@kya-os/mcp-i-core 1.7.0 → 1.8.1

package/dist/proof/generator.js

@@ -1,236 +0,0 @@
-"use strict";
-/**
- * Proof Generation — Platform-agnostic Protocol Reference
- *
- * Handles JCS canonicalization, SHA-256 digest generation, and Ed25519 JWS
- * signing (compact format) according to MCP-I requirements 5.1, 5.2, 5.3, 5.6.
- *
- * This module is the authoritative proof implementation. All platform adapters
- * (Node.js, Cloudflare Workers) inject a CryptoProvider and delegate here.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ProofGenerator = void 0;
-exports.createProofResponse = createProofResponse;
-exports.extractCanonicalData = extractCanonicalData;
-const jose_1 = require("jose");
-const json_canonicalize_1 = require("json-canonicalize");
-const crypto_service_1 = require("../services/crypto.service");
-/**
- * Platform-agnostic proof generator.
- * Requires a CryptoProvider for all cryptographic operations.
- */
-class ProofGenerator {
-    identity;
-    cryptoProvider;
-    constructor(identity, cryptoProvider) {
-        this.identity = identity;
-        this.cryptoProvider = cryptoProvider;
-    }
-    /**
-     * Generate proof for tool request/response.
-     * Requirements: 5.1, 5.2, 5.3, 5.6
-     */
-    async generateProof(request, response, session, options = {}) {
-        const hashes = await this.generateCanonicalHashes(request, response);
-        const meta = {
-            did: this.identity.did,
-            kid: this.identity.kid,
-            ts: Math.floor(Date.now() / 1000),
-            nonce: session.nonce,
-            audience: session.audience,
-            sessionId: session.sessionId,
-            requestHash: hashes.requestHash,
-            responseHash: hashes.responseHash,
-            ...options,
-        };
-        const jws = await this.generateJWS(meta);
-        return { jws, meta };
-    }
-    /**
-     * Generate canonical hashes for request and response.
-     * Requirement: 5.1
-     */
-    async generateCanonicalHashes(request, response) {
-        const canonicalRequest = {
-            method: request.method,
-            ...(request.params ? { params: request.params } : {}),
-        };
-        const canonicalResponse = response.data;
-        const requestHash = await this.generateSHA256Hash(canonicalRequest);
-        const responseHash = await this.generateSHA256Hash(canonicalResponse);
-        return { requestHash, responseHash };
-    }
-    /**
-     * Generate SHA-256 hash with JCS canonicalization.
-     * Requirement: 5.2
-     *
-     * Delegates to CryptoProvider.hash() which must return "sha256:<hex>".
-     */
-    async generateSHA256Hash(data) {
-        const canonicalJson = this.canonicalizeJSON(data);
-        const encoded = new TextEncoder().encode(canonicalJson);
-        return this.cryptoProvider.hash(encoded);
-    }
-    /**
-     * JCS canonicalization implementation (RFC 8785)
-     */
-    canonicalizeJSON(obj) {
-        return (0, json_canonicalize_1.canonicalize)(obj);
-    }
-    /**
-     * Generate Ed25519 JWS in compact format (header.payload.signature).
-     * Requirement: 5.3
-     *
-     * Uses standard JWT claims (aud, sub, iss) in addition to custom claims.
-     */
-    async generateJWS(meta) {
-        try {
-            const privateKeyPem = this.formatPrivateKeyAsPEM(this.identity.privateKey);
-            const privateKey = await (0, jose_1.importPKCS8)(privateKeyPem, "EdDSA");
-            const payload = {
-                aud: meta.audience,
-                sub: meta.did,
-                iss: meta.did,
-                requestHash: meta.requestHash,
-                responseHash: meta.responseHash,
-                ts: meta.ts,
-                nonce: meta.nonce,
-                sessionId: meta.sessionId,
-                ...(meta.scopeId && { scopeId: meta.scopeId }),
-                ...(meta.delegationRef && { delegationRef: meta.delegationRef }),
-                ...(meta.clientDid && { clientDid: meta.clientDid }),
-            };
-            const jwt = await new jose_1.SignJWT(payload)
-                .setProtectedHeader({
-                alg: "EdDSA",
-                kid: this.identity.kid,
-            })
-                .sign(privateKey);
-            return jwt;
-        }
-        catch (error) {
-            throw new Error(`Failed to generate JWS: ${error instanceof Error ? error.message : "Unknown error"}`);
-        }
-    }
-    /**
-     * Format base64 private key as PKCS#8 PEM for JOSE library.
-     */
-    formatPrivateKeyAsPEM(base64PrivateKey) {
-        // Decode the base64 private key bytes
-        // Use platform-agnostic approach (atob + Uint8Array)
-        const binaryStr = atob(base64PrivateKey);
-        const keyData = new Uint8Array(binaryStr.length);
-        for (let i = 0; i < binaryStr.length; i++) {
-            keyData[i] = binaryStr.charCodeAt(i);
-        }
-        // Ed25519 PKCS#8 header (ASN.1 encoding)
-        const pkcs8Header = new Uint8Array([
-            0x30,
-            0x2e, // SEQUENCE, length 46
-            0x02,
-            0x01,
-            0x00, // INTEGER version 0
-            0x30,
-            0x05, // SEQUENCE, length 5
-            0x06,
-            0x03,
-            0x2b,
-            0x65,
-            0x70, // OID for Ed25519
-            0x04,
-            0x22, // OCTET STRING, length 34
-            0x04,
-            0x20, // OCTET STRING, length 32 (the actual key)
-        ]);
-        // Take first 32 bytes of key (Ed25519 raw private key)
-        const rawKey = keyData.subarray(0, 32);
-        const fullKey = new Uint8Array(pkcs8Header.length + rawKey.length);
-        fullKey.set(pkcs8Header);
-        fullKey.set(rawKey, pkcs8Header.length);
-        // Base64-encode the full DER-encoded key
-        let binaryStrOut = "";
-        for (let i = 0; i < fullKey.length; i++) {
-            binaryStrOut += String.fromCharCode(fullKey[i]);
-        }
-        const base64Key = btoa(binaryStrOut);
-        // Format as PEM with 64-char line breaks
-        const formattedKey = base64Key.match(/.{1,64}/g)?.join("\n") ?? base64Key;
-        return ("-----BEGIN PRIVATE KEY-----\n" +
-            formattedKey +
-            "\n-----END PRIVATE KEY-----");
-    }
-    /**
-     * Verify a proof (for testing/validation).
-     */
-    async verifyProof(proof, request, response) {
-        try {
-            const expectedHashes = await this.generateCanonicalHashes(request, response);
-            if (proof.meta.requestHash !== expectedHashes.requestHash ||
-                proof.meta.responseHash !== expectedHashes.responseHash) {
-                return false;
-            }
-            const publicKeyJwk = this.base64PublicKeyToJWK(this.identity.publicKey);
-            const cryptoService = new crypto_service_1.CryptoService(this.cryptoProvider);
-            return cryptoService.verifyJWS(proof.jws, publicKeyJwk, {
-                expectedKid: this.identity.kid,
-                alg: "EdDSA",
-            });
-        }
-        catch {
-            return false;
-        }
-    }
-    /**
-     * Convert base64 public key to Ed25519 JWK format.
-     */
-    base64PublicKeyToJWK(publicKeyBase64) {
-        // Decode base64 to bytes (platform-agnostic)
-        const binaryStr = atob(publicKeyBase64);
-        const publicKeyBytes = new Uint8Array(binaryStr.length);
-        for (let i = 0; i < binaryStr.length; i++) {
-            publicKeyBytes[i] = binaryStr.charCodeAt(i);
-        }
-        if (publicKeyBytes.length !== 32) {
-            throw new Error(`Invalid Ed25519 public key length: ${publicKeyBytes.length}`);
-        }
-        // Convert to base64url
-        let binaryStrOut = "";
-        for (let i = 0; i < publicKeyBytes.length; i++) {
-            binaryStrOut += String.fromCharCode(publicKeyBytes[i]);
-        }
-        const base64url = btoa(binaryStrOut)
-            .replace(/\+/g, "-")
-            .replace(/\//g, "_")
-            .replace(/=/g, "");
-        return {
-            kty: "OKP",
-            crv: "Ed25519",
-            x: base64url,
-            kid: this.identity.kid,
-        };
-    }
-}
-exports.ProofGenerator = ProofGenerator;
-/**
- * Create a tool response with proof.
- */
-async function createProofResponse(request, data, identity, session, cryptoProvider, options = {}) {
-    const response = { data };
-    const proofGenerator = new ProofGenerator(identity, cryptoProvider);
-    const proof = await proofGenerator.generateProof(request, response, session, options);
-    response.meta = { proof };
-    return response;
-}
-/**
- * Extract canonical data for hashing (utility for testing).
- */
-function extractCanonicalData(request, response) {
-    return {
-        request: {
-            method: request.method,
-            ...(request.params ? { params: request.params } : {}),
-        },
-        response: response.data,
-    };
-}
-//# sourceMappingURL=generator.js.map

package/dist/proof/index.d.ts

@@ -1,5 +0,0 @@
-/**
- * Proof module — platform-agnostic proof generation reference implementation.
- */
-export { ProofGenerator, createProofResponse, extractCanonicalData, type ProofAgentIdentity, type ToolRequest, type ToolResponse, type ProofOptions, } from "./generator";
-//# sourceMappingURL=index.d.ts.map

package/dist/proof/index.js

@@ -1,11 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.extractCanonicalData = exports.createProofResponse = exports.ProofGenerator = void 0;
-/**
- * Proof module — platform-agnostic proof generation reference implementation.
- */
-var generator_1 = require("./generator");
-Object.defineProperty(exports, "ProofGenerator", { enumerable: true, get: function () { return generator_1.ProofGenerator; } });
-Object.defineProperty(exports, "createProofResponse", { enumerable: true, get: function () { return generator_1.createProofResponse; } });
-Object.defineProperty(exports, "extractCanonicalData", { enumerable: true, get: function () { return generator_1.extractCanonicalData; } });
-//# sourceMappingURL=index.js.map

package/dist/providers/base.d.ts

@@ -1,95 +0,0 @@
-/**
- * Base Provider Classes
- *
- * Abstract classes that define the provider interfaces for
- * platform-specific implementations.
- */
-/**
- * Cryptographic operations provider
- */
-export declare abstract class CryptoProvider {
-    abstract sign(data: Uint8Array, privateKey: string): Promise<Uint8Array>;
-    abstract verify(data: Uint8Array, signature: Uint8Array, publicKey: string): Promise<boolean>;
-    abstract generateKeyPair(): Promise<{
-        privateKey: string;
-        publicKey: string;
-    }>;
-    /**
-     * Compute SHA-256 hash of data.
-     * Returns "sha256:<hex>" format for cross-platform parity.
-     */
-    abstract hash(data: Uint8Array): Promise<string>;
-    abstract randomBytes(length: number): Promise<Uint8Array>;
-}
-/**
- * Clock/timing operations provider
- */
-export declare abstract class ClockProvider {
-    abstract now(): number;
-    abstract isWithinSkew(timestamp: number, skewSeconds: number): boolean;
-    abstract hasExpired(expiresAt: number): boolean;
-    abstract calculateExpiry(ttlSeconds: number): number;
-    abstract format(timestamp: number): string;
-}
-/**
- * Network fetch operations provider
- */
-export declare abstract class FetchProvider {
-    abstract resolveDID(did: string): Promise<any>;
-    abstract fetchStatusList(url: string): Promise<any>;
-    abstract fetchDelegationChain(id: string): Promise<any[]>;
-    abstract fetch(url: string, options?: any): Promise<Response>;
-}
-/**
- * Storage operations provider
- */
-export declare abstract class StorageProvider {
-    abstract get(key: string): Promise<string | null>;
-    abstract set(key: string, value: string): Promise<void>;
-    abstract delete(key: string): Promise<void>;
-    abstract exists(key: string): Promise<boolean>;
-    abstract list(prefix?: string): Promise<string[]>;
-}
-/**
- * Nonce cache provider
- * Handles replay prevention
- *
- * Nonces should be scoped per agent to prevent cross-agent replay attacks.
- * When agentDid is provided, implementations should use agent-scoped keys.
- */
-export declare abstract class NonceCacheProvider {
-    /**
-     * Check if a nonce has been used
-     * @param nonce - The nonce to check
-     * @param agentDid - Optional agent DID for scoping (prevents cross-agent replay attacks)
-     */
-    abstract has(nonce: string, agentDid?: string): Promise<boolean>;
-    /**
-     * Add a nonce to the cache
-     * @param nonce - The nonce to cache
-     * @param ttlSeconds - Time to live in seconds (callers now pass TTL, not absolute timestamp)
-     * @param agentDid - Optional agent DID for scoping (prevents cross-agent replay attacks)
-     */
-    abstract add(nonce: string, ttlSeconds: number, agentDid?: string): Promise<void>;
-    abstract cleanup(): Promise<void>;
-    abstract destroy(): Promise<void>;
-}
-/**
- * Identity provider for managing agent identities
- */
-export interface AgentIdentity {
-    did: string;
-    kid: string;
-    privateKey: string;
-    publicKey: string;
-    createdAt: string;
-    type: 'development' | 'production';
-    metadata?: Record<string, any>;
-}
-export declare abstract class IdentityProvider {
-    abstract getIdentity(): Promise<AgentIdentity>;
-    abstract saveIdentity(identity: AgentIdentity): Promise<void>;
-    abstract rotateKeys(): Promise<AgentIdentity>;
-    abstract deleteIdentity(): Promise<void>;
-}
-//# sourceMappingURL=base.d.ts.map

package/dist/providers/base.js

@@ -1,47 +0,0 @@
-"use strict";
-/**
- * Base Provider Classes
- *
- * Abstract classes that define the provider interfaces for
- * platform-specific implementations.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.IdentityProvider = exports.NonceCacheProvider = exports.StorageProvider = exports.FetchProvider = exports.ClockProvider = exports.CryptoProvider = void 0;
-/**
- * Cryptographic operations provider
- */
-class CryptoProvider {
-}
-exports.CryptoProvider = CryptoProvider;
-/**
- * Clock/timing operations provider
- */
-class ClockProvider {
-}
-exports.ClockProvider = ClockProvider;
-/**
- * Network fetch operations provider
- */
-class FetchProvider {
-}
-exports.FetchProvider = FetchProvider;
-/**
- * Storage operations provider
- */
-class StorageProvider {
-}
-exports.StorageProvider = StorageProvider;
-/**
- * Nonce cache provider
- * Handles replay prevention
- *
- * Nonces should be scoped per agent to prevent cross-agent replay attacks.
- * When agentDid is provided, implementations should use agent-scoped keys.
- */
-class NonceCacheProvider {
-}
-exports.NonceCacheProvider = NonceCacheProvider;
-class IdentityProvider {
-}
-exports.IdentityProvider = IdentityProvider;
-//# sourceMappingURL=base.js.map

package/dist/providers/memory.d.ts

@@ -1,42 +0,0 @@
-/**
- * Memory-based provider implementations
- *
- * Simple in-memory implementations for development and testing.
- */
-import { StorageProvider, NonceCacheProvider, IdentityProvider, AgentIdentity } from './base';
-/**
- * In-memory storage provider
- */
-export declare class MemoryStorageProvider extends StorageProvider {
-    private store;
-    get(key: string): Promise<string | null>;
-    set(key: string, value: string): Promise<void>;
-    delete(key: string): Promise<void>;
-    exists(key: string): Promise<boolean>;
-    list(prefix?: string): Promise<string[]>;
-}
-/**
- * In-memory nonce cache provider
- */
-export declare class MemoryNonceCacheProvider extends NonceCacheProvider {
-    private nonces;
-    has(nonce: string, agentDid?: string): Promise<boolean>;
-    add(nonce: string, ttlSeconds: number, agentDid?: string): Promise<void>;
-    cleanup(): Promise<void>;
-    destroy(): Promise<void>;
-}
-/**
- * In-memory identity provider
- */
-export declare class MemoryIdentityProvider extends IdentityProvider {
-    private identity?;
-    private cryptoProvider;
-    constructor(cryptoProvider?: any);
-    getIdentity(): Promise<AgentIdentity>;
-    saveIdentity(identity: AgentIdentity): Promise<void>;
-    rotateKeys(): Promise<AgentIdentity>;
-    deleteIdentity(): Promise<void>;
-    private generateIdentity;
-    private generateDIDFromPublicKey;
-}
-//# sourceMappingURL=memory.d.ts.map

package/dist/providers/memory.js

@@ -1,121 +0,0 @@
-"use strict";
-/**
- * Memory-based provider implementations
- *
- * Simple in-memory implementations for development and testing.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.MemoryIdentityProvider = exports.MemoryNonceCacheProvider = exports.MemoryStorageProvider = void 0;
-const base_1 = require("./base");
-/**
- * In-memory storage provider
- */
-class MemoryStorageProvider extends base_1.StorageProvider {
-    store = new Map();
-    async get(key) {
-        return this.store.get(key) ?? null;
-    }
-    async set(key, value) {
-        this.store.set(key, value);
-    }
-    async delete(key) {
-        this.store.delete(key);
-    }
-    async exists(key) {
-        return this.store.has(key);
-    }
-    async list(prefix) {
-        const keys = Array.from(this.store.keys());
-        if (prefix) {
-            return keys.filter(k => k.startsWith(prefix));
-        }
-        return keys;
-    }
-}
-exports.MemoryStorageProvider = MemoryStorageProvider;
-/**
- * In-memory nonce cache provider
- */
-class MemoryNonceCacheProvider extends base_1.NonceCacheProvider {
-    nonces = new Map();
-    async has(nonce, agentDid) {
-        const key = agentDid ? `nonce:${agentDid}:${nonce}` : `nonce:${nonce}`;
-        const expiry = this.nonces.get(key);
-        if (!expiry)
-            return false;
-        if (Date.now() > expiry) {
-            this.nonces.delete(key);
-            return false;
-        }
-        return true;
-    }
-    async add(nonce, ttlSeconds, agentDid) {
-        const key = agentDid ? `nonce:${agentDid}:${nonce}` : `nonce:${nonce}`;
-        // Convert TTL seconds to absolute expiration timestamp for storage
-        const expiresAt = Date.now() + (ttlSeconds * 1000);
-        this.nonces.set(key, expiresAt);
-    }
-    async cleanup() {
-        const now = Date.now();
-        for (const [nonce, expiry] of this.nonces) {
-            if (now > expiry) {
-                this.nonces.delete(nonce);
-            }
-        }
-    }
-    async destroy() {
-        this.nonces.clear();
-    }
-}
-exports.MemoryNonceCacheProvider = MemoryNonceCacheProvider;
-/**
- * In-memory identity provider
- */
-class MemoryIdentityProvider extends base_1.IdentityProvider {
-    identity;
-    cryptoProvider;
-    constructor(cryptoProvider) {
-        super();
-        this.cryptoProvider = cryptoProvider;
-    }
-    async getIdentity() {
-        if (!this.identity) {
-            this.identity = await this.generateIdentity();
-        }
-        return this.identity;
-    }
-    async saveIdentity(identity) {
-        this.identity = identity;
-    }
-    async rotateKeys() {
-        this.identity = await this.generateIdentity();
-        return this.identity;
-    }
-    async deleteIdentity() {
-        this.identity = undefined;
-    }
-    async generateIdentity() {
-        if (!this.cryptoProvider) {
-            throw new Error('Crypto provider required for identity generation');
-        }
-        const keyPair = await this.cryptoProvider.generateKeyPair();
-        const did = this.generateDIDFromPublicKey(keyPair.publicKey);
-        return {
-            did,
-            kid: `${did}#key-1`,
-            privateKey: keyPair.privateKey,
-            publicKey: keyPair.publicKey,
-            createdAt: new Date().toISOString(),
-            type: 'development'
-        };
-    }
-    generateDIDFromPublicKey(publicKey) {
-        // Simplified DID generation
-        const keyHash = Buffer.from(publicKey, 'base64')
-            .toString('base64url')
-            .substring(0, 32);
-        return `did:key:z${keyHash}`;
-    }
-}
-exports.MemoryIdentityProvider = MemoryIdentityProvider;
-//# sourceMappingURL=memory.js.map

package/dist/runtime/audit-logger.d.ts

@@ -1,37 +0,0 @@
-/**
- * Audit Logger Interface
- *
- * Platform-agnostic interface for audit logging in the MCP-I framework.
- * Implementations should be provided by platform-specific packages.
- */
-import type { AuditContext, AuditEventContext } from "@kya-os/contracts/audit";
-/**
- * Interface for audit logging implementations
- *
- * This interface is platform-agnostic and can be implemented by:
- * - Node.js implementations (using Node.js crypto)
- * - Cloudflare Workers implementations (using Web Crypto API)
- * - Other platform-specific implementations
- */
-export interface IAuditLogger {
-    /**
-     * Log an audit record (with session deduplication)
-     *
-     * This method logs audit records using the frozen audit.v1 format.
-     * Only the first call per session is logged (deduplication).
-     *
-     * @param context - Audit context with identity, session, hashes, and verification status
-     */
-    logAuditRecord(context: AuditContext): Promise<void>;
-    /**
-     * Log an event (without session deduplication)
-     *
-     * This method logs events using the frozen audit.v1 format.
-     * Unlike logAuditRecord(), this always logs the event, allowing
-     * multiple events per session (e.g., consent events).
-     *
-     * @param context - Event context with eventType, identity, session, and optional eventData
-     */
-    logEvent(context: AuditEventContext): Promise<void>;
-}
-//# sourceMappingURL=audit-logger.d.ts.map

package/dist/runtime/audit-logger.js

@@ -1,9 +0,0 @@
-"use strict";
-/**
- * Audit Logger Interface
- *
- * Platform-agnostic interface for audit logging in the MCP-I framework.
- * Implementations should be provided by platform-specific packages.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=audit-logger.js.map