVE_GRANTED: "vault.secret.resolve.granted";
-    /** A runtime secret resolution was denied */
-    readonly RESOLVE_DENIED: "vault.secret.resolve.denied";
-};
-export type VaultAuditEvent = (typeof VAULT_AUDIT_EVENTS)[keyof typeof VAULT_AUDIT_EVENTS];

package/dist/vault/audit-events.js

@@ -1,23 +0,0 @@
-"use strict";
-/**
- * Vault Audit Event Taxonomy
- *
- * Constants for audit logging of vault operations.
- *
- * @module @kya-os/contracts/vault
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.VAULT_AUDIT_EVENTS = void 0;
-/** Audit events emitted by the vault system */
-exports.VAULT_AUDIT_EVENTS = {
-    /** A secret was created or updated */
-    SECRET_UPSERTED: 'vault.secret.upserted',
-    /** A secret was deleted */
-    SECRET_DELETED: 'vault.secret.deleted',
-    /** A runtime secret resolution was requested */
-    RESOLVE_REQUESTED: 'vault.secret.resolve.requested',
-    /** A runtime secret resolution was granted */
-    RESOLVE_GRANTED: 'vault.secret.resolve.granted',
-    /** A runtime secret resolution was denied */
-    RESOLVE_DENIED: 'vault.secret.resolve.denied',
-};