@kya-os/mcp-i-core 1.2.3-canary.7 → 1.3.1

package/src/providers/base.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Base Provider Classes
+ *
+ * Abstract classes that define the provider interfaces for
+ * platform-specific implementations.
+ */
+/**
+ * Cryptographic operations provider
+ */
+export declare abstract class CryptoProvider {
+    abstract sign(data: Uint8Array, privateKey: string): Promise<Uint8Array>;
+    abstract verify(data: Uint8Array, signature: Uint8Array, publicKey: string): Promise<boolean>;
+    abstract generateKeyPair(): Promise<{
+        privateKey: string;
+        publicKey: string;
+    }>;
+    abstract hash(data: Uint8Array): Promise<Uint8Array>;
+    abstract randomBytes(length: number): Promise<Uint8Array>;
+}
+/**
+ * Clock/timing operations provider
+ */
+export declare abstract class ClockProvider {
+    abstract now(): number;
+    abstract isWithinSkew(timestamp: number, skewSeconds: number): boolean;
+    abstract hasExpired(expiresAt: number): boolean;
+    abstract calculateExpiry(ttlSeconds: number): number;
+    abstract format(timestamp: number): string;
+}
+/**
+ * Network fetch operations provider
+ */
+export declare abstract class FetchProvider {
+    abstract resolveDID(did: string): Promise<any>;
+    abstract fetchStatusList(url: string): Promise<any>;
+    abstract fetchDelegationChain(id: string): Promise<any[]>;
+    abstract fetch(url: string, options?: any): Promise<Response>;
+}
+/**
+ * Storage operations provider
+ */
+export declare abstract class StorageProvider {
+    abstract get(key: string): Promise<string | null>;
+    abstract set(key: string, value: string): Promise<void>;
+    abstract delete(key: string): Promise<void>;
+    abstract exists(key: string): Promise<boolean>;
+    abstract list(prefix?: string): Promise<string[]>;
+}
+/**
+ * Nonce cache provider
+ * Handles replay prevention
+ *
+ * Nonces should be scoped per agent to prevent cross-agent replay attacks.
+ * When agentDid is provided, implementations should use agent-scoped keys.
+ */
+export declare abstract class NonceCacheProvider {
+    /**
+     * Check if a nonce has been used
+     * @param nonce - The nonce to check
+     * @param agentDid - Optional agent DID for scoping (prevents cross-agent replay attacks)
+     */
+    abstract has(nonce: string, agentDid?: string): Promise<boolean>;
+    /**
+     * Add a nonce to the cache
+     * @param nonce - The nonce to cache
+     * @param ttlSeconds - Time to live in seconds (callers now pass TTL, not absolute timestamp)
+     * @param agentDid - Optional agent DID for scoping (prevents cross-agent replay attacks)
+     */
+    abstract add(nonce: string, ttlSeconds: number, agentDid?: string): Promise<void>;
+    abstract cleanup(): Promise<void>;
+    abstract destroy(): Promise<void>;
+}
+/**
+ * Identity provider for managing agent identities
+ */
+export interface AgentIdentity {
+    did: string;
+    kid: string;
+    privateKey: string;
+    publicKey: string;
+    createdAt: string;
+    type: 'development' | 'production';
+    metadata?: Record<string, any>;
+}
+export declare abstract class IdentityProvider {
+    abstract getIdentity(): Promise<AgentIdentity>;
+    abstract saveIdentity(identity: AgentIdentity): Promise<void>;
+    abstract rotateKeys(): Promise<AgentIdentity>;
+    abstract deleteIdentity(): Promise<void>;
+}
+//# sourceMappingURL=base.d.ts.map

package/src/providers/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["base.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,8BAAsB,cAAc;IAClC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IACxE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAC7F,QAAQ,CAAC,eAAe,IAAI,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9E,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACpD,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CAC1D;AAED;;GAEG;AACH,8BAAsB,aAAa;IACjC,QAAQ,CAAC,GAAG,IAAI,MAAM;IACtB,QAAQ,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO;IACtE,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAC/C,QAAQ,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IACpD,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;CAC3C;AAED;;GAEG;AACH,8BAAsB,aAAa;IACjC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAC9C,QAAQ,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IACnD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACzD,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;CAC9D;AAED;;GAEG;AACH,8BAAsB,eAAe;IACnC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IACjD,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACvD,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC3C,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAC9C,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAClD;AAED;;;;;;GAMG;AACH,8BAAsB,kBAAkB;IACtC;;;;OAIG;IACH,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAEhE;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAEjF,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IACjC,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAChC;AAED,8BAAsB,gBAAgB;IACpC,QAAQ,CAAC,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAC7D,QAAQ,CAAC,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC;IAC7C,QAAQ,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;CACzC"}

package/src/providers/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","sourceRoot":"","sources":["base.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,OAAgB,cAAc;CAMnC;AAED;;GAEG;AACH,MAAM,OAAgB,aAAa;CAMlC;AAED;;GAEG;AACH,MAAM,OAAgB,aAAa;CAKlC;AAED;;GAEG;AACH,MAAM,OAAgB,eAAe;CAMpC;AAED;;;;;;GAMG;AACH,MAAM,OAAgB,kBAAkB;CAkBvC;AAeD,MAAM,OAAgB,gBAAgB;CAKrC"}

package/src/providers/base.ts

@@ -0,0 +1,96 @@
+/**
+ * Base Provider Classes
+ *
+ * Abstract classes that define the provider interfaces for
+ * platform-specific implementations.
+ */
+
+/**
+ * Cryptographic operations provider
+ */
+export abstract class CryptoProvider {
+  abstract sign(data: Uint8Array, privateKey: string): Promise<Uint8Array>;
+  abstract verify(data: Uint8Array, signature: Uint8Array, publicKey: string): Promise<boolean>;
+  abstract generateKeyPair(): Promise<{ privateKey: string; publicKey: string }>;
+  abstract hash(data: Uint8Array): Promise<Uint8Array>;
+  abstract randomBytes(length: number): Promise<Uint8Array>;
+}
+
+/**
+ * Clock/timing operations provider
+ */
+export abstract class ClockProvider {
+  abstract now(): number;
+  abstract isWithinSkew(timestamp: number, skewSeconds: number): boolean;
+  abstract hasExpired(expiresAt: number): boolean;
+  abstract calculateExpiry(ttlSeconds: number): number;
+  abstract format(timestamp: number): string;
+}
+
+/**
+ * Network fetch operations provider
+ */
+export abstract class FetchProvider {
+  abstract resolveDID(did: string): Promise<any>;
+  abstract fetchStatusList(url: string): Promise<any>;
+  abstract fetchDelegationChain(id: string): Promise<any[]>;
+  abstract fetch(url: string, options?: any): Promise<Response>;
+}
+
+/**
+ * Storage operations provider
+ */
+export abstract class StorageProvider {
+  abstract get(key: string): Promise<string | null>;
+  abstract set(key: string, value: string): Promise<void>;
+  abstract delete(key: string): Promise<void>;
+  abstract exists(key: string): Promise<boolean>;
+  abstract list(prefix?: string): Promise<string[]>;
+}
+
+/**
+ * Nonce cache provider
+ * Handles replay prevention
+ * 
+ * Nonces should be scoped per agent to prevent cross-agent replay attacks.
+ * When agentDid is provided, implementations should use agent-scoped keys.
+ */
+export abstract class NonceCacheProvider {
+  /**
+   * Check if a nonce has been used
+   * @param nonce - The nonce to check
+   * @param agentDid - Optional agent DID for scoping (prevents cross-agent replay attacks)
+   */
+  abstract has(nonce: string, agentDid?: string): Promise<boolean>;
+  
+  /**
+   * Add a nonce to the cache
+   * @param nonce - The nonce to cache
+   * @param ttlSeconds - Time to live in seconds (callers now pass TTL, not absolute timestamp)
+   * @param agentDid - Optional agent DID for scoping (prevents cross-agent replay attacks)
+   */
+  abstract add(nonce: string, ttlSeconds: number, agentDid?: string): Promise<void>;
+  
+  abstract cleanup(): Promise<void>;
+  abstract destroy(): Promise<void>;
+}
+
+/**
+ * Identity provider for managing agent identities
+ */
+export interface AgentIdentity {
+  did: string;
+  kid: string;
+  privateKey: string;
+  publicKey: string;
+  createdAt: string;
+  type: 'development' | 'production';
+  metadata?: Record<string, any>;
+}
+
+export abstract class IdentityProvider {
+  abstract getIdentity(): Promise<AgentIdentity>;
+  abstract saveIdentity(identity: AgentIdentity): Promise<void>;
+  abstract rotateKeys(): Promise<AgentIdentity>;
+  abstract deleteIdentity(): Promise<void>;
+}

package/src/providers/memory.ts

@@ -0,0 +1,142 @@
+/**
+ * Memory-based provider implementations
+ *
+ * Simple in-memory implementations for development and testing.
+ */
+
+import {
+  StorageProvider,
+  NonceCacheProvider,
+  IdentityProvider,
+  AgentIdentity
+} from './base';
+
+/**
+ * In-memory storage provider
+ */
+export class MemoryStorageProvider extends StorageProvider {
+  private store: Map<string, string> = new Map();
+
+  async get(key: string): Promise<string | null> {
+    return this.store.get(key) ?? null;
+  }
+
+  async set(key: string, value: string): Promise<void> {
+    this.store.set(key, value);
+  }
+
+  async delete(key: string): Promise<void> {
+    this.store.delete(key);
+  }
+
+  async exists(key: string): Promise<boolean> {
+    return this.store.has(key);
+  }
+
+  async list(prefix?: string): Promise<string[]> {
+    const keys = Array.from(this.store.keys());
+    if (prefix) {
+      return keys.filter(k => k.startsWith(prefix));
+    }
+    return keys;
+  }
+}
+
+/**
+ * In-memory nonce cache provider
+ */
+export class MemoryNonceCacheProvider extends NonceCacheProvider {
+  private nonces: Map<string, number> = new Map();
+
+  async has(nonce: string, agentDid?: string): Promise<boolean> {
+    const key = agentDid ? `nonce:${agentDid}:${nonce}` : `nonce:${nonce}`;
+    const expiry = this.nonces.get(key);
+    if (!expiry) return false;
+
+    if (Date.now() > expiry) {
+      this.nonces.delete(key);
+      return false;
+    }
+
+    return true;
+  }
+
+  async add(nonce: string, ttlSeconds: number, agentDid?: string): Promise<void> {
+    const key = agentDid ? `nonce:${agentDid}:${nonce}` : `nonce:${nonce}`;
+    // Convert TTL seconds to absolute expiration timestamp for storage
+    const expiresAt = Date.now() + (ttlSeconds * 1000);
+    this.nonces.set(key, expiresAt);
+  }
+
+  async cleanup(): Promise<void> {
+    const now = Date.now();
+    for (const [nonce, expiry] of this.nonces) {
+      if (now > expiry) {
+        this.nonces.delete(nonce);
+      }
+    }
+  }
+
+  async destroy(): Promise<void> {
+    this.nonces.clear();
+  }
+}
+
+/**
+ * In-memory identity provider
+ */
+export class MemoryIdentityProvider extends IdentityProvider {
+  private identity?: AgentIdentity;
+  private cryptoProvider: any;
+
+  constructor(cryptoProvider?: any) {
+    super();
+    this.cryptoProvider = cryptoProvider;
+  }
+
+  async getIdentity(): Promise<AgentIdentity> {
+    if (!this.identity) {
+      this.identity = await this.generateIdentity();
+    }
+    return this.identity;
+  }
+
+  async saveIdentity(identity: AgentIdentity): Promise<void> {
+    this.identity = identity;
+  }
+
+  async rotateKeys(): Promise<AgentIdentity> {
+    this.identity = await this.generateIdentity();
+    return this.identity;
+  }
+
+  async deleteIdentity(): Promise<void> {
+    this.identity = undefined;
+  }
+
+  private async generateIdentity(): Promise<AgentIdentity> {
+    if (!this.cryptoProvider) {
+      throw new Error('Crypto provider required for identity generation');
+    }
+
+    const keyPair = await this.cryptoProvider.generateKeyPair();
+    const did = this.generateDIDFromPublicKey(keyPair.publicKey);
+
+    return {
+      did,
+      kid: `${did}#key-1`,
+      privateKey: keyPair.privateKey,
+      publicKey: keyPair.publicKey,
+      createdAt: new Date().toISOString(),
+      type: 'development'
+    };
+  }
+
+  private generateDIDFromPublicKey(publicKey: string): string {
+    // Simplified DID generation
+    const keyHash = Buffer.from(publicKey, 'base64')
+      .toString('base64url')
+      .substring(0, 32);
+    return `did:key:z${keyHash}`;
+  }
+}

package/src/runtime/audit-logger.ts

@@ -0,0 +1,39 @@
+/**
+ * Audit Logger Interface
+ *
+ * Platform-agnostic interface for audit logging in the MCP-I framework.
+ * Implementations should be provided by platform-specific packages.
+ */
+
+import type { AuditContext, AuditEventContext } from "@kya-os/contracts/audit";
+
+/**
+ * Interface for audit logging implementations
+ *
+ * This interface is platform-agnostic and can be implemented by:
+ * - Node.js implementations (using Node.js crypto)
+ * - Cloudflare Workers implementations (using Web Crypto API)
+ * - Other platform-specific implementations
+ */
+export interface IAuditLogger {
+  /**
+   * Log an audit record (with session deduplication)
+   *
+   * This method logs audit records using the frozen audit.v1 format.
+   * Only the first call per session is logged (deduplication).
+   *
+   * @param context - Audit context with identity, session, hashes, and verification status
+   */
+  logAuditRecord(context: AuditContext): Promise<void>;
+
+  /**
+   * Log an event (without session deduplication)
+   *
+   * This method logs events using the frozen audit.v1 format.
+   * Unlike logAuditRecord(), this always logs the event, allowing
+   * multiple events per session (e.g., consent events).
+   *
+   * @param context - Event context with eventType, identity, session, and optional eventData
+   */
+  logEvent(context: AuditEventContext): Promise<void>;
+}