@kya-os/mcp-i 1.11.1 → 1.12.0

package/dist/runtime/index.d.ts

@@ -2,7 +2,7 @@
  * XMCP-I Runtime - Main Exports
  *
  * Identity-aware MCP runtime with proof generation, session management,
- * audit logging, and well-known endpoints.
+ * canonical audit trails, and well-known endpoints.
  */
 export { MCPINodeRuntimeWrapper, MCPINodeRuntimeWrapper as MCPIRuntime, // Backward compatibility alias
 createMCPIRuntime } from "./mcpi-runtime-wrapper";
@@ -10,7 +10,6 @@ export { RuntimeFactory, RUNTIME_ERRORS, type MCPIRuntimeConfig, type RuntimeEnv
 export { IdentityManager, defaultIdentityManager, ensureIdentity, IDENTITY_ERRORS, type AgentIdentity, type DevIdentityFile, type ProdEnvironment, type RuntimeIdentityManagerConfig, } from "./identity";
 export { SessionManager, defaultSessionManager, createHandshakeRequest, validateHandshakeFormat, type SessionConfig, type HandshakeResult, } from "./session";
 export { ProofGenerator, createProofResponse, extractCanonicalData, type ToolRequest, type ToolResponse, type ProofOptions, } from "./proof";
-export { AuditLogger, defaultAuditLogger, logKeyRotationAudit, parseAuditLine, validateAuditRecord, type AuditConfig, type AuditContext, type AuditEventContext, type KeyRotationAuditContext, } from "./audit";
 export { WellKnownManager, createWellKnownHandler, validateDIDDocument, validateAgentDocument, extractDIDFromPath, type DIDDocument, type VerificationMethod, type ServiceEndpoint, type AgentDocument, type WellKnownConfig, type WellKnownHandler, } from "./well-known";
 export { DebugManager, createDebugEndpoint, type DebugVerificationResult, type DebugPageData, } from "./debug";
 export { DemoManager, createDemoManager, DemoConsole, formatVerifyLink, type DemoConfig, } from "./demo";

package/dist/runtime/index.js

@@ -3,11 +3,11 @@
  * XMCP-I Runtime - Main Exports
  *
  * Identity-aware MCP runtime with proof generation, session management,
- * audit logging, and well-known endpoints.
+ * canonical audit trails, and well-known endpoints.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ToolProtectionResolver = exports.MemoryDelegationVerifier = exports.AgentShieldAPIDelegationVerifier = exports.CloudflareKVDelegationVerifier = exports.createProofBatchQueue = exports.AgentShieldProofDestination = exports.KTAProofDestination = exports.ProofBatchQueue = exports.ensureOutboundIdentityBridge = exports.CloudflareKVResumeTokenStore = exports.createResumeTokenStore = exports.MemoryResumeTokenStore = exports.hasSensitiveScopes = exports.verifyOrHints = exports.extractScopes = exports.validateDelegation = exports.checkScopes = exports.createDelegationVerifier = exports.formatVerifyLink = exports.DemoConsole = exports.createDemoManager = exports.DemoManager = exports.createDebugEndpoint = exports.DebugManager = exports.extractDIDFromPath = exports.validateAgentDocument = exports.validateDIDDocument = exports.createWellKnownHandler = exports.WellKnownManager = exports.validateAuditRecord = exports.parseAuditLine = exports.logKeyRotationAudit = exports.defaultAuditLogger = exports.AuditLogger = exports.extractCanonicalData = exports.createProofResponse = exports.ProofGenerator = exports.validateHandshakeFormat = exports.createHandshakeRequest = exports.defaultSessionManager = exports.SessionManager = exports.IDENTITY_ERRORS = exports.ensureIdentity = exports.defaultIdentityManager = exports.IdentityManager = exports.RUNTIME_ERRORS = exports.RuntimeFactory = exports.createMCPIRuntime = exports.MCPIRuntime = exports.MCPINodeRuntimeWrapper = void 0;
-exports.getToolProtection = exports.isToolProtected = exports.toolProtectionRegistry = exports.AgentShieldToolProtectionSource = exports.FileToolProtectionSource = exports.InlineToolProtectionSource = exports.createToolProtectionResolver = void 0;
+exports.toolProtectionRegistry = exports.AgentShieldToolProtectionSource = exports.FileToolProtectionSource = exports.InlineToolProtectionSource = exports.createToolProtectionResolver = exports.ToolProtectionResolver = exports.MemoryDelegationVerifier = exports.AgentShieldAPIDelegationVerifier = exports.CloudflareKVDelegationVerifier = exports.createProofBatchQueue = exports.AgentShieldProofDestination = exports.KTAProofDestination = exports.ProofBatchQueue = exports.ensureOutboundIdentityBridge = exports.CloudflareKVResumeTokenStore = exports.createResumeTokenStore = exports.MemoryResumeTokenStore = exports.hasSensitiveScopes = exports.verifyOrHints = exports.extractScopes = exports.validateDelegation = exports.checkScopes = exports.createDelegationVerifier = exports.formatVerifyLink = exports.DemoConsole = exports.createDemoManager = exports.DemoManager = exports.createDebugEndpoint = exports.DebugManager = exports.extractDIDFromPath = exports.validateAgentDocument = exports.validateDIDDocument = exports.createWellKnownHandler = exports.WellKnownManager = exports.extractCanonicalData = exports.createProofResponse = exports.ProofGenerator = exports.validateHandshakeFormat = exports.createHandshakeRequest = exports.defaultSessionManager = exports.SessionManager = exports.IDENTITY_ERRORS = exports.ensureIdentity = exports.defaultIdentityManager = exports.IdentityManager = exports.RUNTIME_ERRORS = exports.RuntimeFactory = exports.createMCPIRuntime = exports.MCPIRuntime = exports.MCPINodeRuntimeWrapper = void 0;
+exports.getToolProtection = exports.isToolProtected = void 0;
 // Main runtime - Node.js implementation with providers
 var mcpi_runtime_wrapper_1 = require("./mcpi-runtime-wrapper");
 Object.defineProperty(exports, "MCPINodeRuntimeWrapper", { enumerable: true, get: function () { return mcpi_runtime_wrapper_1.MCPINodeRuntimeWrapper; } });
@@ -34,13 +34,6 @@ var proof_1 = require("./proof");
 Object.defineProperty(exports, "ProofGenerator", { enumerable: true, get: function () { return proof_1.ProofGenerator; } });
 Object.defineProperty(exports, "createProofResponse", { enumerable: true, get: function () { return proof_1.createProofResponse; } });
 Object.defineProperty(exports, "extractCanonicalData", { enumerable: true, get: function () { return proof_1.extractCanonicalData; } });
-// Audit logging
-var audit_1 = require("./audit");
-Object.defineProperty(exports, "AuditLogger", { enumerable: true, get: function () { return audit_1.AuditLogger; } });
-Object.defineProperty(exports, "defaultAuditLogger", { enumerable: true, get: function () { return audit_1.defaultAuditLogger; } });
-Object.defineProperty(exports, "logKeyRotationAudit", { enumerable: true, get: function () { return audit_1.logKeyRotationAudit; } });
-Object.defineProperty(exports, "parseAuditLine", { enumerable: true, get: function () { return audit_1.parseAuditLine; } });
-Object.defineProperty(exports, "validateAuditRecord", { enumerable: true, get: function () { return audit_1.validateAuditRecord; } });
 // Well-known endpoints
 var well_known_1 = require("./well-known");
 Object.defineProperty(exports, "WellKnownManager", { enumerable: true, get: function () { return well_known_1.WellKnownManager; } });

package/dist/runtime/mcpi-runtime-wrapper.js

@@ -37,14 +37,7 @@ function createProvidersFromConfig(config) {
             timestampSkewSeconds: config.session?.timestampSkewSeconds || 120,
             ttlMinutes: config.session?.sessionTtlMinutes || 30,
         },
-        audit: config.audit
-            ? {
-                enabled: config.audit.enabled !== false,
-                logFunction: config.audit.logFunction,
-                includePayloads: config.audit.includePayloads,
-                includeProofHashes: config.audit.includeProofHashes,
-            }
-            : undefined,
+        auditTrail: config.auditTrail,
         wellKnown: config.wellKnown
             ? {
                 enabled: true,

package/dist/runtime/mcpi-runtime.d.ts

@@ -6,6 +6,7 @@
  */
 import { SessionContext, HandshakeRequest } from "@kya-os/contracts/handshake";
 import { ToolRequest, ToolResponse } from "./proof";
+import { type RuntimeAuditConfig } from "@kya-os/mcp-i-runtime";
 import { WellKnownConfig } from "./well-known";
 import { DemoManager } from "./demo";
 import { DelegationVerifierConfig } from "./delegation-verifier";
@@ -39,12 +40,8 @@ export interface MCPIRuntimeConfig {
         sessionTtlMinutes?: number;
         absoluteSessionLifetime?: number;
     };
-    audit?: {
-        enabled?: boolean;
-        logFunction?: (record: string) => void;
-        includePayloads?: boolean;
-        includeProofHashes?: boolean;
-    };
+    /** Canonical KYA-OS audit trail. */
+    auditTrail?: RuntimeAuditConfig;
     proofing?: {
         /** Enable proof generation and submission */
         enabled?: boolean;
@@ -128,7 +125,6 @@ export interface MCPIRuntimeConfig {
 export declare class MCPIRuntime {
     private identityManager;
     private sessionManager;
-    private auditLogger;
     private wellKnownManager?;
     private debugManager?;
     private demoManager?;
@@ -196,11 +192,7 @@ export declare class MCPIRuntime {
         };
         audit: {
             enabled: boolean;
-            sessionsLogged: number;
-            includePayloads: boolean;
-            totalRecordsLogged: number;
-            currentLogSize: number;
-            lastRotationTime: number;
+            profile: import("@kya-os/mcp", { with: { "resolution-mode": "import" } }).AuditAssuranceProfile;
         };
         runtime: {
             initialized: boolean;

package/dist/runtime/mcpi-runtime.js

@@ -11,7 +11,7 @@ exports.createMCPIRuntime = createMCPIRuntime;
 const identity_1 = require("./identity");
 const session_1 = require("./session");
 const proof_1 = require("./proof");
-const audit_1 = require("./audit");
+const mcp_i_runtime_1 = require("@kya-os/mcp-i-runtime");
 const well_known_1 = require("./well-known");
 const debug_1 = require("./debug");
 const demo_1 = require("./demo");
@@ -34,7 +34,6 @@ const mcp_i_core_1 = require("@kya-os/mcp-i-core");
 class MCPIRuntime {
     identityManager;
     sessionManager;
-    auditLogger;
     wellKnownManager;
     debugManager;
     demoManager;
@@ -52,8 +51,6 @@ class MCPIRuntime {
         });
         // Initialize session manager
         this.sessionManager = new session_1.SessionManager(config.session);
-        // Initialize audit logger
-        this.auditLogger = new audit_1.AuditLogger(config.audit);
         // Initialize resume token store (NEW - Phase 1).
         // Durable stores (e.g. Cloudflare KV) are selected from config so a token
         // minted at consent time survives cold starts / restarts / multi-instance
@@ -229,6 +226,16 @@ class MCPIRuntime {
                 });
             }
         }
+        const auditInvocation = this.config.auditTrail
+            ? await (0, mcp_i_runtime_1.beginRuntimeToolAudit)(this.config.auditTrail, {
+                toolName: request.method,
+                args: request.params,
+                session: {
+                    ...session,
+                    id: session.sessionId,
+                },
+            })
+            : undefined;
         // Capture before async boundary — TS narrowing doesn't survive across async callbacks
         const cachedIdentity = this.cachedIdentity;
         return (0, request_context_1.runWithContext)({ session: session ?? undefined }, async () => {
@@ -251,29 +258,30 @@ class MCPIRuntime {
                 if (this.debugManager && response.meta?.proof) {
                     this.debugManager.updateDebugState(response.meta.proof, session);
                 }
-                // Log audit record (first call per session)
-                const auditContext = {
-                    identity: cachedIdentity,
-                    session,
-                    requestHash: response.meta.proof.meta.requestHash,
-                    responseHash: response.meta.proof.meta.responseHash,
-                    verified: "yes",
-                    scopeId: options.scopeId,
-                };
-                await this.auditLogger.logAuditRecord(auditContext);
-                return response;
+                if (!auditInvocation || !this.config.auditTrail)
+                    return response;
+                try {
+                    const terminal = await auditInvocation.terminal((0, mcp_i_runtime_1.terminalForToolResult)(response));
+                    return (0, mcp_i_runtime_1.attachRuntimeAuditMetadata)(response, this.config.auditTrail.sourceId, auditInvocation.context.invocationId, auditInvocation.results(terminal));
+                }
+                catch (auditError) {
+                    console.error("[MCP-I] Failed to record successful tool audit terminal", {
+                        error: auditError instanceof Error ? auditError.message : String(auditError),
+                    });
+                    return (0, mcp_i_runtime_1.attachRuntimeAuditMetadata)(response, this.config.auditTrail.sourceId, auditInvocation.context.invocationId, auditInvocation.results(), true);
+                }
             }
             catch (error) {
-                // Log failed audit record
-                const auditContext = {
-                    identity: cachedIdentity,
-                    session,
-                    requestHash: "sha256:error",
-                    responseHash: "sha256:error",
-                    verified: "no",
-                    scopeId: options.scopeId,
-                };
-                await this.auditLogger.logAuditRecord(auditContext);
+                if (auditInvocation) {
+                    try {
+                        await auditInvocation.terminal((0, mcp_i_runtime_1.terminalForToolError)(error));
+                    }
+                    catch (auditError) {
+                        console.error("[MCP-I] Failed to record terminal tool audit event", {
+                            error: auditError instanceof Error ? auditError.message : String(auditError),
+                        });
+                    }
+                }
                 throw error;
             }
         }); // end runWithContext
@@ -330,7 +338,10 @@ class MCPIRuntime {
                 environment: this.config.identity?.environment || "development",
             },
             session: this.sessionManager.getStats(),
-            audit: this.auditLogger.getStats(),
+            audit: {
+                enabled: this.config.auditTrail !== undefined,
+                profile: this.config.auditTrail?.trail.capabilities?.profile ?? "AAP-0",
+            },
             runtime: {
                 initialized: !!this.cachedIdentity,
                 wellKnownEnabled: !!this.wellKnownManager,
@@ -342,7 +353,6 @@ class MCPIRuntime {
      */
     async cleanup() {
         await this.sessionManager.cleanup();
-        this.auditLogger.clearSessionLog();
     }
     /**
      * Check runtime environment compatibility
@@ -445,7 +455,7 @@ exports.RuntimeFactory = {
                 ...overrides.demo,
             },
             session: overrides.session,
-            audit: overrides.audit,
+            auditTrail: overrides.auditTrail,
         };
         return createMCPIRuntime(config);
     },
@@ -480,9 +490,6 @@ exports.RuntimeFactory = {
                 environment: "development",
                 devIdentityPath: ".test-mcp-i/identity.json",
             },
-            audit: {
-                enabled: false, // Disable audit logging in tests
-            },
             runtime: {
                 showVerifyLink: false,
             },