@kya-os/mcp-i-core 1.7.0 → 1.8.1

package/dist/utils/did-helpers.d.ts

@@ -1,168 +1,7 @@
 /**
- * DID Validation and Helper Utilities
- *
- * Centralized utilities for DID validation, normalization, and handling.
- * Promotes DRY principle and consistency across the codebase.
- *
- * @package @kya-os/mcp-i-core/utils
+ * Compatibility re-export. The implementation moved to @kya-os/mcp-i-runtime
+ * (C4 Step 2). Kept here so the pinned `src/delegation/**` (E3.5 #2904) keeps
+ * resolving its `../utils/did-helpers` import without being modified.
  */
-/**
- * Check if a string is a valid DID format
- *
- * @param did - String to validate
- * @returns true if string starts with "did:"
- *
- * @example
- * ```typescript
- * isValidDid("did:key:z6Mk...") // true
- * isValidDid("not-a-did") // false
- * ```
- */
-export declare function isValidDid(did: string): boolean;
-/**
- * Get the DID method from a DID string
- *
- * @param did - DID string
- * @returns DID method (e.g., "key", "web") or null if invalid
- *
- * @example
- * ```typescript
- * getDidMethod("did:key:z6Mk...") // "key"
- * getDidMethod("did:web:example.com") // "web"
- * getDidMethod("invalid") // null
- * ```
- */
-export declare function getDidMethod(did: string): string | null;
-/**
- * Normalize a DID string (trim whitespace)
- *
- * @param did - DID string to normalize
- * @returns Normalized DID string
- *
- * @example
- * ```typescript
- * normalizeDid("  did:key:z6Mk...  ") // "did:key:z6Mk..."
- * ```
- */
-export declare function normalizeDid(did: string): string;
-/**
- * Compare two DIDs for equality (case-sensitive)
- *
- * @param did1 - First DID
- * @param did2 - Second DID
- * @returns true if DIDs are equal (after normalization)
- *
- * @example
- * ```typescript
- * compareDids("did:key:z6Mk...", "did:key:z6Mk...") // true
- * compareDids("did:key:z6Mk...", "did:web:example.com") // false
- * ```
- */
-export declare function compareDids(did1: string, did2: string): boolean;
-/**
- * Extract server DID from config (supports both old and new field names)
- *
- * Supports backward compatibility by reading both `serverDid` and deprecated `agentDid`.
- * Prefers `serverDid` if both are present.
- *
- * @param config - Config object with identity field
- * @returns Server DID string
- * @throws Error if neither serverDid nor agentDid is configured
- *
- * @example
- * ```typescript
- * // New config
- * getServerDid({ identity: { serverDid: "did:web:server.com" } }) // "did:web:server.com"
- *
- * // Old config (backward compatibility)
- * getServerDid({ identity: { agentDid: "did:web:server.com" } }) // "did:web:server.com"
- *
- * // Prefers serverDid over agentDid
- * getServerDid({ identity: { serverDid: "new", agentDid: "old" } }) // "new"
- * ```
- */
-export declare function getServerDid(config: {
-    identity: {
-        serverDid?: string;
-        agentDid?: string;
-    };
-}): string;
-/**
- * Extract agent ID from DID
- *
- * The agent ID is the last component of the DID.
- *
- * @param did - DID string
- * @returns Agent ID (last component of DID)
- *
- * @example
- * ```typescript
- * extractAgentId("did:web:knowthat.ai:agents:my-agent") // "my-agent"
- * extractAgentId("did:web:localhost:3000:agents:12912feb") // "12912feb"
- * extractAgentId("did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK") // "z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK"
- * ```
- */
-export declare function extractAgentId(did: string): string;
-/**
- * Extract agent slug from DID
- *
- * Agent slug is the same as agent ID - the last component of the DID.
- * For DID format: did:web:knowthat.ai:agents:my-agent
- * Returns: my-agent
- *
- * @param did - DID string
- * @returns Agent slug (last component of DID)
- *
- * @example
- * ```typescript
- * extractAgentSlug("did:web:knowthat.ai:agents:my-agent") // "my-agent"
- * extractAgentSlug("did:web:localhost:3000:agents:12912feb") // "12912feb"
- * ```
- */
-export declare function extractAgentSlug(did: string): string;
-/**
- * Generate a did:key from Ed25519 public key bytes
- *
- * Following spec: https://w3c-ccg.github.io/did-method-key/
- * Format: did:key:z<multibase-base58btc(<multicodec-ed25519-pub><publicKey>)>
- *
- * @param publicKeyBytes - Ed25519 public key as Uint8Array (32 bytes)
- * @returns did:key string
- *
- * @example
- * ```typescript
- * const publicKey = new Uint8Array(32); // 32-byte Ed25519 public key
- * const did = generateDidKeyFromBytes(publicKey);
- * // did = "did:key:z6Mk..."
- * ```
- */
-export declare function generateDidKeyFromBytes(publicKeyBytes: Uint8Array): string;
-/**
- * Generate a did:key from base64-encoded Ed25519 public key
- *
- * Convenience wrapper around generateDidKeyFromBytes for base64-encoded keys.
- *
- * @param publicKeyBase64 - Ed25519 public key as base64 string
- * @returns did:key string
- *
- * @example
- * ```typescript
- * const publicKeyBase64 = "...base64 encoded key...";
- * const did = generateDidKeyFromBase64(publicKeyBase64);
- * // did = "did:key:z6Mk..."
- * ```
- */
-export declare function generateDidKeyFromBase64(publicKeyBase64: string): string;
-/**
- * Get the spec-compliant fragment identifier for a did:key DID.
- *
- * Per the W3C CCG did:key spec, the fragment equals the multibase-encoded
- * public key value (the DID-specific-id). For example:
- *   did:key:z6MkABC... → z6MkABC...
- *
- * @see https://w3c-ccg.github.io/did-key-spec/#document-creation-algorithm
- * @param did - A DID string
- * @returns The fragment identifier (multibase value for did:key, or 'keys-1' fallback)
- */
-export declare function didKeyFragment(did: string): string;
+export * from "@kya-os/mcp-i-runtime/utils/did-helpers";
 //# sourceMappingURL=did-helpers.d.ts.map

package/dist/utils/did-helpers.js

@@ -1,222 +1,23 @@
 "use strict";
-/**
- * DID Validation and Helper Utilities
- *
- * Centralized utilities for DID validation, normalization, and handling.
- * Promotes DRY principle and consistency across the codebase.
- *
- * @package @kya-os/mcp-i-core/utils
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isValidDid = isValidDid;
-exports.getDidMethod = getDidMethod;
-exports.normalizeDid = normalizeDid;
-exports.compareDids = compareDids;
-exports.getServerDid = getServerDid;
-exports.extractAgentId = extractAgentId;
-exports.extractAgentSlug = extractAgentSlug;
-exports.generateDidKeyFromBytes = generateDidKeyFromBytes;
-exports.generateDidKeyFromBase64 = generateDidKeyFromBase64;
-exports.didKeyFragment = didKeyFragment;
-const base58_1 = require("./base58");
-/**
- * Check if a string is a valid DID format
- *
- * @param did - String to validate
- * @returns true if string starts with "did:"
- *
- * @example
- * ```typescript
- * isValidDid("did:key:z6Mk...") // true
- * isValidDid("not-a-did") // false
- * ```
- */
-function isValidDid(did) {
-    return typeof did === "string" && did.startsWith("did:");
-}
-/**
- * Get the DID method from a DID string
- *
- * @param did - DID string
- * @returns DID method (e.g., "key", "web") or null if invalid
- *
- * @example
- * ```typescript
- * getDidMethod("did:key:z6Mk...") // "key"
- * getDidMethod("did:web:example.com") // "web"
- * getDidMethod("invalid") // null
- * ```
- */
-function getDidMethod(did) {
-    if (!isValidDid(did)) {
-        return null;
-    }
-    const match = did.match(/^did:([^:]+):/);
-    return match ? match[1] : null;
-}
-/**
- * Normalize a DID string (trim whitespace)
- *
- * @param did - DID string to normalize
- * @returns Normalized DID string
- *
- * @example
- * ```typescript
- * normalizeDid("  did:key:z6Mk...  ") // "did:key:z6Mk..."
- * ```
- */
-function normalizeDid(did) {
-    return did.trim();
-}
-/**
- * Compare two DIDs for equality (case-sensitive)
- *
- * @param did1 - First DID
- * @param did2 - Second DID
- * @returns true if DIDs are equal (after normalization)
- *
- * @example
- * ```typescript
- * compareDids("did:key:z6Mk...", "did:key:z6Mk...") // true
- * compareDids("did:key:z6Mk...", "did:web:example.com") // false
- * ```
- */
-function compareDids(did1, did2) {
-    return normalizeDid(did1) === normalizeDid(did2);
-}
-/**
- * Extract server DID from config (supports both old and new field names)
- *
- * Supports backward compatibility by reading both `serverDid` and deprecated `agentDid`.
- * Prefers `serverDid` if both are present.
- *
- * @param config - Config object with identity field
- * @returns Server DID string
- * @throws Error if neither serverDid nor agentDid is configured
- *
- * @example
- * ```typescript
- * // New config
- * getServerDid({ identity: { serverDid: "did:web:server.com" } }) // "did:web:server.com"
- *
- * // Old config (backward compatibility)
- * getServerDid({ identity: { agentDid: "did:web:server.com" } }) // "did:web:server.com"
- *
- * // Prefers serverDid over agentDid
- * getServerDid({ identity: { serverDid: "new", agentDid: "old" } }) // "new"
- * ```
- */
-function getServerDid(config) {
-    const serverDid = config.identity.serverDid || config.identity.agentDid;
-    if (!serverDid) {
-        throw new Error("Server DID not configured");
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
     }
-    return serverDid;
-}
-/**
- * Extract agent ID from DID
- *
- * The agent ID is the last component of the DID.
- *
- * @param did - DID string
- * @returns Agent ID (last component of DID)
- *
- * @example
- * ```typescript
- * extractAgentId("did:web:knowthat.ai:agents:my-agent") // "my-agent"
- * extractAgentId("did:web:localhost:3000:agents:12912feb") // "12912feb"
- * extractAgentId("did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK") // "z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK"
- * ```
- */
-function extractAgentId(did) {
-    const parts = did.split(':');
-    return parts[parts.length - 1];
-}
-/**
- * Extract agent slug from DID
- *
- * Agent slug is the same as agent ID - the last component of the DID.
- * For DID format: did:web:knowthat.ai:agents:my-agent
- * Returns: my-agent
- *
- * @param did - DID string
- * @returns Agent slug (last component of DID)
- *
- * @example
- * ```typescript
- * extractAgentSlug("did:web:knowthat.ai:agents:my-agent") // "my-agent"
- * extractAgentSlug("did:web:localhost:3000:agents:12912feb") // "12912feb"
- * ```
- */
-function extractAgentSlug(did) {
-    return extractAgentId(did);
-}
-/**
- * Ed25519 multicodec prefix for did:key encoding
- * As per https://w3c-ccg.github.io/did-method-key/
- */
-const ED25519_MULTICODEC_PREFIX = new Uint8Array([0xed, 0x01]);
-/**
- * Generate a did:key from Ed25519 public key bytes
- *
- * Following spec: https://w3c-ccg.github.io/did-method-key/
- * Format: did:key:z<multibase-base58btc(<multicodec-ed25519-pub><publicKey>)>
- *
- * @param publicKeyBytes - Ed25519 public key as Uint8Array (32 bytes)
- * @returns did:key string
- *
- * @example
- * ```typescript
- * const publicKey = new Uint8Array(32); // 32-byte Ed25519 public key
- * const did = generateDidKeyFromBytes(publicKey);
- * // did = "did:key:z6Mk..."
- * ```
- */
-function generateDidKeyFromBytes(publicKeyBytes) {
-    // Combine multicodec prefix + public key
-    const multicodecKey = new Uint8Array(ED25519_MULTICODEC_PREFIX.length + publicKeyBytes.length);
-    multicodecKey.set(ED25519_MULTICODEC_PREFIX);
-    multicodecKey.set(publicKeyBytes, ED25519_MULTICODEC_PREFIX.length);
-    // Base58-btc encode and add multibase prefix 'z'
-    const base58Encoded = (0, base58_1.base58Encode)(multicodecKey);
-    return `did:key:z${base58Encoded}`;
-}
-/**
- * Generate a did:key from base64-encoded Ed25519 public key
- *
- * Convenience wrapper around generateDidKeyFromBytes for base64-encoded keys.
- *
- * @param publicKeyBase64 - Ed25519 public key as base64 string
- * @returns did:key string
- *
- * @example
- * ```typescript
- * const publicKeyBase64 = "...base64 encoded key...";
- * const did = generateDidKeyFromBase64(publicKeyBase64);
- * // did = "did:key:z6Mk..."
- * ```
- */
-function generateDidKeyFromBase64(publicKeyBase64) {
-    // Decode base64 to bytes
-    const publicKeyBytes = Uint8Array.from(atob(publicKeyBase64), (c) => c.charCodeAt(0));
-    return generateDidKeyFromBytes(publicKeyBytes);
-}
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
 /**
- * Get the spec-compliant fragment identifier for a did:key DID.
- *
- * Per the W3C CCG did:key spec, the fragment equals the multibase-encoded
- * public key value (the DID-specific-id). For example:
- *   did:key:z6MkABC... → z6MkABC...
- *
- * @see https://w3c-ccg.github.io/did-key-spec/#document-creation-algorithm
- * @param did - A DID string
- * @returns The fragment identifier (multibase value for did:key, or 'keys-1' fallback)
+ * Compatibility re-export. The implementation moved to @kya-os/mcp-i-runtime
+ * (C4 Step 2). Kept here so the pinned `src/delegation/**` (E3.5 #2904) keeps
+ * resolving its `../utils/did-helpers` import without being modified.
  */
-function didKeyFragment(did) {
-    if (did.startsWith('did:key:')) {
-        return did.slice('did:key:'.length);
-    }
-    // Fallback for non-did:key methods
-    return 'keys-1';
-}
+__exportStar(require("@kya-os/mcp-i-runtime/utils/did-helpers"), exports);
 //# sourceMappingURL=did-helpers.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kya-os/mcp-i-core",
-  "version": "1.7.0",
-  "description": "Core runtime and types for MCP-I framework",
+  "version": "1.8.1",
+  "description": "Compatibility shim — re-exports @kya-os/mcp-i-runtime (product layer) plus the pinned W3C-VC delegation modules. Prefer @kya-os/mcp-i-runtime directly.",
   "license": "MIT",
   "author": "Dylan Hobbs",
   "repository": {
@@ -16,10 +16,6 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
-    "./runtime/audit-logger": {
-      "types": "./dist/runtime/audit-logger.d.ts",
-      "default": "./dist/runtime/audit-logger.js"
-    },
     "./*": {
       "types": "./dist/*.d.ts",
       "default": "./dist/*.js"
@@ -35,7 +31,9 @@
     "prepublishOnly": "npm run build && node ../create-mcpi-app/scripts/validate-no-workspace.js"
   },
   "dependencies": {
-    "@kya-os/contracts": "^1.8.0",
+    "@kya-os/contracts": "^1.9.0",
+    "@kya-os/mcp": "^1.10.1",
+    "@kya-os/mcp-i-runtime": "^1.0.0",
     "jose": "^5.6.3",
     "json-canonicalize": "^2.0.0",
     "zod": "^3.25.67"

package/dist/auth/handshake.d.ts

@@ -1,119 +0,0 @@
-/**
- * Authorization Handshake — Platform-agnostic Protocol Reference
- *
- * Orchestrates the authorization flow for MCP-I bouncer:
- * 1. Check agent reputation (optional)
- * 2. Verify delegation exists
- * 3. Return needs_authorization error if missing
- *
- * This module uses only the global fetch API — no Node-specific imports.
- * It is safe to run on Node.js, Cloudflare Workers, and any fetch-capable runtime.
- *
- * Flow:
- * - If delegation exists + valid → allow (fast path)
- * - If delegation missing → return needs_authorization with hints
- * - If reputation too low (optional) → require authorization
- */
-import { NeedsAuthorizationError } from "@kya-os/contracts/runtime";
-import { DelegationRecord } from "@kya-os/contracts/delegation";
-import { DelegationVerifier, VerifyDelegationResult } from "./types";
-export type { DelegationVerifier, VerifyDelegationResult };
-/**
- * Agent reputation data from KTA
- */
-export interface AgentReputation {
-    agentDid: string;
-    score: number;
-    totalInteractions: number;
-    successRate: number;
-    riskLevel: "low" | "medium" | "high" | "unknown";
-    updatedAt: number;
-}
-/**
- * Configuration for auth handshake
- */
-export interface AuthHandshakeConfig {
-    delegationVerifier: DelegationVerifier;
-    resumeTokenStore: ResumeTokenStore;
-    kta?: {
-        apiUrl: string;
-        apiKey?: string;
-        apiFormat?: "kta" | "argus";
-    };
-    bouncer: {
-        authorizationUrl: string;
-        resumeTokenTtl?: number;
-        requireAuthForUnknown?: boolean;
-        minReputationScore?: number;
-    };
-    debug?: boolean;
-}
-/**
- * Result of auth handshake verification
- */
-export interface VerifyOrHintsResult {
-    authorized: boolean;
-    delegation?: DelegationRecord;
-    credential?: {
-        agent_did: string;
-        user_did: string;
-        scopes: string[];
-        authorization: {
-            type: "oauth" | "oauth2" | "password" | "credential" | "webauthn" | "siwe" | "none";
-            provider?: string;
-            credentialType?: string;
-            rpId?: string;
-            userVerification?: "required" | "preferred" | "discouraged";
-            chainId?: number;
-            domain?: string;
-        };
-        [key: string]: unknown;
-    };
-    authError?: NeedsAuthorizationError;
-    reputation?: AgentReputation;
-    reason?: string;
-}
-/**
- * Resume token store interface
- */
-export interface ResumeTokenStore {
-    create(agentDid: string, scopes: string[], metadata?: Record<string, unknown>): Promise<string>;
-    get(token: string): Promise<{
-        agentDid: string;
-        scopes: string[];
-        createdAt: number;
-        expiresAt: number;
-        metadata?: Record<string, unknown>;
-    } | null>;
-    fulfill(token: string): Promise<void>;
-}
-/**
- * Simple in-memory resume token store (for testing/development).
- * Not suitable for multi-instance deployments.
- */
-export declare class MemoryResumeTokenStore implements ResumeTokenStore {
-    private tokens;
-    private ttl;
-    constructor(ttlMs?: number);
-    create(agentDid: string, scopes: string[], metadata?: Record<string, unknown>): Promise<string>;
-    get(token: string): Promise<{
-        agentDid: string;
-        scopes: string[];
-        createdAt: number;
-        expiresAt: number;
-        metadata?: Record<string, unknown>;
-    } | null>;
-    fulfill(token: string): Promise<void>;
-    clear(): void;
-}
-/**
- * Main auth handshake function.
- *
- * Verifies agent authorization or returns authorization hints.
- */
-export declare function verifyOrHints(agentDid: string, scopes: string[], config: AuthHandshakeConfig, _resumeToken?: string): Promise<VerifyOrHintsResult>;
-/**
- * Helper: Check if scopes are sensitive and require authorization.
- */
-export declare function hasSensitiveScopes(scopes: string[]): boolean;
-//# sourceMappingURL=handshake.d.ts.map