@kya-os/mcp-i-core 1.7.0 → 1.8.1

package/dist/services/policy.service.d.ts

@@ -1,130 +0,0 @@
-/**
- * PolicyService - Evaluates agent access policies
- *
- * This service evaluates incoming requests against configured policy rules
- * to determine the appropriate enforcement action (allow, block, challenge, redirect).
- *
- * Policy evaluation order:
- * 1. Allow list (exempt agents, always allowed)
- * 2. Deny list (blocked agents, always blocked)
- * 3. Threshold checks (confidence, reputation)
- * 4. Custom rules (evaluated by priority, first match wins)
- * 5. Default action (if no rules match)
- *
- * @package @kya-os/mcp-i-core
- * @since 1.7.0
- */
-import type { PolicyConfig, EnforcementAction } from '@kya-os/contracts';
-/**
- * Context for policy evaluation
- * Contains all attributes about the request/agent that can be matched against
- */
-export interface PolicyEvaluationContext {
-    agentType?: string;
-    agentName?: string;
-    agentVendor?: string;
-    clientDid?: string;
-    agentDid?: string;
-    confidence?: number;
-    reputationScore?: number;
-    riskLevel?: 'low' | 'medium' | 'high' | 'critical';
-    path?: string;
-    method?: string;
-    origin?: string;
-    userAgent?: string;
-    signatureVerified?: boolean;
-    isAuthenticated?: boolean;
-    hasValidDelegation?: boolean;
-}
-/**
- * Result of policy evaluation
- */
-export interface PolicyEvaluationResult {
-    /** Enforcement action to take */
-    action: EnforcementAction;
-    /** Reason for the action */
-    reason: string;
-    /** Rule ID that matched (if any) */
-    ruleId?: string;
-    /** Rule name that matched (if any) */
-    ruleName?: string;
-    /** Redirect URL (if action is 'redirect') */
-    redirectUrl?: string;
-    /** Custom message from the matched rule */
-    message?: string;
-    /** Whether this was matched by allow/deny list */
-    matchType: 'allow-list' | 'deny-list' | 'threshold' | 'rule' | 'default';
-}
-/**
- * Service configuration
- */
-export interface PolicyServiceConfig {
-    /** Enable debug logging */
-    debug?: boolean;
-}
-export declare class PolicyService {
-    private config;
-    private policy;
-    constructor(policy?: PolicyConfig, config?: PolicyServiceConfig);
-    /**
-     * Update the policy configuration
-     */
-    setPolicy(policy: PolicyConfig): void;
-    /**
-     * Get the current policy configuration
-     */
-    getPolicy(): PolicyConfig;
-    /**
-     * Check if policy enforcement is enabled
-     */
-    isEnabled(): boolean;
-    /**
-     * Evaluate a request against the policy
-     *
-     * @param context - Request/agent context to evaluate
-     * @returns Evaluation result with action and reason
-     */
-    evaluate(context: PolicyEvaluationContext): PolicyEvaluationResult;
-    /**
-     * Check if context matches any allow list entry
-     */
-    private checkAllowList;
-    /**
-     * Check if context matches any deny list entry
-     */
-    private checkDenyList;
-    /**
-     * Check if context matches a list entry (allow or deny)
-     */
-    private matchesListEntry;
-    /**
-     * Check threshold-based enforcement
-     */
-    private checkThresholds;
-    /**
-     * Evaluate custom policy rules
-     */
-    private evaluateRules;
-    /**
-     * Check if context matches a rule (all conditions must match)
-     */
-    private matchesRule;
-    /**
-     * Check if context matches a single condition
-     */
-    private matchesCondition;
-    /**
-     * Get a value from the context by field name
-     */
-    private getContextValue;
-    /**
-     * Compare two values for equality
-     */
-    private compareEqual;
-    /**
-     * Sanitize context for logging (mask sensitive values)
-     */
-    private sanitizeContext;
-}
-export default PolicyService;
-//# sourceMappingURL=policy.service.d.ts.map

package/dist/services/policy.service.js

@@ -1,399 +0,0 @@
-"use strict";
-/**
- * PolicyService - Evaluates agent access policies
- *
- * This service evaluates incoming requests against configured policy rules
- * to determine the appropriate enforcement action (allow, block, challenge, redirect).
- *
- * Policy evaluation order:
- * 1. Allow list (exempt agents, always allowed)
- * 2. Deny list (blocked agents, always blocked)
- * 3. Threshold checks (confidence, reputation)
- * 4. Custom rules (evaluated by priority, first match wins)
- * 5. Default action (if no rules match)
- *
- * @package @kya-os/mcp-i-core
- * @since 1.7.0
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PolicyService = void 0;
-const contracts_1 = require("@kya-os/contracts");
-// ============================================================================
-// PolicyService Implementation
-// ============================================================================
-class PolicyService {
-    config;
-    policy;
-    constructor(policy, config) {
-        // Clone the default config to prevent mutation of the shared default
-        this.policy = policy ?? structuredClone(contracts_1.DEFAULT_POLICY_CONFIG);
-        this.config = config ?? {};
-    }
-    /**
-     * Update the policy configuration
-     */
-    setPolicy(policy) {
-        this.policy = policy;
-    }
-    /**
-     * Get the current policy configuration
-     */
-    getPolicy() {
-        return this.policy;
-    }
-    /**
-     * Check if policy enforcement is enabled
-     */
-    isEnabled() {
-        return this.policy.enabled ?? true;
-    }
-    /**
-     * Evaluate a request against the policy
-     *
-     * @param context - Request/agent context to evaluate
-     * @returns Evaluation result with action and reason
-     */
-    evaluate(context) {
-        // If policy is disabled, always allow
-        if (!this.isEnabled()) {
-            return {
-                action: 'allow',
-                reason: 'Policy enforcement disabled',
-                matchType: 'default',
-            };
-        }
-        // 1. Check allow list first (exempt agents)
-        const allowListMatch = this.checkAllowList(context);
-        if (allowListMatch) {
-            if (this.config.debug) {
-                console.error('[PolicyService] Allow list match', {
-                    context: this.sanitizeContext(context),
-                    match: allowListMatch,
-                });
-            }
-            return {
-                action: 'allow',
-                reason: `Allowed: ${allowListMatch.reason ?? 'On allow list'}`,
-                matchType: 'allow-list',
-            };
-        }
-        // 2. Check deny list (blocked agents)
-        const denyListMatch = this.checkDenyList(context);
-        if (denyListMatch) {
-            if (this.config.debug) {
-                console.error('[PolicyService] Deny list match', {
-                    context: this.sanitizeContext(context),
-                    match: denyListMatch,
-                });
-            }
-            return {
-                action: 'block',
-                reason: denyListMatch.reason ?? 'On deny list',
-                matchType: 'deny-list',
-            };
-        }
-        // 3. Check threshold-based enforcement
-        const thresholdResult = this.checkThresholds(context);
-        if (thresholdResult) {
-            if (this.config.debug) {
-                console.error('[PolicyService] Threshold match', {
-                    context: this.sanitizeContext(context),
-                    result: thresholdResult,
-                });
-            }
-            return thresholdResult;
-        }
-        // 4. Evaluate custom rules (by priority)
-        const ruleResult = this.evaluateRules(context);
-        if (ruleResult) {
-            if (this.config.debug) {
-                console.error('[PolicyService] Rule match', {
-                    context: this.sanitizeContext(context),
-                    result: ruleResult,
-                });
-            }
-            return ruleResult;
-        }
-        // 5. Default action
-        return {
-            action: this.policy.defaultAction ?? 'allow',
-            reason: 'No matching rules, using default action',
-            matchType: 'default',
-            redirectUrl: this.policy.defaultAction === 'redirect' ? this.policy.redirectUrl : undefined,
-        };
-    }
-    // ============================================================================
-    // Private Methods
-    // ============================================================================
-    /**
-     * Check if context matches any allow list entry
-     */
-    checkAllowList(context) {
-        if (!this.policy.allowList?.length) {
-            return null;
-        }
-        for (const entry of this.policy.allowList) {
-            if (this.matchesListEntry(context, entry)) {
-                return entry;
-            }
-        }
-        return null;
-    }
-    /**
-     * Check if context matches any deny list entry
-     */
-    checkDenyList(context) {
-        if (!this.policy.denyList?.length) {
-            return null;
-        }
-        for (const entry of this.policy.denyList) {
-            // Check if entry is active and not expired
-            if (entry.active === false)
-                continue;
-            if (entry.expiresAt && new Date(entry.expiresAt) < new Date())
-                continue;
-            if (this.matchesListEntry(context, entry)) {
-                return entry;
-            }
-        }
-        return null;
-    }
-    /**
-     * Check if context matches a list entry (allow or deny)
-     */
-    matchesListEntry(context, entry) {
-        // At least one identifier must match
-        if (entry.clientDid && context.clientDid === entry.clientDid)
-            return true;
-        if (entry.agentDid && context.agentDid === entry.agentDid)
-            return true;
-        if (entry.clientName && context.agentName?.toLowerCase() === entry.clientName.toLowerCase())
-            return true;
-        if (entry.agentType && context.agentType === entry.agentType)
-            return true;
-        return false;
-    }
-    /**
-     * Check threshold-based enforcement
-     */
-    checkThresholds(context) {
-        const thresholds = this.policy.thresholds;
-        if (!thresholds)
-            return null;
-        // If signed requests bypass thresholds and request is signed, skip threshold checks
-        if (thresholds.trustSignedRequests && context.signatureVerified) {
-            return null;
-        }
-        // Check trusted reputation threshold (bypass other checks)
-        if (context.reputationScore !== undefined &&
-            context.reputationScore >= thresholds.trustedReputationThreshold) {
-            return null; // Trusted, continue to rules
-        }
-        // Check confidence threshold
-        if (context.confidence !== undefined &&
-            context.confidence >= thresholds.confidenceThreshold) {
-            return {
-                action: thresholds.confidenceAction,
-                reason: `Detection confidence (${context.confidence}) exceeds threshold (${thresholds.confidenceThreshold})`,
-                matchType: 'threshold',
-                redirectUrl: thresholds.confidenceAction === 'redirect' ? this.policy.redirectUrl : undefined,
-            };
-        }
-        // Check minimum reputation score
-        if (thresholds.minReputationScore > 0 &&
-            context.reputationScore !== undefined &&
-            context.reputationScore < thresholds.minReputationScore) {
-            return {
-                action: thresholds.lowReputationAction,
-                reason: `Reputation score (${context.reputationScore}) below minimum (${thresholds.minReputationScore})`,
-                matchType: 'threshold',
-                redirectUrl: thresholds.lowReputationAction === 'redirect' ? this.policy.redirectUrl : undefined,
-            };
-        }
-        return null;
-    }
-    /**
-     * Evaluate custom policy rules
-     */
-    evaluateRules(context) {
-        const rules = this.policy.rules;
-        if (!rules?.length)
-            return null;
-        // Sort rules by priority (lower = higher priority)
-        const sortedRules = [...rules]
-            .filter((r) => r.enabled !== false)
-            .sort((a, b) => (a.priority ?? 100) - (b.priority ?? 100));
-        for (const rule of sortedRules) {
-            if (this.matchesRule(context, rule)) {
-                return {
-                    action: rule.action,
-                    reason: rule.description ?? rule.name,
-                    ruleId: rule.id,
-                    ruleName: rule.name,
-                    redirectUrl: rule.action === 'redirect' ? rule.redirectUrl : undefined,
-                    message: rule.message,
-                    matchType: 'rule',
-                };
-            }
-        }
-        return null;
-    }
-    /**
-     * Check if context matches a rule (all conditions must match)
-     */
-    matchesRule(context, rule) {
-        // All conditions must match (AND logic)
-        return rule.conditions.every((condition) => this.matchesCondition(context, condition));
-    }
-    /**
-     * Check if context matches a single condition
-     */
-    matchesCondition(context, condition) {
-        const value = this.getContextValue(context, condition.field);
-        const targetValue = condition.value;
-        // Handle null/undefined - these operators should return true when value is missing
-        if (value === undefined || value === null) {
-            return (condition.operator === 'notEquals' ||
-                condition.operator === 'notIn' ||
-                condition.operator === 'notContains');
-        }
-        switch (condition.operator) {
-            case 'equals':
-                return this.compareEqual(value, targetValue, condition.caseInsensitive);
-            case 'notEquals':
-                return !this.compareEqual(value, targetValue, condition.caseInsensitive);
-            case 'contains':
-                return typeof value === 'string' && typeof targetValue === 'string'
-                    ? condition.caseInsensitive
-                        ? value.toLowerCase().includes(targetValue.toLowerCase())
-                        : value.includes(targetValue)
-                    : false;
-            case 'notContains':
-                return typeof value === 'string' && typeof targetValue === 'string'
-                    ? condition.caseInsensitive
-                        ? !value.toLowerCase().includes(targetValue.toLowerCase())
-                        : !value.includes(targetValue)
-                    : true;
-            case 'startsWith':
-                return typeof value === 'string' && typeof targetValue === 'string'
-                    ? condition.caseInsensitive
-                        ? value.toLowerCase().startsWith(targetValue.toLowerCase())
-                        : value.startsWith(targetValue)
-                    : false;
-            case 'endsWith':
-                return typeof value === 'string' && typeof targetValue === 'string'
-                    ? condition.caseInsensitive
-                        ? value.toLowerCase().endsWith(targetValue.toLowerCase())
-                        : value.endsWith(targetValue)
-                    : false;
-            case 'greaterThan':
-                return typeof value === 'number' && typeof targetValue === 'number'
-                    ? value > targetValue
-                    : false;
-            case 'lessThan':
-                return typeof value === 'number' && typeof targetValue === 'number'
-                    ? value < targetValue
-                    : false;
-            case 'greaterThanOrEquals':
-                return typeof value === 'number' && typeof targetValue === 'number'
-                    ? value >= targetValue
-                    : false;
-            case 'lessThanOrEquals':
-                return typeof value === 'number' && typeof targetValue === 'number'
-                    ? value <= targetValue
-                    : false;
-            case 'matches':
-                if (typeof value !== 'string' || typeof targetValue !== 'string') {
-                    return false;
-                }
-                try {
-                    const flags = condition.caseInsensitive ? 'i' : '';
-                    return new RegExp(targetValue, flags).test(value);
-                }
-                catch {
-                    return false;
-                }
-            case 'in':
-                return Array.isArray(targetValue)
-                    ? targetValue.some((v) => this.compareEqual(value, v, condition.caseInsensitive))
-                    : false;
-            case 'notIn':
-                return Array.isArray(targetValue)
-                    ? !targetValue.some((v) => this.compareEqual(value, v, condition.caseInsensitive))
-                    : true;
-            default:
-                return false;
-        }
-    }
-    /**
-     * Get a value from the context by field name
-     */
-    getContextValue(context, field) {
-        switch (field) {
-            case 'agentType':
-                return context.agentType;
-            case 'agentName':
-                return context.agentName;
-            case 'agentVendor':
-                return context.agentVendor;
-            case 'clientDid':
-                return context.clientDid;
-            case 'agentDid':
-                return context.agentDid;
-            case 'confidence':
-                return context.confidence;
-            case 'reputationScore':
-                return context.reputationScore;
-            case 'riskLevel':
-                return context.riskLevel;
-            case 'path':
-                return context.path;
-            case 'method':
-                return context.method;
-            case 'origin':
-                return context.origin;
-            case 'userAgent':
-                return context.userAgent;
-            case 'signatureVerified':
-                return context.signatureVerified;
-            case 'isAuthenticated':
-                return context.isAuthenticated;
-            case 'hasValidDelegation':
-                return context.hasValidDelegation;
-            default:
-                return undefined;
-        }
-    }
-    /**
-     * Compare two values for equality
-     */
-    compareEqual(a, b, caseInsensitive) {
-        if (typeof a === 'string' && typeof b === 'string') {
-            return caseInsensitive ? a.toLowerCase() === b.toLowerCase() : a === b;
-        }
-        return a === b;
-    }
-    /**
-     * Sanitize context for logging (mask sensitive values)
-     */
-    sanitizeContext(context) {
-        return {
-            agentType: context.agentType,
-            agentName: context.agentName,
-            agentVendor: context.agentVendor,
-            clientDid: context.clientDid ? `${context.clientDid.slice(0, 20)}...` : undefined,
-            agentDid: context.agentDid ? `${context.agentDid.slice(0, 20)}...` : undefined,
-            confidence: context.confidence,
-            reputationScore: context.reputationScore,
-            riskLevel: context.riskLevel,
-            path: context.path,
-            method: context.method,
-            signatureVerified: context.signatureVerified,
-            isAuthenticated: context.isAuthenticated,
-            hasValidDelegation: context.hasValidDelegation,
-        };
-    }
-}
-exports.PolicyService = PolicyService;
-exports.default = PolicyService;
-//# sourceMappingURL=policy.service.js.map

package/dist/services/proof-verifier.d.ts

@@ -1,98 +0,0 @@
-/**
- * ProofVerifier
- *
- * Centralized proof verification service that validates DetachedProof
- * signatures, enforces nonce replay protection, and checks timestamp skew.
- */
-import { type Ed25519JWK } from "./crypto.service.js";
-import { CryptoProvider } from "../providers/base.js";
-import { ClockProvider } from "../providers/base.js";
-import { NonceCacheProvider } from "../providers/base.js";
-import { FetchProvider } from "../providers/base.js";
-import { type DetachedProof } from "@kya-os/contracts/proof";
-import { type ProofVerificationErrorCode } from "./errors.js";
-export interface ProofVerificationResult {
-    valid: boolean;
-    reason?: string;
-    error?: Error;
-    errorCode?: ProofVerificationErrorCode;
-    details?: Record<string, unknown>;
-}
-export interface ProofVerifierConfig {
-    cryptoProvider: CryptoProvider;
-    clockProvider: ClockProvider;
-    nonceCacheProvider: NonceCacheProvider;
-    fetchProvider: FetchProvider;
-    timestampSkewSeconds?: number;
-    nonceTtlSeconds?: number;
-}
-export declare class ProofVerifier {
-    private cryptoService;
-    private clock;
-    private nonceCache;
-    private fetch;
-    private timestampSkewSeconds;
-    private nonceTtlSeconds;
-    constructor(config: ProofVerifierConfig);
-    /**
-     * Verify a DetachedProof
-     * Automatically reconstructs canonical payload from proof.meta for signature verification
-     * @param proof - The proof to verify
-     * @param publicKeyJwk - Ed25519 public key in JWK format (from DID document)
-     * @returns Verification result
-     */
-    verifyProof(proof: DetachedProof, publicKeyJwk: Ed25519JWK): Promise<ProofVerificationResult>;
-    /**
-     * Verify proof with detached payload (for CLI/verifier compatibility)
-     * @param proof - The proof to verify
-     * @param canonicalPayload - Canonical JSON payload (for detached JWS) as string or Uint8Array
-     * @param publicKeyJwk - Ed25519 public key in JWK format
-     * @returns Verification result
-     */
-    verifyProofDetached(proof: DetachedProof, canonicalPayload: string | Uint8Array, publicKeyJwk: Ed25519JWK): Promise<ProofVerificationResult>;
-    /**
-     * Validate proof structure using Zod schema
-     * @private
-     */
-    private validateProofStructure;
-    /**
-     * Validate nonce replay protection
-     * @private
-     */
-    private validateNonce;
-    /**
-     * Validate timestamp skew
-     * @private
-     */
-    private validateTimestamp;
-    /**
-     * Verify JWS signature
-     * @private
-     */
-    private verifySignature;
-    /**
-     * Add nonce to cache to prevent replay (scoped to agent DID)
-     * @private
-     */
-    private addNonceToCache;
-    /**
-     * Fetch public key from DID document
-     * @param did - DID to resolve
-     * @param kid - Key ID (optional, defaults to first verification method)
-     * @returns Ed25519 JWK or null if not found
-     * @throws {ProofVerificationError} If DID resolution fails with specific error code
-     */
-    fetchPublicKeyFromDID(did: string, kid?: string): Promise<Ed25519JWK | null>;
-    /**
-     * Build canonical payload from proof meta
-     *
-     * CRITICAL: This must reconstruct the exact JWS payload structure that was originally signed.
-     * The original JWS payload uses standard JWT claims (aud, sub, iss) plus custom proof claims,
-     * NOT the proof.meta structure directly.
-     *
-     * @param meta - Proof metadata
-     * @returns Canonical JSON string matching the original JWS payload structure
-     */
-    buildCanonicalPayload(meta: DetachedProof["meta"]): string;
-}
-//# sourceMappingURL=proof-verifier.d.ts.map