@kya-os/cli 2.0.0 → 2.0.3

package/node_modules/@kya-os/contracts/dist/config/identity.d.ts

@@ -0,0 +1,1164 @@
+/**
+ * Identity Configuration Types
+ *
+ * Configuration for MCP-I identity management including DID generation,
+ * key management, and environment-specific settings.
+ *
+ * @module @kya-os/contracts/config
+ */
+import { z } from "zod";
+/**
+ * Runtime Identity Configuration
+ *
+ * Configuration for MCP-I identity management at runtime.
+ * Used in application configs (mcpi-runtime-config.ts)
+ *
+ * Controls how agent identity is managed, including key generation,
+ * storage, and DID creation.
+ */
+export interface RuntimeIdentityConfig {
+    /**
+     * Enable identity features
+     * When false, the agent operates anonymously without DID/keys
+     */
+    enabled: boolean;
+    /**
+     * Runtime environment for identity
+     * Determines where keys come from and how they're managed
+     */
+    environment: "development" | "production";
+    /**
+     * Production identity configuration
+     * Used when environment is 'production'
+     */
+    production?: {
+        /**
+         * Environment variable name containing the private key
+         * @example 'MCPI_PRIVATE_KEY'
+         */
+        privateKeyEnv?: string;
+        /**
+         * Environment variable name containing the public key
+         * @example 'MCPI_PUBLIC_KEY'
+         */
+        publicKeyEnv?: string;
+        /**
+         * Environment variable name containing the DID
+         * @example 'MCPI_AGENT_DID'
+         */
+        didEnv?: string;
+    };
+    /**
+     * Privacy mode - minimizes identity disclosure
+     * When true, identity is only revealed when absolutely necessary
+     * @default false
+     */
+    privacyMode?: boolean;
+    /**
+     * Enable debug logging for identity operations
+     * WARNING: May log sensitive information
+     * @default false
+     */
+    debug?: boolean;
+    /**
+     * Enable automatic user DID generation on chat join
+     * When true, generates ephemeral did:key DIDs for users when they join a session
+     * @default false
+     */
+    generateUserDids?: boolean;
+    /**
+     * User DID storage strategy
+     * - 'ephemeral': User DIDs are not persisted (default, did:key)
+     * - 'persistent': User DIDs are persisted in storage (requires did:web setup)
+     * @default 'ephemeral'
+     */
+    userDidStorage?: "ephemeral" | "persistent";
+}
+/**
+ * Auth Provider Type
+ *
+ * Discriminator for provider configuration types.
+ */
+export type AuthProviderType = "oauth2" | "credential";
+/**
+ * Base Provider Configuration
+ *
+ * Common fields shared by all provider types.
+ */
+export interface BaseProviderConfig {
+    /** Provider type discriminator */
+    type: AuthProviderType;
+    /** Human-readable display name for the provider */
+    displayName?: string;
+}
+/**
+ * Credential Provider Configuration
+ *
+ * Configuration for credential-based authentication (email/password).
+ * Used for customers who don't use OAuth and want direct login.
+ */
+export interface CredentialProviderConfig extends BaseProviderConfig {
+    type: "credential";
+    /** Authentication endpoint URL to POST credentials */
+    authEndpoint: string;
+    /**
+     * Request body template mapping form fields to API fields
+     * Use {{fieldName}} placeholders that will be replaced with form values
+     * @example { email: "{{email}}", password: "{{password}}" }
+     */
+    requestBodyTemplate: Record<string, string>;
+    /**
+     * Response field mappings to extract data from auth response
+     */
+    responseFields: {
+        /** JSON path to session token, or "cookie" to extract from Set-Cookie header */
+        sessionToken: string;
+        /** JSON path to user ID (optional) */
+        userId?: string;
+        /** JSON path to user email (optional) */
+        userEmail?: string;
+        /** JSON path to user display name (optional) */
+        userDisplayName?: string;
+        /** JSON path to token expiration in seconds (optional) */
+        expiresIn?: string;
+    };
+    /**
+     * Success validation configuration
+     * Checks if a field in the response matches an expected value
+     */
+    successCheck?: {
+        /** JSON path to check in response */
+        path: string;
+        /** Expected value (string, boolean, or number) */
+        expectedValue: string | boolean | number;
+    };
+    /** Custom headers to include in auth request */
+    headers?: Record<string, string>;
+    /**
+     * How to use the token for subsequent API calls
+     * - "cookie": Send as Cookie header
+     * - "bearer": Send as Authorization: Bearer xxx
+     * - "header": Send as custom header (specify tokenHeader)
+     * @default "cookie"
+     */
+    tokenUsage?: "cookie" | "bearer" | "header";
+    /** Custom header name when tokenUsage is "header" */
+    tokenHeader?: string;
+    /**
+     * Cookie format template when tokenUsage is "cookie"
+     * Use {{token}} placeholder for the token value
+     * @example "CIX={{token}}; customerCookie={{token}}"
+     */
+    cookieFormat?: string;
+    /** Additional headers to include in subsequent API calls */
+    apiHeaders?: Record<string, string>;
+    /**
+     * Consent page customization overrides
+     */
+    consentOverrides?: {
+        branding?: Record<string, unknown>;
+        formTitle?: string;
+        formDescription?: string;
+        identityFieldLabel?: string;
+        /**
+         * Input type for the identity/username field
+         * Use "text" for username-based authentication, "email" for email-based
+         * @default Automatically detected from field name (email -> "email", otherwise "text")
+         */
+        identityFieldType?: "text" | "email" | "tel";
+        passwordFieldLabel?: string;
+        submitButtonText?: string;
+    };
+}
+/**
+ * Zod schema for CredentialProviderConfig validation
+ */
+export declare const CredentialProviderConfigSchema: z.ZodObject<{
+    type: z.ZodLiteral<"credential">;
+    displayName: z.ZodOptional<z.ZodString>;
+    authEndpoint: z.ZodString;
+    requestBodyTemplate: z.ZodRecord<z.ZodString, z.ZodString>;
+    responseFields: z.ZodObject<{
+        sessionToken: z.ZodString;
+        userId: z.ZodOptional<z.ZodString>;
+        userEmail: z.ZodOptional<z.ZodString>;
+        userDisplayName: z.ZodOptional<z.ZodString>;
+        expiresIn: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        sessionToken: string;
+        userId?: string | undefined;
+        userEmail?: string | undefined;
+        userDisplayName?: string | undefined;
+        expiresIn?: string | undefined;
+    }, {
+        sessionToken: string;
+        userId?: string | undefined;
+        userEmail?: string | undefined;
+        userDisplayName?: string | undefined;
+        expiresIn?: string | undefined;
+    }>;
+    successCheck: z.ZodOptional<z.ZodObject<{
+        path: z.ZodString;
+        expectedValue: z.ZodUnion<[z.ZodString, z.ZodBoolean, z.ZodNumber]>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        expectedValue: string | number | boolean;
+    }, {
+        path: string;
+        expectedValue: string | number | boolean;
+    }>>;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    tokenUsage: z.ZodOptional<z.ZodEnum<["cookie", "bearer", "header"]>>;
+    tokenHeader: z.ZodOptional<z.ZodString>;
+    cookieFormat: z.ZodOptional<z.ZodString>;
+    apiHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    consentOverrides: z.ZodOptional<z.ZodObject<{
+        branding: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        formTitle: z.ZodOptional<z.ZodString>;
+        formDescription: z.ZodOptional<z.ZodString>;
+        identityFieldLabel: z.ZodOptional<z.ZodString>;
+        identityFieldType: z.ZodOptional<z.ZodEnum<["text", "email", "tel"]>>;
+        passwordFieldLabel: z.ZodOptional<z.ZodString>;
+        submitButtonText: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        branding?: Record<string, unknown> | undefined;
+        formTitle?: string | undefined;
+        formDescription?: string | undefined;
+        identityFieldLabel?: string | undefined;
+        identityFieldType?: "text" | "email" | "tel" | undefined;
+        passwordFieldLabel?: string | undefined;
+        submitButtonText?: string | undefined;
+    }, {
+        branding?: Record<string, unknown> | undefined;
+        formTitle?: string | undefined;
+        formDescription?: string | undefined;
+        identityFieldLabel?: string | undefined;
+        identityFieldType?: "text" | "email" | "tel" | undefined;
+        passwordFieldLabel?: string | undefined;
+        submitButtonText?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    type: "credential";
+    authEndpoint: string;
+    requestBodyTemplate: Record<string, string>;
+    responseFields: {
+        sessionToken: string;
+        userId?: string | undefined;
+        userEmail?: string | undefined;
+        userDisplayName?: string | undefined;
+        expiresIn?: string | undefined;
+    };
+    displayName?: string | undefined;
+    successCheck?: {
+        path: string;
+        expectedValue: string | number | boolean;
+    } | undefined;
+    headers?: Record<string, string> | undefined;
+    tokenUsage?: "cookie" | "bearer" | "header" | undefined;
+    tokenHeader?: string | undefined;
+    cookieFormat?: string | undefined;
+    apiHeaders?: Record<string, string> | undefined;
+    consentOverrides?: {
+        branding?: Record<string, unknown> | undefined;
+        formTitle?: string | undefined;
+        formDescription?: string | undefined;
+        identityFieldLabel?: string | undefined;
+        identityFieldType?: "text" | "email" | "tel" | undefined;
+        passwordFieldLabel?: string | undefined;
+        submitButtonText?: string | undefined;
+    } | undefined;
+}, {
+    type: "credential";
+    authEndpoint: string;
+    requestBodyTemplate: Record<string, string>;
+    responseFields: {
+        sessionToken: string;
+        userId?: string | undefined;
+        userEmail?: string | undefined;
+        userDisplayName?: string | undefined;
+        expiresIn?: string | undefined;
+    };
+    displayName?: string | undefined;
+    successCheck?: {
+        path: string;
+        expectedValue: string | number | boolean;
+    } | undefined;
+    headers?: Record<string, string> | undefined;
+    tokenUsage?: "cookie" | "bearer" | "header" | undefined;
+    tokenHeader?: string | undefined;
+    cookieFormat?: string | undefined;
+    apiHeaders?: Record<string, string> | undefined;
+    consentOverrides?: {
+        branding?: Record<string, unknown> | undefined;
+        formTitle?: string | undefined;
+        formDescription?: string | undefined;
+        identityFieldLabel?: string | undefined;
+        identityFieldType?: "text" | "email" | "tel" | undefined;
+        passwordFieldLabel?: string | undefined;
+        submitButtonText?: string | undefined;
+    } | undefined;
+}>;
+/**
+ * OAuth Provider Secret Metadata
+ *
+ * Metadata for runtime secret resolution from secure storage.
+ * Part of the MCP-I provider-registry model where agents resolve
+ * secrets by name from Cloudflare Worker env bindings.
+ */
+export interface OAuthProviderSecretMetadata {
+    /**
+     * Secret name for client secret in secure storage
+     * Used by agents to resolve the actual secret value at runtime
+     * @example 'KYA_PROD_MYPROJ_GITHUB_CLIENT_SECRET'
+     */
+    clientSecretName?: string;
+    /**
+     * Secret name for client ID in secure storage (optional)
+     * @example 'KYA_PROD_MYPROJ_GITHUB_CLIENT_ID'
+     */
+    clientIdSecretName?: string;
+    /**
+     * Secret name for API key in secure storage (for non-OAuth providers)
+     * @example 'KYA_PROD_MYPROJ_CUSTOM_API_KEY'
+     */
+    apiKeySecretName?: string;
+    /**
+     * Version number of the client secret for rotation tracking
+     * Incremented on each rotation
+     */
+    clientSecretVersion?: number;
+    /**
+     * ISO 8601 timestamp of when the secret was last rotated
+     * @example '2025-12-01T00:00:00Z'
+     */
+    lastRotatedAt?: string;
+}
+/**
+ * OAuth Provider Configuration
+ *
+ * Configuration for a single OAuth provider (GitHub, Google, etc.)
+ */
+export interface OAuthProvider {
+    /** OAuth client ID (public, safe to expose) */
+    clientId: string;
+    /** OAuth client secret (NOT returned in API response for security) */
+    clientSecret?: string | null;
+    /** OAuth authorization URL */
+    authorizationUrl: string;
+    /** OAuth token exchange URL */
+    tokenUrl: string;
+    /** OAuth user info endpoint URL */
+    userInfoUrl?: string;
+    /** Whether provider supports PKCE (Proof Key for Code Exchange) */
+    supportsPKCE: boolean;
+    /** Whether provider requires client secret (false for PKCE-only providers) */
+    requiresClientSecret: boolean;
+    /** Available scopes for this provider */
+    scopes?: string[];
+    /** Default scopes to request */
+    defaultScopes?: string[];
+    /** Whether provider uses proxy mode (via AgentShield) */
+    proxyMode?: boolean;
+    /** Custom OAuth parameters to include in authorization URL (e.g., audience, acr_values) */
+    customParams?: Record<string, string>;
+    /** Token endpoint authentication method */
+    tokenEndpointAuthMethod?: "client_secret_post" | "client_secret_basic";
+    /** OAuth response type (default: "code") */
+    responseType?: string;
+    /** OAuth grant type (default: "authorization_code") */
+    grantType?: string;
+    /**
+     * Whether provider has a client secret configured
+     * Boolean flag indicating secret availability without exposing the value
+     */
+    hasClientSecret?: boolean;
+    /**
+     * Secret resolution metadata for MCP-I provider-registry model
+     * Contains secret names (not values) for runtime resolution from secure storage
+     * Agents use these names to look up actual secrets from Cloudflare Worker env
+     */
+    metadata?: OAuthProviderSecretMetadata;
+}
+/**
+ * OAuth Configuration
+ *
+ * Configuration for OAuth providers fetched from AgentShield API.
+ * Contains all available providers for a project.
+ *
+ * The `configuredProvider` field indicates which provider (if any) has been
+ * explicitly configured in the AgentShield dashboard for this project.
+ * Phase 2+ requires tools to explicitly specify oauthProvider.
+ */
+export interface OAuthConfig {
+    /** Map of provider names to provider configurations */
+    providers: Record<string, OAuthProvider>;
+    /**
+     * The explicitly configured OAuth provider for this project.
+     * Null if no provider has been configured in AgentShield dashboard.
+     * Used by ProviderResolver as fallback when tool doesn't specify oauthProvider.
+     */
+    configuredProvider?: string | null;
+}
+/**
+ * Zod schema for OAuthProviderSecretMetadata validation
+ */
+export declare const OAuthProviderSecretMetadataSchema: z.ZodObject<{
+    clientSecretName: z.ZodOptional<z.ZodString>;
+    clientIdSecretName: z.ZodOptional<z.ZodString>;
+    apiKeySecretName: z.ZodOptional<z.ZodString>;
+    clientSecretVersion: z.ZodOptional<z.ZodNumber>;
+    lastRotatedAt: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    clientSecretName?: string | undefined;
+    clientIdSecretName?: string | undefined;
+    apiKeySecretName?: string | undefined;
+    clientSecretVersion?: number | undefined;
+    lastRotatedAt?: string | undefined;
+}, {
+    clientSecretName?: string | undefined;
+    clientIdSecretName?: string | undefined;
+    apiKeySecretName?: string | undefined;
+    clientSecretVersion?: number | undefined;
+    lastRotatedAt?: string | undefined;
+}>;
+/**
+ * Zod schema for OAuthProvider validation
+ */
+export declare const OAuthProviderSchema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    authorizationUrl: z.ZodString;
+    tokenUrl: z.ZodString;
+    userInfoUrl: z.ZodOptional<z.ZodString>;
+    supportsPKCE: z.ZodBoolean;
+    requiresClientSecret: z.ZodBoolean;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    defaultScopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    proxyMode: z.ZodOptional<z.ZodBoolean>;
+    customParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    tokenEndpointAuthMethod: z.ZodOptional<z.ZodEnum<["client_secret_post", "client_secret_basic"]>>;
+    responseType: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    grantType: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    hasClientSecret: z.ZodOptional<z.ZodBoolean>;
+    metadata: z.ZodOptional<z.ZodObject<{
+        clientSecretName: z.ZodOptional<z.ZodString>;
+        clientIdSecretName: z.ZodOptional<z.ZodString>;
+        apiKeySecretName: z.ZodOptional<z.ZodString>;
+        clientSecretVersion: z.ZodOptional<z.ZodNumber>;
+        lastRotatedAt: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        clientSecretName?: string | undefined;
+        clientIdSecretName?: string | undefined;
+        apiKeySecretName?: string | undefined;
+        clientSecretVersion?: number | undefined;
+        lastRotatedAt?: string | undefined;
+    }, {
+        clientSecretName?: string | undefined;
+        clientIdSecretName?: string | undefined;
+        apiKeySecretName?: string | undefined;
+        clientSecretVersion?: number | undefined;
+        lastRotatedAt?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    authorizationUrl: string;
+    tokenUrl: string;
+    supportsPKCE: boolean;
+    requiresClientSecret: boolean;
+    responseType: string;
+    grantType: string;
+    clientSecret?: string | null | undefined;
+    userInfoUrl?: string | undefined;
+    scopes?: string[] | undefined;
+    defaultScopes?: string[] | undefined;
+    proxyMode?: boolean | undefined;
+    customParams?: Record<string, string> | undefined;
+    tokenEndpointAuthMethod?: "client_secret_post" | "client_secret_basic" | undefined;
+    hasClientSecret?: boolean | undefined;
+    metadata?: {
+        clientSecretName?: string | undefined;
+        clientIdSecretName?: string | undefined;
+        apiKeySecretName?: string | undefined;
+        clientSecretVersion?: number | undefined;
+        lastRotatedAt?: string | undefined;
+    } | undefined;
+}, {
+    clientId: string;
+    authorizationUrl: string;
+    tokenUrl: string;
+    supportsPKCE: boolean;
+    requiresClientSecret: boolean;
+    clientSecret?: string | null | undefined;
+    userInfoUrl?: string | undefined;
+    scopes?: string[] | undefined;
+    defaultScopes?: string[] | undefined;
+    proxyMode?: boolean | undefined;
+    customParams?: Record<string, string> | undefined;
+    tokenEndpointAuthMethod?: "client_secret_post" | "client_secret_basic" | undefined;
+    responseType?: string | undefined;
+    grantType?: string | undefined;
+    hasClientSecret?: boolean | undefined;
+    metadata?: {
+        clientSecretName?: string | undefined;
+        clientIdSecretName?: string | undefined;
+        apiKeySecretName?: string | undefined;
+        clientSecretVersion?: number | undefined;
+        lastRotatedAt?: string | undefined;
+    } | undefined;
+}>;
+/**
+ * Zod schema for OAuthConfig validation
+ */
+export declare const OAuthConfigSchema: z.ZodObject<{
+    providers: z.ZodRecord<z.ZodString, z.ZodObject<{
+        clientId: z.ZodString;
+        clientSecret: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        authorizationUrl: z.ZodString;
+        tokenUrl: z.ZodString;
+        userInfoUrl: z.ZodOptional<z.ZodString>;
+        supportsPKCE: z.ZodBoolean;
+        requiresClientSecret: z.ZodBoolean;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        defaultScopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        proxyMode: z.ZodOptional<z.ZodBoolean>;
+        customParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        tokenEndpointAuthMethod: z.ZodOptional<z.ZodEnum<["client_secret_post", "client_secret_basic"]>>;
+        responseType: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        grantType: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        hasClientSecret: z.ZodOptional<z.ZodBoolean>;
+        metadata: z.ZodOptional<z.ZodObject<{
+            clientSecretName: z.ZodOptional<z.ZodString>;
+            clientIdSecretName: z.ZodOptional<z.ZodString>;
+            apiKeySecretName: z.ZodOptional<z.ZodString>;
+            clientSecretVersion: z.ZodOptional<z.ZodNumber>;
+            lastRotatedAt: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            clientSecretName?: string | undefined;
+            clientIdSecretName?: string | undefined;
+            apiKeySecretName?: string | undefined;
+            clientSecretVersion?: number | undefined;
+            lastRotatedAt?: string | undefined;
+        }, {
+            clientSecretName?: string | undefined;
+            clientIdSecretName?: string | undefined;
+            apiKeySecretName?: string | undefined;
+            clientSecretVersion?: number | undefined;
+            lastRotatedAt?: string | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        clientId: string;
+        authorizationUrl: string;
+        tokenUrl: string;
+        supportsPKCE: boolean;
+        requiresClientSecret: boolean;
+        responseType: string;
+        grantType: string;
+        clientSecret?: string | null | undefined;
+        userInfoUrl?: string | undefined;
+        scopes?: string[] | undefined;
+        defaultScopes?: string[] | undefined;
+        proxyMode?: boolean | undefined;
+        customParams?: Record<string, string> | undefined;
+        tokenEndpointAuthMethod?: "client_secret_post" | "client_secret_basic" | undefined;
+        hasClientSecret?: boolean | undefined;
+        metadata?: {
+            clientSecretName?: string | undefined;
+            clientIdSecretName?: string | undefined;
+            apiKeySecretName?: string | undefined;
+            clientSecretVersion?: number | undefined;
+            lastRotatedAt?: string | undefined;
+        } | undefined;
+    }, {
+        clientId: string;
+        authorizationUrl: string;
+        tokenUrl: string;
+        supportsPKCE: boolean;
+        requiresClientSecret: boolean;
+        clientSecret?: string | null | undefined;
+        userInfoUrl?: string | undefined;
+        scopes?: string[] | undefined;
+        defaultScopes?: string[] | undefined;
+        proxyMode?: boolean | undefined;
+        customParams?: Record<string, string> | undefined;
+        tokenEndpointAuthMethod?: "client_secret_post" | "client_secret_basic" | undefined;
+        responseType?: string | undefined;
+        grantType?: string | undefined;
+        hasClientSecret?: boolean | undefined;
+        metadata?: {
+            clientSecretName?: string | undefined;
+            clientIdSecretName?: string | undefined;
+            apiKeySecretName?: string | undefined;
+            clientSecretVersion?: number | undefined;
+            lastRotatedAt?: string | undefined;
+        } | undefined;
+    }>>;
+    configuredProvider: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    providers: Record<string, {
+        clientId: string;
+        authorizationUrl: string;
+        tokenUrl: string;
+        supportsPKCE: boolean;
+        requiresClientSecret: boolean;
+        responseType: string;
+        grantType: string;
+        clientSecret?: string | null | undefined;
+        userInfoUrl?: string | undefined;
+        scopes?: string[] | undefined;
+        defaultScopes?: string[] | undefined;
+        proxyMode?: boolean | undefined;
+        customParams?: Record<string, string> | undefined;
+        tokenEndpointAuthMethod?: "client_secret_post" | "client_secret_basic" | undefined;
+        hasClientSecret?: boolean | undefined;
+        metadata?: {
+            clientSecretName?: string | undefined;
+            clientIdSecretName?: string | undefined;
+            apiKeySecretName?: string | undefined;
+            clientSecretVersion?: number | undefined;
+            lastRotatedAt?: string | undefined;
+        } | undefined;
+    }>;
+    configuredProvider?: string | null | undefined;
+}, {
+    providers: Record<string, {
+        clientId: string;
+        authorizationUrl: string;
+        tokenUrl: string;
+        supportsPKCE: boolean;
+        requiresClientSecret: boolean;
+        clientSecret?: string | null | undefined;
+        userInfoUrl?: string | undefined;
+        scopes?: string[] | undefined;
+        defaultScopes?: string[] | undefined;
+        proxyMode?: boolean | undefined;
+        customParams?: Record<string, string> | undefined;
+        tokenEndpointAuthMethod?: "client_secret_post" | "client_secret_basic" | undefined;
+        responseType?: string | undefined;
+        grantType?: string | undefined;
+        hasClientSecret?: boolean | undefined;
+        metadata?: {
+            clientSecretName?: string | undefined;
+            clientIdSecretName?: string | undefined;
+            apiKeySecretName?: string | undefined;
+            clientSecretVersion?: number | undefined;
+            lastRotatedAt?: string | undefined;
+        } | undefined;
+    }>;
+    configuredProvider?: string | null | undefined;
+}>;
+/**
+ * OAuth2 Provider Configuration (explicit type for discriminated union)
+ *
+ * Wrapper around OAuthProvider with explicit type discriminator.
+ */
+export interface OAuth2ProviderConfig extends BaseProviderConfig {
+    type: "oauth2";
+    clientId: string;
+    clientSecret?: string | null;
+    authorizationUrl: string;
+    tokenUrl: string;
+    userInfoUrl?: string;
+    supportsPKCE: boolean;
+    requiresClientSecret: boolean;
+    scopes?: string[];
+    defaultScopes?: string[];
+    proxyMode?: boolean;
+    customParams?: Record<string, string>;
+    tokenEndpointAuthMethod?: "client_secret_post" | "client_secret_basic";
+    responseType?: string;
+    grantType?: string;
+    /** Whether provider has a client secret configured */
+    hasClientSecret?: boolean;
+    /** Secret resolution metadata for MCP-I provider-registry model */
+    metadata?: OAuthProviderSecretMetadata;
+}
+/**
+ * Zod schema for OAuth2ProviderConfig validation
+ */
+export declare const OAuth2ProviderConfigSchema: z.ZodObject<{
+    type: z.ZodLiteral<"oauth2">;
+    displayName: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodString;
+    clientSecret: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    authorizationUrl: z.ZodString;
+    tokenUrl: z.ZodString;
+    userInfoUrl: z.ZodOptional<z.ZodString>;
+    supportsPKCE: z.ZodBoolean;
+    requiresClientSecret: z.ZodBoolean;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    defaultScopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    proxyMode: z.ZodOptional<z.ZodBoolean>;
+    customParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    tokenEndpointAuthMethod: z.ZodOptional<z.ZodEnum<["client_secret_post", "client_secret_basic"]>>;
+    responseType: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    grantType: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    hasClientSecret: z.ZodOptional<z.ZodBoolean>;
+    metadata: z.ZodOptional<z.ZodObject<{
+        clientSecretName: z.ZodOptional<z.ZodString>;
+        clientIdSecretName: z.ZodOptional<z.ZodString>;
+        apiKeySecretName: z.ZodOptional<z.ZodString>;
+        clientSecretVersion: z.ZodOptional<z.ZodNumber>;
+        lastRotatedAt: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        clientSecretName?: string | undefined;
+        clientIdSecretName?: string | undefined;
+        apiKeySecretName?: string | undefined;
+        clientSecretVersion?: number | undefined;
+        lastRotatedAt?: string | undefined;
+    }, {
+        clientSecretName?: string | undefined;
+        clientIdSecretName?: string | undefined;
+        apiKeySecretName?: string | undefined;
+        clientSecretVersion?: number | undefined;
+        lastRotatedAt?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    type: "oauth2";
+    clientId: string;
+    authorizationUrl: string;
+    tokenUrl: string;
+    supportsPKCE: boolean;
+    requiresClientSecret: boolean;
+    responseType: string;
+    grantType: string;
+    displayName?: string | undefined;
+    clientSecret?: string | null | undefined;
+    userInfoUrl?: string | undefined;
+    scopes?: string[] | undefined;
+    defaultScopes?: string[] | undefined;
+    proxyMode?: boolean | undefined;
+    customParams?: Record<string, string> | undefined;
+    tokenEndpointAuthMethod?: "client_secret_post" | "client_secret_basic" | undefined;
+    hasClientSecret?: boolean | undefined;
+    metadata?: {
+        clientSecretName?: string | undefined;
+        clientIdSecretName?: string | undefined;
+        apiKeySecretName?: string | undefined;
+        clientSecretVersion?: number | undefined;
+        lastRotatedAt?: string | undefined;
+    } | undefined;
+}, {
+    type: "oauth2";
+    clientId: string;
+    authorizationUrl: string;
+    tokenUrl: string;
+    supportsPKCE: boolean;
+    requiresClientSecret: boolean;
+    displayName?: string | undefined;
+    clientSecret?: string | null | undefined;
+    userInfoUrl?: string | undefined;
+    scopes?: string[] | undefined;
+    defaultScopes?: string[] | undefined;
+    proxyMode?: boolean | undefined;
+    customParams?: Record<string, string> | undefined;
+    tokenEndpointAuthMethod?: "client_secret_post" | "client_secret_basic" | undefined;
+    responseType?: string | undefined;
+    grantType?: string | undefined;
+    hasClientSecret?: boolean | undefined;
+    metadata?: {
+        clientSecretName?: string | undefined;
+        clientIdSecretName?: string | undefined;
+        apiKeySecretName?: string | undefined;
+        clientSecretVersion?: number | undefined;
+        lastRotatedAt?: string | undefined;
+    } | undefined;
+}>;
+/**
+ * Unified Auth Provider Type
+ *
+ * Discriminated union of all supported authentication provider types.
+ * Use `type` field to determine which configuration shape to expect.
+ */
+export type AuthProvider = OAuth2ProviderConfig | CredentialProviderConfig;
+/**
+ * Zod schema for AuthProvider validation (discriminated union)
+ */
+export declare const AuthProviderSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+    type: z.ZodLiteral<"oauth2">;
+    displayName: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodString;
+    clientSecret: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    authorizationUrl: z.ZodString;
+    tokenUrl: z.ZodString;
+    userInfoUrl: z.ZodOptional<z.ZodString>;
+    supportsPKCE: z.ZodBoolean;
+    requiresClientSecret: z.ZodBoolean;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    defaultScopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    proxyMode: z.ZodOptional<z.ZodBoolean>;
+    customParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    tokenEndpointAuthMethod: z.ZodOptional<z.ZodEnum<["client_secret_post", "client_secret_basic"]>>;
+    responseType: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    grantType: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    hasClientSecret: z.ZodOptional<z.ZodBoolean>;
+    metadata: z.ZodOptional<z.ZodObject<{
+        clientSecretName: z.ZodOptional<z.ZodString>;
+        clientIdSecretName: z.ZodOptional<z.ZodString>;
+        apiKeySecretName: z.ZodOptional<z.ZodString>;
+        clientSecretVersion: z.ZodOptional<z.ZodNumber>;
+        lastRotatedAt: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        clientSecretName?: string | undefined;
+        clientIdSecretName?: string | undefined;
+        apiKeySecretName?: string | undefined;
+        clientSecretVersion?: number | undefined;
+        lastRotatedAt?: string | undefined;
+    }, {
+        clientSecretName?: string | undefined;
+        clientIdSecretName?: string | undefined;
+        apiKeySecretName?: string | undefined;
+        clientSecretVersion?: number | undefined;
+        lastRotatedAt?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    type: "oauth2";
+    clientId: string;
+    authorizationUrl: string;
+    tokenUrl: string;
+    supportsPKCE: boolean;
+    requiresClientSecret: boolean;
+    responseType: string;
+    grantType: string;
+    displayName?: string | undefined;
+    clientSecret?: string | null | undefined;
+    userInfoUrl?: string | undefined;
+    scopes?: string[] | undefined;
+    defaultScopes?: string[] | undefined;
+    proxyMode?: boolean | undefined;
+    customParams?: Record<string, string> | undefined;
+    tokenEndpointAuthMethod?: "client_secret_post" | "client_secret_basic" | undefined;
+    hasClientSecret?: boolean | undefined;
+    metadata?: {
+        clientSecretName?: string | undefined;
+        clientIdSecretName?: string | undefined;
+        apiKeySecretName?: string | undefined;
+        clientSecretVersion?: number | undefined;
+        lastRotatedAt?: string | undefined;
+    } | undefined;
+}, {
+    type: "oauth2";
+    clientId: string;
+    authorizationUrl: string;
+    tokenUrl: string;
+    supportsPKCE: boolean;
+    requiresClientSecret: boolean;
+    displayName?: string | undefined;
+    clientSecret?: string | null | undefined;
+    userInfoUrl?: string | undefined;
+    scopes?: string[] | undefined;
+    defaultScopes?: string[] | undefined;
+    proxyMode?: boolean | undefined;
+    customParams?: Record<string, string> | undefined;
+    tokenEndpointAuthMethod?: "client_secret_post" | "client_secret_basic" | undefined;
+    responseType?: string | undefined;
+    grantType?: string | undefined;
+    hasClientSecret?: boolean | undefined;
+    metadata?: {
+        clientSecretName?: string | undefined;
+        clientIdSecretName?: string | undefined;
+        apiKeySecretName?: string | undefined;
+        clientSecretVersion?: number | undefined;
+        lastRotatedAt?: string | undefined;
+    } | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"credential">;
+    displayName: z.ZodOptional<z.ZodString>;
+    authEndpoint: z.ZodString;
+    requestBodyTemplate: z.ZodRecord<z.ZodString, z.ZodString>;
+    responseFields: z.ZodObject<{
+        sessionToken: z.ZodString;
+        userId: z.ZodOptional<z.ZodString>;
+        userEmail: z.ZodOptional<z.ZodString>;
+        userDisplayName: z.ZodOptional<z.ZodString>;
+        expiresIn: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        sessionToken: string;
+        userId?: string | undefined;
+        userEmail?: string | undefined;
+        userDisplayName?: string | undefined;
+        expiresIn?: string | undefined;
+    }, {
+        sessionToken: string;
+        userId?: string | undefined;
+        userEmail?: string | undefined;
+        userDisplayName?: string | undefined;
+        expiresIn?: string | undefined;
+    }>;
+    successCheck: z.ZodOptional<z.ZodObject<{
+        path: z.ZodString;
+        expectedValue: z.ZodUnion<[z.ZodString, z.ZodBoolean, z.ZodNumber]>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        expectedValue: string | number | boolean;
+    }, {
+        path: string;
+        expectedValue: string | number | boolean;
+    }>>;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    tokenUsage: z.ZodOptional<z.ZodEnum<["cookie", "bearer", "header"]>>;
+    tokenHeader: z.ZodOptional<z.ZodString>;
+    cookieFormat: z.ZodOptional<z.ZodString>;
+    apiHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    consentOverrides: z.ZodOptional<z.ZodObject<{
+        branding: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        formTitle: z.ZodOptional<z.ZodString>;
+        formDescription: z.ZodOptional<z.ZodString>;
+        identityFieldLabel: z.ZodOptional<z.ZodString>;
+        identityFieldType: z.ZodOptional<z.ZodEnum<["text", "email", "tel"]>>;
+        passwordFieldLabel: z.ZodOptional<z.ZodString>;
+        submitButtonText: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        branding?: Record<string, unknown> | undefined;
+        formTitle?: string | undefined;
+        formDescription?: string | undefined;
+        identityFieldLabel?: string | undefined;
+        identityFieldType?: "text" | "email" | "tel" | undefined;
+        passwordFieldLabel?: string | undefined;
+        submitButtonText?: string | undefined;
+    }, {
+        branding?: Record<string, unknown> | undefined;
+        formTitle?: string | undefined;
+        formDescription?: string | undefined;
+        identityFieldLabel?: string | undefined;
+        identityFieldType?: "text" | "email" | "tel" | undefined;
+        passwordFieldLabel?: string | undefined;
+        submitButtonText?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    type: "credential";
+    authEndpoint: string;
+    requestBodyTemplate: Record<string, string>;
+    responseFields: {
+        sessionToken: string;
+        userId?: string | undefined;
+        userEmail?: string | undefined;
+        userDisplayName?: string | undefined;
+        expiresIn?: string | undefined;
+    };
+    displayName?: string | undefined;
+    successCheck?: {
+        path: string;
+        expectedValue: string | number | boolean;
+    } | undefined;
+    headers?: Record<string, string> | undefined;
+    tokenUsage?: "cookie" | "bearer" | "header" | undefined;
+    tokenHeader?: string | undefined;
+    cookieFormat?: string | undefined;
+    apiHeaders?: Record<string, string> | undefined;
+    consentOverrides?: {
+        branding?: Record<string, unknown> | undefined;
+        formTitle?: string | undefined;
+        formDescription?: string | undefined;
+        identityFieldLabel?: string | undefined;
+        identityFieldType?: "text" | "email" | "tel" | undefined;
+        passwordFieldLabel?: string | undefined;
+        submitButtonText?: string | undefined;
+    } | undefined;
+}, {
+    type: "credential";
+    authEndpoint: string;
+    requestBodyTemplate: Record<string, string>;
+    responseFields: {
+        sessionToken: string;
+        userId?: string | undefined;
+        userEmail?: string | undefined;
+        userDisplayName?: string | undefined;
+        expiresIn?: string | undefined;
+    };
+    displayName?: string | undefined;
+    successCheck?: {
+        path: string;
+        expectedValue: string | number | boolean;
+    } | undefined;
+    headers?: Record<string, string> | undefined;
+    tokenUsage?: "cookie" | "bearer" | "header" | undefined;
+    tokenHeader?: string | undefined;
+    cookieFormat?: string | undefined;
+    apiHeaders?: Record<string, string> | undefined;
+    consentOverrides?: {
+        branding?: Record<string, unknown> | undefined;
+        formTitle?: string | undefined;
+        formDescription?: string | undefined;
+        identityFieldLabel?: string | undefined;
+        identityFieldType?: "text" | "email" | "tel" | undefined;
+        passwordFieldLabel?: string | undefined;
+        submitButtonText?: string | undefined;
+    } | undefined;
+}>]>;
+/**
+ * IDP Tokens
+ *
+ * Tokens received from OAuth provider (IDP = Identity Provider)
+ */
+export interface IdpTokens {
+    /** OAuth access token for API calls */
+    access_token: string;
+    /** OAuth refresh token (optional) */
+    refresh_token?: string;
+    /** Token expiration time in seconds */
+    expires_in?: number;
+    /** Token expiration timestamp (milliseconds since epoch) */
+    expires_at: number;
+    /** Token type (usually "Bearer") */
+    token_type: string;
+    /** Granted scopes */
+    scope?: string;
+}
+/**
+ * Know That AI Registration
+ *
+ * Tracks whether and when this agent was registered with Know That AI
+ * for reputation tracking and discovery.
+ *
+ * Present when agent is registered via:
+ * - CLI: `mcpi register`
+ * - Scaffolder: `create-mcpi-app --register`
+ * - Shadow registration (automatic for did:key)
+ */
+export interface KTARegistration {
+    /**
+     * Whether registration was successful
+     */
+    registered: boolean;
+    /**
+     * ISO 8601 timestamp of when the agent was registered
+     * @example '2025-01-15T10:30:00.000Z'
+     */
+    registeredAt: string;
+    /**
+     * Claim URL for did:web identity verification
+     * - For did:web agents: URL to claim public listing
+     * - For did:key agents: null (shadow registration, no public listing)
+     * @example 'https://knowthat.ai/agents/claim/abc123'
+     */
+    claimUrl: string | null;
+}
+/**
+ * Zod schema for KTARegistration
+ */
+export declare const KTARegistrationSchema: z.ZodObject<{
+    registered: z.ZodBoolean;
+    registeredAt: z.ZodString;
+    claimUrl: z.ZodNullable<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    registered: boolean;
+    registeredAt: string;
+    claimUrl: string | null;
+}, {
+    registered: boolean;
+    registeredAt: string;
+    claimUrl: string | null;
+}>;
+/**
+ * Agent identity representation
+ * The actual identity data structure used at runtime
+ */
+export interface AgentIdentity {
+    /**
+     * Decentralized Identifier
+     * @example 'did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK'
+     */
+    did: string;
+    /**
+     * Base64-encoded public key
+     */
+    publicKey: string;
+    /**
+     * Base64-encoded private key
+     * NOTE: Should be kept secure and never logged
+     */
+    privateKey: string;
+    /**
+     * ISO 8601 timestamp of when the identity was created
+     */
+    createdAt: string;
+    /**
+     * Know That AI registration information
+     * Present when agent is registered with KTA for reputation tracking.
+     *
+     * @example
+     * ```typescript
+     * if (identity.kta?.registered) {
+     *   // Agent is registered, reputation tracking is enabled
+     * }
+     * ```
+     */
+    kta?: KTARegistration;
+    /**
+     * Optional metadata about the identity
+     */
+    metadata?: {
+        /**
+         * Human-readable name for this identity
+         */
+        name?: string;
+        /**
+         * Version of the identity format
+         */
+        version?: string;
+        /**
+         * Additional custom properties
+         */
+        [key: string]: unknown;
+    };
+}
+/**
+ * Zod schema for AgentIdentity validation
+ */
+export declare const AgentIdentitySchema: z.ZodObject<{
+    did: z.ZodEffects<z.ZodString, string, string>;
+    publicKey: z.ZodString;
+    privateKey: z.ZodString;
+    createdAt: z.ZodString;
+    kta: z.ZodOptional<z.ZodObject<{
+        registered: z.ZodBoolean;
+        registeredAt: z.ZodString;
+        claimUrl: z.ZodNullable<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        registered: boolean;
+        registeredAt: string;
+        claimUrl: string | null;
+    }, {
+        registered: boolean;
+        registeredAt: string;
+        claimUrl: string | null;
+    }>>;
+    metadata: z.ZodOptional<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        version: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        name: z.ZodOptional<z.ZodString>;
+        version: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        name: z.ZodOptional<z.ZodString>;
+        version: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>>;
+}, "strip", z.ZodTypeAny, {
+    did: string;
+    publicKey: string;
+    privateKey: string;
+    createdAt: string;
+    metadata?: z.objectOutputType<{
+        name: z.ZodOptional<z.ZodString>;
+        version: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough"> | undefined;
+    kta?: {
+        registered: boolean;
+        registeredAt: string;
+        claimUrl: string | null;
+    } | undefined;
+}, {
+    did: string;
+    publicKey: string;
+    privateKey: string;
+    createdAt: string;
+    metadata?: z.objectInputType<{
+        name: z.ZodOptional<z.ZodString>;
+        version: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough"> | undefined;
+    kta?: {
+        registered: boolean;
+        registeredAt: string;
+        claimUrl: string | null;
+    } | undefined;
+}>;