@kya-os/mcp-i-core 1.7.0 → 1.8.0

package/dist/index.js

@@ -2,8 +2,12 @@
 /**
  * @kya-os/mcp-i-core
  *
- * Core provider-based architecture for MCP-I framework.
- * Platform-agnostic runtime that can be extended for any environment.
+ * Compatibility shim. The product-runtime layer has relocated to
+ * @kya-os/mcp-i-runtime; this package re-exports it so existing
+ * `@kya-os/mcp-i-core` importers keep resolving during the C4 drain window.
+ *
+ * Delegation (W3C VC) symbols remain sourced here — `src/delegation/**` is
+ * pinned by E3.5 (#2904) and is intentionally NOT relocated.
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -20,103 +24,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.StatusList2021Manager = exports.createDelegationVerifier = exports.DelegationCredentialVerifier = exports.createDelegationIssuer = exports.DelegationCredentialIssuer = exports.createDelegationErrorFormatter = exports.DelegationErrorFormatter = exports.OAuthRequiredError = exports.DelegationRequiredError = exports.NoOpToolProtectionCache = exports.InMemoryToolProtectionCache = exports.createProofVerificationError = exports.PROOF_VERIFICATION_ERROR_CODES = exports.ProofVerificationError = exports.migrateLegacyKeys = exports.StorageKeyHelpers = exports.createStorageProviders = exports.NoOpOAuthConfigCache = exports.InMemoryOAuthConfigCache = exports.BatchDelegationService = exports.OAuthTokenRetrievalService = exports.ProviderValidationError = exports.ProviderValidator = exports.CredentialAuthModeError = exports.ConsentOnlyModeError = exports.ProviderResolver = exports.OAuthProviderRegistry = exports.ToolContextBuilder = exports.defaultSecretResolver = exports.OAuthService = exports.OAuthConfigService = exports.createSessionRegistrationService = exports.SessionRegistrationService = exports.authorizationMatches = exports.AccessControlApiService = exports.ProofVerifier = exports.CryptoService = exports.PolicyService = exports.ToolProtectionService = exports.CONSENT_UI_RESOURCE_URI = exports.MCPIRuntimeBase = exports.MemoryIdentityProvider = exports.MemoryNonceCacheProvider = exports.MemoryStorageProvider = exports.IdentityProvider = exports.NonceCacheProvider = exports.StorageProvider = exports.FetchProvider = exports.ClockProvider = exports.CryptoProvider = void 0;
-exports.createProofResponse = exports.ProofGenerator = exports.createDefaultConsoleLogger = exports.logger = exports.IdpTokenResolver = exports.UserDidManager = exports.isPolicyEnabled = exports.hasMergedPolicy = exports.extractPolicy = exports.getPolicy = exports.hasMergedToolProtections = exports.extractToolProtections = exports.getToolProtection = exports.fetchRemoteConfig = exports.bytesToBase64 = exports.base64urlDecodeToString = exports.base64urlDecodeToBytes = exports.base64urlEncodeFromString = exports.base64urlEncodeFromBytes = exports.parseVCJWT = exports.completeVCJWT = exports.createUnsignedVCJWT = exports.canonicalizeJSON = exports.getSchemaStats = exports.getCriticalSchemas = exports.getSchemaById = exports.getSchemasByCategory = exports.getAllSchemas = exports.SCHEMA_REGISTRY = exports.createSchemaVerifier = exports.SchemaVerifier = exports.isValidBase58 = exports.base58Decode = exports.base58Encode = exports.resolveDidKeySync = exports.publicKeyToJwk = exports.extractPublicKeyFromDidKey = exports.isEd25519DidKey = exports.createDidKeyResolver = exports.buildChainString = exports.buildDelegationProofJWT = exports.MemoryDelegationGraphStorage = exports.MemoryStatusListStorage = exports.createCascadingRevocationManager = exports.CascadingRevocationManager = exports.createDelegationGraph = exports.DelegationGraphManager = exports.isIndexSet = exports.BitstringManager = exports.createStatusListManager = void 0;
-exports.MemoryResumeTokenStore = exports.hasSensitiveScopes = exports.verifyOrHints = exports.validateHandshakeFormat = exports.createHandshakeRequest = exports.SessionManager = exports.extractCanonicalData = void 0;
-// Base providers
-var base_1 = require("./providers/base");
-Object.defineProperty(exports, "CryptoProvider", { enumerable: true, get: function () { return base_1.CryptoProvider; } });
-Object.defineProperty(exports, "ClockProvider", { enumerable: true, get: function () { return base_1.ClockProvider; } });
-Object.defineProperty(exports, "FetchProvider", { enumerable: true, get: function () { return base_1.FetchProvider; } });
-Object.defineProperty(exports, "StorageProvider", { enumerable: true, get: function () { return base_1.StorageProvider; } });
-Object.defineProperty(exports, "NonceCacheProvider", { enumerable: true, get: function () { return base_1.NonceCacheProvider; } });
-Object.defineProperty(exports, "IdentityProvider", { enumerable: true, get: function () { return base_1.IdentityProvider; } });
-// Memory providers
-var memory_1 = require("./providers/memory");
-Object.defineProperty(exports, "MemoryStorageProvider", { enumerable: true, get: function () { return memory_1.MemoryStorageProvider; } });
-Object.defineProperty(exports, "MemoryNonceCacheProvider", { enumerable: true, get: function () { return memory_1.MemoryNonceCacheProvider; } });
-Object.defineProperty(exports, "MemoryIdentityProvider", { enumerable: true, get: function () { return memory_1.MemoryIdentityProvider; } });
-// Runtime
-var base_2 = require("./runtime/base");
-Object.defineProperty(exports, "MCPIRuntimeBase", { enumerable: true, get: function () { return base_2.MCPIRuntimeBase; } });
-// MCP Apps consent constants
-var ext_apps_constants_1 = require("./runtime/ext-apps-constants");
-Object.defineProperty(exports, "CONSENT_UI_RESOURCE_URI", { enumerable: true, get: function () { return ext_apps_constants_1.CONSENT_UI_RESOURCE_URI; } });
-// Utilities
-__exportStar(require("./utils"), exports);
-// Tool Protection
-var tool_protection_service_1 = require("./services/tool-protection.service");
-Object.defineProperty(exports, "ToolProtectionService", { enumerable: true, get: function () { return tool_protection_service_1.ToolProtectionService; } });
-// Policy Service (v1.7.0)
-var policy_service_1 = require("./services/policy.service");
-Object.defineProperty(exports, "PolicyService", { enumerable: true, get: function () { return policy_service_1.PolicyService; } });
-// Crypto Service
-var crypto_service_1 = require("./services/crypto.service");
-Object.defineProperty(exports, "CryptoService", { enumerable: true, get: function () { return crypto_service_1.CryptoService; } });
-// Proof Verifier Service
-var proof_verifier_1 = require("./services/proof-verifier");
-Object.defineProperty(exports, "ProofVerifier", { enumerable: true, get: function () { return proof_verifier_1.ProofVerifier; } });
-// Access Control API Service (stub for Phase 3)
-var access_control_service_1 = require("./services/access-control.service");
-Object.defineProperty(exports, "AccessControlApiService", { enumerable: true, get: function () { return access_control_service_1.AccessControlApiService; } });
-Object.defineProperty(exports, "authorizationMatches", { enumerable: true, get: function () { return access_control_service_1.authorizationMatches; } });
-// Session Registration Service
-var session_registration_service_1 = require("./services/session-registration.service");
-Object.defineProperty(exports, "SessionRegistrationService", { enumerable: true, get: function () { return session_registration_service_1.SessionRegistrationService; } });
-Object.defineProperty(exports, "createSessionRegistrationService", { enumerable: true, get: function () { return session_registration_service_1.createSessionRegistrationService; } });
-// OAuth Config Service (Phase 1)
-var oauth_config_service_1 = require("./services/oauth-config.service");
-Object.defineProperty(exports, "OAuthConfigService", { enumerable: true, get: function () { return oauth_config_service_1.OAuthConfigService; } });
-// OAuth Service (Phase 1)
-var oauth_service_1 = require("./services/oauth-service");
-Object.defineProperty(exports, "OAuthService", { enumerable: true, get: function () { return oauth_service_1.OAuthService; } });
-Object.defineProperty(exports, "defaultSecretResolver", { enumerable: true, get: function () { return oauth_service_1.defaultSecretResolver; } });
-// Tool Context Builder (Phase 1)
-var tool_context_builder_1 = require("./services/tool-context-builder");
-Object.defineProperty(exports, "ToolContextBuilder", { enumerable: true, get: function () { return tool_context_builder_1.ToolContextBuilder; } });
-// OAuth Provider Registry (Phase 2)
-var oauth_provider_registry_1 = require("./services/oauth-provider-registry");
-Object.defineProperty(exports, "OAuthProviderRegistry", { enumerable: true, get: function () { return oauth_provider_registry_1.OAuthProviderRegistry; } });
-// Provider Resolver (Phase 2)
-var provider_resolver_1 = require("./services/provider-resolver");
-Object.defineProperty(exports, "ProviderResolver", { enumerable: true, get: function () { return provider_resolver_1.ProviderResolver; } });
-Object.defineProperty(exports, "ConsentOnlyModeError", { enumerable: true, get: function () { return provider_resolver_1.ConsentOnlyModeError; } });
-Object.defineProperty(exports, "CredentialAuthModeError", { enumerable: true, get: function () { return provider_resolver_1.CredentialAuthModeError; } });
-// Provider Validator (Phase 3)
-var provider_validator_1 = require("./services/provider-validator");
-Object.defineProperty(exports, "ProviderValidator", { enumerable: true, get: function () { return provider_validator_1.ProviderValidator; } });
-Object.defineProperty(exports, "ProviderValidationError", { enumerable: true, get: function () { return provider_validator_1.ProviderValidationError; } });
-// OAuth Token Retrieval Service (Phase 3)
-var oauth_token_retrieval_service_1 = require("./services/oauth-token-retrieval.service");
-Object.defineProperty(exports, "OAuthTokenRetrievalService", { enumerable: true, get: function () { return oauth_token_retrieval_service_1.OAuthTokenRetrievalService; } });
-// Batch Delegation Service (Phase 2)
-var batch_delegation_service_1 = require("./services/batch-delegation.service");
-Object.defineProperty(exports, "BatchDelegationService", { enumerable: true, get: function () { return batch_delegation_service_1.BatchDelegationService; } });
-// OAuth Config Cache
-var oauth_config_cache_1 = require("./cache/oauth-config-cache");
-Object.defineProperty(exports, "InMemoryOAuthConfigCache", { enumerable: true, get: function () { return oauth_config_cache_1.InMemoryOAuthConfigCache; } });
-Object.defineProperty(exports, "NoOpOAuthConfigCache", { enumerable: true, get: function () { return oauth_config_cache_1.NoOpOAuthConfigCache; } });
-// Storage Service Factory
-var storage_service_1 = require("./services/storage.service");
-Object.defineProperty(exports, "createStorageProviders", { enumerable: true, get: function () { return storage_service_1.createStorageProviders; } });
-Object.defineProperty(exports, "StorageKeyHelpers", { enumerable: true, get: function () { return storage_service_1.StorageKeyHelpers; } });
-Object.defineProperty(exports, "migrateLegacyKeys", { enumerable: true, get: function () { return storage_service_1.migrateLegacyKeys; } });
-// Proof Verification Errors
-var errors_1 = require("./services/errors");
-Object.defineProperty(exports, "ProofVerificationError", { enumerable: true, get: function () { return errors_1.ProofVerificationError; } });
-Object.defineProperty(exports, "PROOF_VERIFICATION_ERROR_CODES", { enumerable: true, get: function () { return errors_1.PROOF_VERIFICATION_ERROR_CODES; } });
-Object.defineProperty(exports, "createProofVerificationError", { enumerable: true, get: function () { return errors_1.createProofVerificationError; } });
-var tool_protection_cache_1 = require("./cache/tool-protection-cache");
-Object.defineProperty(exports, "InMemoryToolProtectionCache", { enumerable: true, get: function () { return tool_protection_cache_1.InMemoryToolProtectionCache; } });
-Object.defineProperty(exports, "NoOpToolProtectionCache", { enumerable: true, get: function () { return tool_protection_cache_1.NoOpToolProtectionCache; } });
-var tool_protection_1 = require("./types/tool-protection");
-Object.defineProperty(exports, "DelegationRequiredError", { enumerable: true, get: function () { return tool_protection_1.DelegationRequiredError; } });
-var oauth_required_error_1 = require("./types/oauth-required-error");
-Object.defineProperty(exports, "OAuthRequiredError", { enumerable: true, get: function () { return oauth_required_error_1.OAuthRequiredError; } });
-// Delegation Error Formatter (client-specific messages)
-var delegation_error_formatter_1 = require("./services/delegation-error-formatter");
-Object.defineProperty(exports, "DelegationErrorFormatter", { enumerable: true, get: function () { return delegation_error_formatter_1.DelegationErrorFormatter; } });
-Object.defineProperty(exports, "createDelegationErrorFormatter", { enumerable: true, get: function () { return delegation_error_formatter_1.createDelegationErrorFormatter; } });
+exports.DEFAULT_TRUSTED_ISSUERS = exports.validateLevel2 = exports.parseVCJWT = exports.completeVCJWT = exports.createUnsignedVCJWT = exports.canonicalizeJSON = exports.resolveDidKeySync = exports.publicKeyToJwk = exports.extractPublicKeyFromDidKey = exports.isEd25519DidKey = exports.createDidKeyResolver = exports.buildChainString = exports.buildDelegationProofJWT = exports.MemoryDelegationGraphStorage = exports.MemoryStatusListStorage = exports.createCascadingRevocationManager = exports.CascadingRevocationManager = exports.createDelegationGraph = exports.DelegationGraphManager = exports.isIndexSet = exports.BitstringManager = exports.createStatusListManager = exports.StatusList2021Manager = exports.createDelegationVerifier = exports.DelegationCredentialVerifier = exports.createDelegationIssuer = exports.DelegationCredentialIssuer = void 0;
+__exportStar(require("@kya-os/mcp-i-runtime"), exports);
 // Delegation (W3C VC-based)
 var vc_issuer_1 = require("./delegation/vc-issuer");
 Object.defineProperty(exports, "DelegationCredentialIssuer", { enumerable: true, get: function () { return vc_issuer_1.DelegationCredentialIssuer; } });
@@ -154,71 +63,15 @@ Object.defineProperty(exports, "isEd25519DidKey", { enumerable: true, get: funct
 Object.defineProperty(exports, "extractPublicKeyFromDidKey", { enumerable: true, get: function () { return did_key_resolver_1.extractPublicKeyFromDidKey; } });
 Object.defineProperty(exports, "publicKeyToJwk", { enumerable: true, get: function () { return did_key_resolver_1.publicKeyToJwk; } });
 Object.defineProperty(exports, "resolveDidKeySync", { enumerable: true, get: function () { return did_key_resolver_1.resolveDidKeySync; } });
-// Base58 Utilities (for did:key encoding/decoding)
-var base58_1 = require("./utils/base58");
-Object.defineProperty(exports, "base58Encode", { enumerable: true, get: function () { return base58_1.base58Encode; } });
-Object.defineProperty(exports, "base58Decode", { enumerable: true, get: function () { return base58_1.base58Decode; } });
-Object.defineProperty(exports, "isValidBase58", { enumerable: true, get: function () { return base58_1.isValidBase58; } });
-// Compliance Verification (with JSON Schema draft-07 support)
-var schema_verifier_1 = require("./compliance/schema-verifier");
-Object.defineProperty(exports, "SchemaVerifier", { enumerable: true, get: function () { return schema_verifier_1.SchemaVerifier; } });
-Object.defineProperty(exports, "createSchemaVerifier", { enumerable: true, get: function () { return schema_verifier_1.createSchemaVerifier; } });
-var schema_registry_1 = require("./compliance/schema-registry");
-Object.defineProperty(exports, "SCHEMA_REGISTRY", { enumerable: true, get: function () { return schema_registry_1.SCHEMA_REGISTRY; } });
-Object.defineProperty(exports, "getAllSchemas", { enumerable: true, get: function () { return schema_registry_1.getAllSchemas; } });
-Object.defineProperty(exports, "getSchemasByCategory", { enumerable: true, get: function () { return schema_registry_1.getSchemasByCategory; } });
-Object.defineProperty(exports, "getSchemaById", { enumerable: true, get: function () { return schema_registry_1.getSchemaById; } });
-Object.defineProperty(exports, "getCriticalSchemas", { enumerable: true, get: function () { return schema_registry_1.getCriticalSchemas; } });
-Object.defineProperty(exports, "getSchemaStats", { enumerable: true, get: function () { return schema_registry_1.getSchemaStats; } });
+// Delegation VC JWT utilities
 var utils_1 = require("./delegation/utils");
 Object.defineProperty(exports, "canonicalizeJSON", { enumerable: true, get: function () { return utils_1.canonicalizeJSON; } });
 Object.defineProperty(exports, "createUnsignedVCJWT", { enumerable: true, get: function () { return utils_1.createUnsignedVCJWT; } });
 Object.defineProperty(exports, "completeVCJWT", { enumerable: true, get: function () { return utils_1.completeVCJWT; } });
 Object.defineProperty(exports, "parseVCJWT", { enumerable: true, get: function () { return utils_1.parseVCJWT; } });
-// Base64 utilities for VC JWT encoding
-var base64_1 = require("./utils/base64");
-Object.defineProperty(exports, "base64urlEncodeFromBytes", { enumerable: true, get: function () { return base64_1.base64urlEncodeFromBytes; } });
-Object.defineProperty(exports, "base64urlEncodeFromString", { enumerable: true, get: function () { return base64_1.base64urlEncodeFromString; } });
-Object.defineProperty(exports, "base64urlDecodeToBytes", { enumerable: true, get: function () { return base64_1.base64urlDecodeToBytes; } });
-Object.defineProperty(exports, "base64urlDecodeToString", { enumerable: true, get: function () { return base64_1.base64urlDecodeToString; } });
-Object.defineProperty(exports, "bytesToBase64", { enumerable: true, get: function () { return base64_1.bytesToBase64; } });
-// Configuration types and utilities
-__exportStar(require("./config"), exports);
-// Remote configuration fetching
-var remote_config_1 = require("./config/remote-config");
-Object.defineProperty(exports, "fetchRemoteConfig", { enumerable: true, get: function () { return remote_config_1.fetchRemoteConfig; } });
-// Tool protection helpers
-Object.defineProperty(exports, "getToolProtection", { enumerable: true, get: function () { return remote_config_1.getToolProtection; } });
-Object.defineProperty(exports, "extractToolProtections", { enumerable: true, get: function () { return remote_config_1.extractToolProtections; } });
-Object.defineProperty(exports, "hasMergedToolProtections", { enumerable: true, get: function () { return remote_config_1.hasMergedToolProtections; } });
-// Policy helpers (v1.7.0)
-Object.defineProperty(exports, "getPolicy", { enumerable: true, get: function () { return remote_config_1.getPolicy; } });
-Object.defineProperty(exports, "extractPolicy", { enumerable: true, get: function () { return remote_config_1.extractPolicy; } });
-Object.defineProperty(exports, "hasMergedPolicy", { enumerable: true, get: function () { return remote_config_1.hasMergedPolicy; } });
-Object.defineProperty(exports, "isPolicyEnabled", { enumerable: true, get: function () { return remote_config_1.isPolicyEnabled; } });
-// User DID Manager (Phase 4)
-var user_did_manager_1 = require("./identity/user-did-manager");
-Object.defineProperty(exports, "UserDidManager", { enumerable: true, get: function () { return user_did_manager_1.UserDidManager; } });
-// IDP Token Resolver (Phase 1 - MH-7, updated for CRED-003)
-var idp_token_resolver_1 = require("./identity/idp-token-resolver");
-Object.defineProperty(exports, "IdpTokenResolver", { enumerable: true, get: function () { return idp_token_resolver_1.IdpTokenResolver; } });
-// Logger (transport-aware logging)
-var logging_1 = require("./logging");
-Object.defineProperty(exports, "logger", { enumerable: true, get: function () { return logging_1.logger; } });
-Object.defineProperty(exports, "createDefaultConsoleLogger", { enumerable: true, get: function () { return logging_1.createDefaultConsoleLogger; } });
-// Proof generation (platform-agnostic protocol reference — Phase 2)
-var proof_1 = require("./proof");
-Object.defineProperty(exports, "ProofGenerator", { enumerable: true, get: function () { return proof_1.ProofGenerator; } });
-Object.defineProperty(exports, "createProofResponse", { enumerable: true, get: function () { return proof_1.createProofResponse; } });
-Object.defineProperty(exports, "extractCanonicalData", { enumerable: true, get: function () { return proof_1.extractCanonicalData; } });
-// Session management (platform-agnostic protocol reference — Phase 2)
-var session_1 = require("./session");
-Object.defineProperty(exports, "SessionManager", { enumerable: true, get: function () { return session_1.SessionManager; } });
-Object.defineProperty(exports, "createHandshakeRequest", { enumerable: true, get: function () { return session_1.createHandshakeRequest; } });
-Object.defineProperty(exports, "validateHandshakeFormat", { enumerable: true, get: function () { return session_1.validateHandshakeFormat; } });
-// Auth handshake (platform-agnostic protocol reference — Phase 2)
-var auth_1 = require("./auth");
-Object.defineProperty(exports, "verifyOrHints", { enumerable: true, get: function () { return auth_1.verifyOrHints; } });
-Object.defineProperty(exports, "hasSensitiveScopes", { enumerable: true, get: function () { return auth_1.hasSensitiveScopes; } });
-Object.defineProperty(exports, "MemoryResumeTokenStore", { enumerable: true, get: function () { return auth_1.MemoryResumeTokenStore; } });
+// Level 2 capability attestation validator (spec follow-up to
+// modelcontextprotocol-identity#46)
+var index_js_1 = require("./conformance/index.js");
+Object.defineProperty(exports, "validateLevel2", { enumerable: true, get: function () { return index_js_1.validateLevel2; } });
+Object.defineProperty(exports, "DEFAULT_TRUSTED_ISSUERS", { enumerable: true, get: function () { return index_js_1.DEFAULT_TRUSTED_ISSUERS; } });
 //# sourceMappingURL=index.js.map

package/dist/utils/base58.d.ts

@@ -1,31 +1,7 @@
 /**
- * Base58 Utilities (Bitcoin alphabet)
- *
- * Encoding and decoding utilities for Base58 (Bitcoin alphabet).
- * Used for did:key multibase encoding (with 'z' prefix for base58btc).
- *
- * The Bitcoin alphabet excludes ambiguous characters (0, O, I, l).
+ * Compatibility re-export. The implementation moved to @kya-os/mcp-i-runtime
+ * (C4 Step 2). Kept here so the pinned `src/delegation/**` (E3.5 #2904) keeps
+ * resolving its `../utils/base58` import without being modified.
  */
-/**
- * Encode bytes to Base58 (Bitcoin alphabet)
- *
- * @param bytes - Bytes to encode
- * @returns Base58-encoded string
- */
-export declare function base58Encode(bytes: Uint8Array): string;
-/**
- * Decode Base58 (Bitcoin alphabet) to bytes
- *
- * @param encoded - Base58-encoded string
- * @returns Decoded bytes
- * @throws Error if input contains invalid characters
- */
-export declare function base58Decode(encoded: string): Uint8Array;
-/**
- * Validate a Base58 string
- *
- * @param encoded - String to validate
- * @returns true if valid Base58, false otherwise
- */
-export declare function isValidBase58(encoded: string): boolean;
+export * from "@kya-os/mcp-i-runtime/utils/base58";
 //# sourceMappingURL=base58.d.ts.map

package/dist/utils/base58.js

@@ -1,103 +1,23 @@
 "use strict";
-/**
- * Base58 Utilities (Bitcoin alphabet)
- *
- * Encoding and decoding utilities for Base58 (Bitcoin alphabet).
- * Used for did:key multibase encoding (with 'z' prefix for base58btc).
- *
- * The Bitcoin alphabet excludes ambiguous characters (0, O, I, l).
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.base58Encode = base58Encode;
-exports.base58Decode = base58Decode;
-exports.isValidBase58 = isValidBase58;
-const ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
-const ALPHABET_MAP = new Map();
-// Build reverse lookup map
-for (let i = 0; i < ALPHABET.length; i++) {
-    ALPHABET_MAP.set(ALPHABET[i], i);
-}
-/**
- * Encode bytes to Base58 (Bitcoin alphabet)
- *
- * @param bytes - Bytes to encode
- * @returns Base58-encoded string
- */
-function base58Encode(bytes) {
-    if (bytes.length === 0)
-        return '';
-    // Convert bytes to big integer
-    let num = BigInt(0);
-    for (let i = 0; i < bytes.length; i++) {
-        num = num * BigInt(256) + BigInt(bytes[i]);
-    }
-    // Convert to base58
-    let result = '';
-    while (num > 0) {
-        result = ALPHABET[Number(num % BigInt(58))] + result;
-        num = num / BigInt(58);
-    }
-    // Add leading zeros (encoded as '1' in base58)
-    for (let i = 0; i < bytes.length && bytes[i] === 0; i++) {
-        result = '1' + result;
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
     }
-    return result;
-}
-/**
- * Decode Base58 (Bitcoin alphabet) to bytes
- *
- * @param encoded - Base58-encoded string
- * @returns Decoded bytes
- * @throws Error if input contains invalid characters
- */
-function base58Decode(encoded) {
-    if (encoded.length === 0)
-        return new Uint8Array(0);
-    // Convert base58 to big integer
-    let num = BigInt(0);
-    for (const char of encoded) {
-        const value = ALPHABET_MAP.get(char);
-        if (value === undefined) {
-            throw new Error(`Invalid base58 character: ${char}`);
-        }
-        num = num * BigInt(58) + BigInt(value);
-    }
-    // Convert big integer to bytes
-    const bytes = [];
-    while (num > 0) {
-        bytes.unshift(Number(num % BigInt(256)));
-        num = num / BigInt(256);
-    }
-    // Count leading zeros in input (encoded as '1')
-    let leadingZeros = 0;
-    for (const char of encoded) {
-        if (char === '1') {
-            leadingZeros++;
-        }
-        else {
-            break;
-        }
-    }
-    // Prepend leading zero bytes
-    const result = new Uint8Array(leadingZeros + bytes.length);
-    // Leading zeros are already 0 in Uint8Array
-    result.set(bytes, leadingZeros);
-    return result;
-}
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
 /**
- * Validate a Base58 string
- *
- * @param encoded - String to validate
- * @returns true if valid Base58, false otherwise
+ * Compatibility re-export. The implementation moved to @kya-os/mcp-i-runtime
+ * (C4 Step 2). Kept here so the pinned `src/delegation/**` (E3.5 #2904) keeps
+ * resolving its `../utils/base58` import without being modified.
  */
-function isValidBase58(encoded) {
-    if (encoded.length === 0)
-        return true;
-    for (const char of encoded) {
-        if (!ALPHABET_MAP.has(char)) {
-            return false;
-        }
-    }
-    return true;
-}
+__exportStar(require("@kya-os/mcp-i-runtime/utils/base58"), exports);
 //# sourceMappingURL=base58.js.map

package/dist/utils/base64.d.ts

@@ -1,32 +1,7 @@
 /**
- * Base64URL Encoding/Decoding Utilities
- *
- * Environment-aware base64url helpers that work in both Node.js and Cloudflare Workers.
- * Uses Buffer in Node.js, TextEncoder/Decoder fallback for Workers.
+ * Compatibility re-export. The implementation moved to @kya-os/mcp-i-runtime
+ * (C4 Step 2). Kept here so the pinned `src/delegation/**` (E3.5 #2904) keeps
+ * resolving its `../utils/base64` import without being modified.
  */
-/**
- * Decode base64url string to string
- */
-export declare function base64urlDecodeToString(input: string): string;
-/**
- * Decode base64url string to Uint8Array
- */
-export declare function base64urlDecodeToBytes(input: string): Uint8Array;
-/**
- * Encode string to base64url
- */
-export declare function base64urlEncodeFromString(input: string): string;
-/**
- * Encode Uint8Array to base64url
- */
-export declare function base64urlEncodeFromBytes(bytes: Uint8Array): string;
-/**
- * Convert bytes to standard base64 (not base64url)
- */
-export declare function bytesToBase64(bytes: Uint8Array): string;
-/**
- * Convert standard base64 or base64url to bytes
- * Handles both standard base64 (+/) and base64url (-_) formats
- */
-export declare function base64ToBytes(base64: string): Uint8Array;
+export * from "@kya-os/mcp-i-runtime/utils/base64";
 //# sourceMappingURL=base64.d.ts.map

package/dist/utils/base64.js

@@ -1,172 +1,23 @@
 "use strict";
-/**
- * Base64URL Encoding/Decoding Utilities
- *
- * Environment-aware base64url helpers that work in both Node.js and Cloudflare Workers.
- * Uses Buffer in Node.js, TextEncoder/Decoder fallback for Workers.
- */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.base64urlDecodeToString = base64urlDecodeToString;
-exports.base64urlDecodeToBytes = base64urlDecodeToBytes;
-exports.base64urlEncodeFromString = base64urlEncodeFromString;
-exports.base64urlEncodeFromBytes = base64urlEncodeFromBytes;
-exports.bytesToBase64 = bytesToBase64;
-exports.base64ToBytes = base64ToBytes;
-/**
- * Decode base64url string to string
- */
-function base64urlDecodeToString(input) {
-    const padded = addPadding(input);
-    const base64 = padded.replace(/-/g, "+").replace(/_/g, "/");
-    // Prefer Buffer when available (Node.js) as it handles UTF-8 correctly
-    if (typeof Buffer !== "undefined") {
-        // Buffer.from doesn't throw for invalid base64, so we validate first
-        const base64Regex = /^[A-Za-z0-9+/]*={0,2}$/;
-        if (!base64Regex.test(base64)) {
-            throw new Error("Invalid base64url string: contains invalid characters");
-        }
-        try {
-            const decoded = Buffer.from(base64, "base64").toString("utf-8");
-            return decoded;
-        }
-        catch (error) {
-            throw new Error(`Invalid base64url string: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    }
-    // For platforms that don't have Buffer (e.g., Cloudflare Workers)
-    if (typeof atob !== "undefined") {
-        try {
-            const binaryString = atob(base64);
-            // Decode UTF-8 bytes to string
-            if (typeof TextDecoder !== "undefined") {
-                const bytes = new Uint8Array(binaryString.length);
-                for (let i = 0; i < binaryString.length; i++) {
-                    bytes[i] = binaryString.charCodeAt(i);
-                }
-                return new TextDecoder().decode(bytes);
-            }
-            // Fallback: return binary string as-is (may not handle UTF-8 correctly)
-            return binaryString;
-        }
-        catch (error) {
-            throw new Error(`Invalid base64url string: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    }
-    throw new Error("Neither Buffer nor atob is available");
-}
 /**
- * Decode base64url string to Uint8Array
+ * Compatibility re-export. The implementation moved to @kya-os/mcp-i-runtime
+ * (C4 Step 2). Kept here so the pinned `src/delegation/**` (E3.5 #2904) keeps
+ * resolving its `../utils/base64` import without being modified.
  */
-function base64urlDecodeToBytes(input) {
-    const padded = addPadding(input);
-    const base64 = padded.replace(/-/g, "+").replace(/_/g, "/");
-    // For platforms that don't have Buffer (e.g., Cloudflare Workers)
-    if (typeof atob !== "undefined") {
-        try {
-            const binaryString = atob(base64);
-            const bytes = new Uint8Array(binaryString.length);
-            for (let i = 0; i < binaryString.length; i++) {
-                bytes[i] = binaryString.charCodeAt(i);
-            }
-            return bytes;
-        }
-        catch (error) {
-            throw new Error(`Invalid base64url string: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    }
-    // For Node.js environments - Buffer.from doesn't throw, so we can't validate here
-    // The caller should validate the result if needed
-    return new Uint8Array(Buffer.from(base64, "base64"));
-}
-/**
- * Encode string to base64url
- */
-function base64urlEncodeFromString(input) {
-    // Prefer Buffer when available (Node.js) as it handles Unicode correctly
-    if (typeof Buffer !== "undefined") {
-        const base64 = Buffer.from(input, "utf-8").toString("base64");
-        return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-    }
-    // For platforms that don't have Buffer (e.g., Cloudflare Workers)
-    if (typeof btoa !== "undefined") {
-        // btoa doesn't handle Unicode, so we need to encode to UTF-8 bytes first
-        try {
-            const utf8Bytes = new TextEncoder().encode(input);
-            const binaryString = Array.from(utf8Bytes)
-                .map((byte) => String.fromCharCode(byte))
-                .join("");
-            const base64 = btoa(binaryString);
-            return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-        }
-        catch {
-            // Fallback: if TextEncoder not available, try direct btoa (may fail for Unicode)
-            const base64 = btoa(input);
-            return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-        }
-    }
-    throw new Error("Neither Buffer nor btoa is available");
-}
-/**
- * Encode Uint8Array to base64url
- */
-function base64urlEncodeFromBytes(bytes) {
-    // For platforms that don't have Buffer
-    if (typeof btoa !== "undefined") {
-        const binaryString = Array.from(bytes)
-            .map((byte) => String.fromCharCode(byte))
-            .join("");
-        const base64 = btoa(binaryString);
-        return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-    }
-    // For Node.js environments
-    const base64 = Buffer.from(bytes).toString("base64");
-    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-}
-/**
- * Convert bytes to standard base64 (not base64url)
- */
-function bytesToBase64(bytes) {
-    // For platforms that don't have Buffer
-    if (typeof btoa !== "undefined") {
-        const binaryString = Array.from(bytes)
-            .map((byte) => String.fromCharCode(byte))
-            .join("");
-        return btoa(binaryString);
-    }
-    // For Node.js environments
-    return Buffer.from(bytes).toString("base64");
-}
-/**
- * Convert standard base64 or base64url to bytes
- * Handles both standard base64 (+/) and base64url (-_) formats
- */
-function base64ToBytes(base64) {
-    // Convert base64url to standard base64 if needed
-    // Base64url uses - instead of + and _ instead of /
-    let standardBase64 = base64.replace(/-/g, "+").replace(/_/g, "/");
-    // Add padding if needed (base64url often omits padding)
-    const paddingNeeded = (4 - (standardBase64.length % 4)) % 4;
-    standardBase64 += "=".repeat(paddingNeeded);
-    // For platforms that don't have Buffer
-    if (typeof atob !== "undefined") {
-        const binaryString = atob(standardBase64);
-        const bytes = new Uint8Array(binaryString.length);
-        for (let i = 0; i < binaryString.length; i++) {
-            bytes[i] = binaryString.charCodeAt(i);
-        }
-        return bytes;
-    }
-    // For Node.js environments
-    return new Uint8Array(Buffer.from(standardBase64, "base64"));
-}
-/**
- * Add padding to base64url string if needed
- */
-function addPadding(input) {
-    const remainder = input.length % 4;
-    if (remainder === 0) {
-        return input;
-    }
-    return input + "=".repeat((4 - remainder) % 4);
-}
+__exportStar(require("@kya-os/mcp-i-runtime/utils/base64"), exports);
 //# sourceMappingURL=base64.js.map