@kya-os/contracts 1.5.3-canary.13 → 1.5.3-canary.15

package/dist/agentshield-api/schemas.d.ts

@@ -211,12 +211,12 @@ export declare const proofSubmissionRequestSchema: z.ZodObject<{
                 identifier: string;
             }>>;
         }, "strip", z.ZodTypeAny, {
-            sessionId: string;
-            scopes: string[];
             timestamp: number;
+            sessionId: string;
             eventType: "consent:page_viewed" | "consent:approved" | "consent:delegation_created" | "consent:credential_required";
             agentDid: string;
             targetTools: string[];
+            scopes: string[];
             projectId: string;
             userDid?: string | undefined;
             delegationId?: string | undefined;
@@ -227,12 +227,12 @@ export declare const proofSubmissionRequestSchema: z.ZodObject<{
                 identifier: string;
             } | undefined;
         }, {
-            sessionId: string;
-            scopes: string[];
             timestamp: number;
+            sessionId: string;
             eventType: "consent:page_viewed" | "consent:approved" | "consent:delegation_created" | "consent:credential_required";
             agentDid: string;
             targetTools: string[];
+            scopes: string[];
             projectId: string;
             userDid?: string | undefined;
             delegationId?: string | undefined;
@@ -253,12 +253,12 @@ export declare const proofSubmissionRequestSchema: z.ZodObject<{
             userIdentifier?: string | undefined;
         }[] | undefined;
         consentEvents?: {
-            sessionId: string;
-            scopes: string[];
             timestamp: number;
+            sessionId: string;
             eventType: "consent:page_viewed" | "consent:approved" | "consent:delegation_created" | "consent:credential_required";
             agentDid: string;
             targetTools: string[];
+            scopes: string[];
             projectId: string;
             userDid?: string | undefined;
             delegationId?: string | undefined;
@@ -279,12 +279,12 @@ export declare const proofSubmissionRequestSchema: z.ZodObject<{
             userIdentifier?: string | undefined;
         }[] | undefined;
         consentEvents?: {
-            sessionId: string;
-            scopes: string[];
             timestamp: number;
+            sessionId: string;
             eventType: "consent:page_viewed" | "consent:approved" | "consent:delegation_created" | "consent:credential_required";
             agentDid: string;
             targetTools: string[];
+            scopes: string[];
             projectId: string;
             userDid?: string | undefined;
             delegationId?: string | undefined;
@@ -325,12 +325,12 @@ export declare const proofSubmissionRequestSchema: z.ZodObject<{
             userIdentifier?: string | undefined;
         }[] | undefined;
         consentEvents?: {
-            sessionId: string;
-            scopes: string[];
             timestamp: number;
+            sessionId: string;
             eventType: "consent:page_viewed" | "consent:approved" | "consent:delegation_created" | "consent:credential_required";
             agentDid: string;
             targetTools: string[];
+            scopes: string[];
             projectId: string;
             userDid?: string | undefined;
             delegationId?: string | undefined;
@@ -371,12 +371,12 @@ export declare const proofSubmissionRequestSchema: z.ZodObject<{
             userIdentifier?: string | undefined;
         }[] | undefined;
         consentEvents?: {
-            sessionId: string;
-            scopes: string[];
             timestamp: number;
+            sessionId: string;
             eventType: "consent:page_viewed" | "consent:approved" | "consent:delegation_created" | "consent:credential_required";
             agentDid: string;
             targetTools: string[];
+            scopes: string[];
             projectId: string;
             userDid?: string | undefined;
             delegationId?: string | undefined;
@@ -397,7 +397,7 @@ export declare const proofSubmissionResponseSchema: z.ZodObject<{
     success: z.ZodBoolean;
     accepted: z.ZodNumber;
     rejected: z.ZodNumber;
-    outcomes: z.ZodRecord<z.ZodString, z.ZodNumber>;
+    outcomes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
     errors: z.ZodOptional<z.ZodArray<z.ZodObject<{
         proof_index: z.ZodNumber;
         error: z.ZodObject<{
@@ -414,45 +414,45 @@ export declare const proofSubmissionResponseSchema: z.ZodObject<{
             details?: Record<string, unknown> | undefined;
         }>;
     }, "strip", z.ZodTypeAny, {
+        proof_index: number;
         error: {
             code: string;
             message: string;
             details?: Record<string, unknown> | undefined;
         };
-        proof_index: number;
     }, {
+        proof_index: number;
         error: {
             code: string;
             message: string;
             details?: Record<string, unknown> | undefined;
         };
-        proof_index: number;
     }>, "many">>;
 }, "strip", z.ZodTypeAny, {
     success: boolean;
     accepted: number;
     rejected: number;
-    outcomes: Record<string, number>;
+    outcomes?: Record<string, number> | undefined;
     errors?: {
+        proof_index: number;
         error: {
             code: string;
             message: string;
             details?: Record<string, unknown> | undefined;
         };
-        proof_index: number;
     }[] | undefined;
 }, {
     success: boolean;
     accepted: number;
     rejected: number;
-    outcomes: Record<string, number>;
+    outcomes?: Record<string, number> | undefined;
     errors?: {
+        proof_index: number;
         error: {
             code: string;
             message: string;
             details?: Record<string, unknown> | undefined;
         };
-        proof_index: number;
     }[] | undefined;
 }>;
 /**
@@ -471,24 +471,24 @@ export declare const delegationCredentialSchema: z.ZodObject<{
     agent_did: string;
     issued_at: number;
     created_at: number;
-    constraints?: Record<string, unknown> | undefined;
     user_id?: string | undefined;
     user_identifier?: string | undefined;
+    constraints?: Record<string, unknown> | undefined;
 }, {
     scopes: string[];
     agent_did: string;
     issued_at: number;
     created_at: number;
-    constraints?: Record<string, unknown> | undefined;
     user_id?: string | undefined;
     user_identifier?: string | undefined;
+    constraints?: Record<string, unknown> | undefined;
 }>;
 /**
  * Delegation verification request schema
  */
 export declare const verifyDelegationRequestSchema: z.ZodObject<{
-    scopes: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
     timestamp: z.ZodOptional<z.ZodNumber>;
+    scopes: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
     agent_did: z.ZodString;
     credential_jwt: z.ZodOptional<z.ZodString>;
     delegation_token: z.ZodOptional<z.ZodString>;
@@ -507,8 +507,8 @@ export declare const verifyDelegationRequestSchema: z.ZodObject<{
     }>>;
 }, "strip", z.ZodTypeAny, {
     agent_did: string;
-    scopes?: string[] | undefined;
     timestamp?: number | undefined;
+    scopes?: string[] | undefined;
     credential_jwt?: string | undefined;
     delegation_token?: string | undefined;
     client_info?: {
@@ -518,8 +518,8 @@ export declare const verifyDelegationRequestSchema: z.ZodObject<{
     } | undefined;
 }, {
     agent_did: string;
-    scopes?: string[] | undefined;
     timestamp?: number | undefined;
+    scopes?: string[] | undefined;
     credential_jwt?: string | undefined;
     delegation_token?: string | undefined;
     client_info?: {
@@ -1778,17 +1778,17 @@ export declare const verifyDelegationResponseSchema: z.ZodObject<{
         agent_did: string;
         issued_at: number;
         created_at: number;
-        constraints?: Record<string, unknown> | undefined;
         user_id?: string | undefined;
         user_identifier?: string | undefined;
+        constraints?: Record<string, unknown> | undefined;
     }, {
         scopes: string[];
         agent_did: string;
         issued_at: number;
         created_at: number;
-        constraints?: Record<string, unknown> | undefined;
         user_id?: string | undefined;
         user_identifier?: string | undefined;
+        constraints?: Record<string, unknown> | undefined;
     }>>;
     error: z.ZodOptional<z.ZodObject<{
         code: z.ZodString;
@@ -1806,12 +1806,12 @@ export declare const verifyDelegationResponseSchema: z.ZodObject<{
     reason: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     valid: boolean;
+    delegation_id?: string | undefined;
     error?: {
         code: string;
         message: string;
         details?: Record<string, unknown> | undefined;
     } | undefined;
-    delegation_id?: string | undefined;
     delegation?: z.objectOutputType<{
         id: z.ZodString;
         issuerDid: z.ZodString;
@@ -2228,19 +2228,19 @@ export declare const verifyDelegationResponseSchema: z.ZodObject<{
         agent_did: string;
         issued_at: number;
         created_at: number;
-        constraints?: Record<string, unknown> | undefined;
         user_id?: string | undefined;
         user_identifier?: string | undefined;
+        constraints?: Record<string, unknown> | undefined;
     } | undefined;
     reason?: string | undefined;
 }, {
     valid: boolean;
+    delegation_id?: string | undefined;
     error?: {
         code: string;
         message: string;
         details?: Record<string, unknown> | undefined;
     } | undefined;
-    delegation_id?: string | undefined;
     delegation?: z.objectInputType<{
         id: z.ZodString;
         issuerDid: z.ZodString;
@@ -2657,9 +2657,9 @@ export declare const verifyDelegationResponseSchema: z.ZodObject<{
         agent_did: string;
         issued_at: number;
         created_at: number;
-        constraints?: Record<string, unknown> | undefined;
         user_id?: string | undefined;
         user_identifier?: string | undefined;
+        constraints?: Record<string, unknown> | undefined;
     } | undefined;
     reason?: string | undefined;
 }>;
@@ -3915,17 +3915,17 @@ export declare const verifyDelegationAPIResponseSchema: z.ZodObject<{
             agent_did: string;
             issued_at: number;
             created_at: number;
-            constraints?: Record<string, unknown> | undefined;
             user_id?: string | undefined;
             user_identifier?: string | undefined;
+            constraints?: Record<string, unknown> | undefined;
         }, {
             scopes: string[];
             agent_did: string;
             issued_at: number;
             created_at: number;
-            constraints?: Record<string, unknown> | undefined;
             user_id?: string | undefined;
             user_identifier?: string | undefined;
+            constraints?: Record<string, unknown> | undefined;
         }>>;
         error: z.ZodOptional<z.ZodObject<{
             code: z.ZodString;
@@ -3943,12 +3943,12 @@ export declare const verifyDelegationAPIResponseSchema: z.ZodObject<{
         reason: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         valid: boolean;
+        delegation_id?: string | undefined;
         error?: {
             code: string;
             message: string;
             details?: Record<string, unknown> | undefined;
         } | undefined;
-        delegation_id?: string | undefined;
         delegation?: z.objectOutputType<{
             id: z.ZodString;
             issuerDid: z.ZodString;
@@ -4365,19 +4365,19 @@ export declare const verifyDelegationAPIResponseSchema: z.ZodObject<{
             agent_did: string;
             issued_at: number;
             created_at: number;
-            constraints?: Record<string, unknown> | undefined;
             user_id?: string | undefined;
             user_identifier?: string | undefined;
+            constraints?: Record<string, unknown> | undefined;
         } | undefined;
         reason?: string | undefined;
     }, {
         valid: boolean;
+        delegation_id?: string | undefined;
         error?: {
             code: string;
             message: string;
             details?: Record<string, unknown> | undefined;
         } | undefined;
-        delegation_id?: string | undefined;
         delegation?: z.objectInputType<{
             id: z.ZodString;
             issuerDid: z.ZodString;
@@ -4794,9 +4794,9 @@ export declare const verifyDelegationAPIResponseSchema: z.ZodObject<{
             agent_did: string;
             issued_at: number;
             created_at: number;
-            constraints?: Record<string, unknown> | undefined;
             user_id?: string | undefined;
             user_identifier?: string | undefined;
+            constraints?: Record<string, unknown> | undefined;
         } | undefined;
         reason?: string | undefined;
     }>;
@@ -4814,12 +4814,12 @@ export declare const verifyDelegationAPIResponseSchema: z.ZodObject<{
     success: boolean;
     data: {
         valid: boolean;
+        delegation_id?: string | undefined;
         error?: {
             code: string;
             message: string;
             details?: Record<string, unknown> | undefined;
         } | undefined;
-        delegation_id?: string | undefined;
         delegation?: z.objectOutputType<{
             id: z.ZodString;
             issuerDid: z.ZodString;
@@ -5236,9 +5236,9 @@ export declare const verifyDelegationAPIResponseSchema: z.ZodObject<{
             agent_did: string;
             issued_at: number;
             created_at: number;
-            constraints?: Record<string, unknown> | undefined;
             user_id?: string | undefined;
             user_identifier?: string | undefined;
+            constraints?: Record<string, unknown> | undefined;
         } | undefined;
         reason?: string | undefined;
     };
@@ -5250,12 +5250,12 @@ export declare const verifyDelegationAPIResponseSchema: z.ZodObject<{
     success: boolean;
     data: {
         valid: boolean;
+        delegation_id?: string | undefined;
         error?: {
             code: string;
             message: string;
             details?: Record<string, unknown> | undefined;
         } | undefined;
-        delegation_id?: string | undefined;
         delegation?: z.objectInputType<{
             id: z.ZodString;
             issuerDid: z.ZodString;
@@ -5672,9 +5672,9 @@ export declare const verifyDelegationAPIResponseSchema: z.ZodObject<{
             agent_did: string;
             issued_at: number;
             created_at: number;
-            constraints?: Record<string, unknown> | undefined;
             user_id?: string | undefined;
             user_identifier?: string | undefined;
+            constraints?: Record<string, unknown> | undefined;
         } | undefined;
         reason?: string | undefined;
     };
@@ -5981,8 +5981,8 @@ export declare const createDelegationResponseSchema: z.ZodObject<{
     created_at: z.ZodString;
 }, "strip", z.ZodTypeAny, {
     status: "active" | "revoked" | "expired";
-    scopes: string[];
     delegation_id: string;
+    scopes: string[];
     agent_did: string;
     issued_at: string;
     created_at: string;
@@ -5991,8 +5991,8 @@ export declare const createDelegationResponseSchema: z.ZodObject<{
     expires_at?: string | null | undefined;
 }, {
     status: "active" | "revoked" | "expired";
-    scopes: string[];
     delegation_id: string;
+    scopes: string[];
     agent_did: string;
     issued_at: string;
     created_at: string;
@@ -6017,8 +6017,8 @@ export declare const createDelegationAPIResponseSchema: z.ZodObject<{
         created_at: z.ZodString;
     }, "strip", z.ZodTypeAny, {
         status: "active" | "revoked" | "expired";
-        scopes: string[];
         delegation_id: string;
+        scopes: string[];
         agent_did: string;
         issued_at: string;
         created_at: string;
@@ -6027,8 +6027,8 @@ export declare const createDelegationAPIResponseSchema: z.ZodObject<{
         expires_at?: string | null | undefined;
     }, {
         status: "active" | "revoked" | "expired";
-        scopes: string[];
         delegation_id: string;
+        scopes: string[];
         agent_did: string;
         issued_at: string;
         created_at: string;
@@ -6050,8 +6050,8 @@ export declare const createDelegationAPIResponseSchema: z.ZodObject<{
     success: boolean;
     data: {
         status: "active" | "revoked" | "expired";
-        scopes: string[];
         delegation_id: string;
+        scopes: string[];
         agent_did: string;
         issued_at: string;
         created_at: string;
@@ -6067,8 +6067,8 @@ export declare const createDelegationAPIResponseSchema: z.ZodObject<{
     success: boolean;
     data: {
         status: "active" | "revoked" | "expired";
-        scopes: string[];
         delegation_id: string;
+        scopes: string[];
         agent_did: string;
         issued_at: string;
         created_at: string;
@@ -6099,12 +6099,12 @@ export declare const revokeDelegationResponseSchema: z.ZodObject<{
     revoked: z.ZodBoolean;
     revoked_at: z.ZodNumber;
 }, "strip", z.ZodTypeAny, {
-    revoked: boolean;
     delegation_id: string;
+    revoked: boolean;
     revoked_at: number;
 }, {
-    revoked: boolean;
     delegation_id: string;
+    revoked: boolean;
     revoked_at: number;
 }>;
 /**
@@ -6117,12 +6117,12 @@ export declare const revokeDelegationAPIResponseSchema: z.ZodObject<{
         revoked: z.ZodBoolean;
         revoked_at: z.ZodNumber;
     }, "strip", z.ZodTypeAny, {
-        revoked: boolean;
         delegation_id: string;
+        revoked: boolean;
         revoked_at: number;
     }, {
-        revoked: boolean;
         delegation_id: string;
+        revoked: boolean;
         revoked_at: number;
     }>;
     metadata: z.ZodOptional<z.ZodObject<{
@@ -6138,8 +6138,8 @@ export declare const revokeDelegationAPIResponseSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     success: boolean;
     data: {
-        revoked: boolean;
         delegation_id: string;
+        revoked: boolean;
         revoked_at: number;
     };
     metadata?: {
@@ -6149,8 +6149,8 @@ export declare const revokeDelegationAPIResponseSchema: z.ZodObject<{
 }, {
     success: boolean;
     data: {
-        revoked: boolean;
         delegation_id: string;
+        revoked: boolean;
         revoked_at: number;
     };
     metadata?: {

package/dist/agentshield-api/schemas.js

@@ -97,7 +97,7 @@ exports.proofSubmissionResponseSchema = zod_1.z.object({
     success: zod_1.z.boolean(),
     accepted: zod_1.z.number().int().min(0),
     rejected: zod_1.z.number().int().min(0),
-    outcomes: zod_1.z.record(zod_1.z.string(), zod_1.z.number().int().min(0)), // Record<BouncerOutcome, number>
+    outcomes: zod_1.z.record(zod_1.z.string(), zod_1.z.number().int().min(0)).optional(), // Record<BouncerOutcome, number> - Optional because API may return empty object or omit it
     errors: zod_1.z
         .array(zod_1.z.object({
         proof_index: zod_1.z.number().int().min(0),

package/dist/agentshield-api/types.d.ts

@@ -94,7 +94,7 @@ export interface ProofSubmissionResponse {
     success: boolean;
     accepted: number;
     rejected: number;
-    outcomes: Record<BouncerOutcome, number>;
+    outcomes?: Record<BouncerOutcome, number>;
     errors?: Array<{
         proof_index: number;
         error: {

package/dist/config/identity.d.ts

@@ -73,6 +73,74 @@ export interface RuntimeIdentityConfig {
      */
     userDidStorage?: 'ephemeral' | 'persistent';
 }
+/**
+ * OAuth Provider Configuration
+ *
+ * Configuration for a single OAuth provider (GitHub, Google, etc.)
+ */
+export interface OAuthProvider {
+    /** OAuth client ID (public, safe to expose) */
+    clientId: string;
+    /** OAuth client secret (NOT returned in API response for security) */
+    clientSecret?: string | null;
+    /** OAuth authorization URL */
+    authorizationUrl: string;
+    /** OAuth token exchange URL */
+    tokenUrl: string;
+    /** OAuth user info endpoint URL */
+    userInfoUrl?: string;
+    /** Whether provider supports PKCE (Proof Key for Code Exchange) */
+    supportsPKCE: boolean;
+    /** Whether provider requires client secret (false for PKCE-only providers) */
+    requiresClientSecret: boolean;
+    /** Available scopes for this provider */
+    scopes?: string[];
+    /** Default scopes to request */
+    defaultScopes?: string[];
+    /** Whether provider uses proxy mode (via AgentShield) */
+    proxyMode?: boolean;
+    /** Custom OAuth parameters to include in authorization URL (e.g., audience, acr_values) */
+    customParams?: Record<string, string>;
+    /** Token endpoint authentication method */
+    tokenEndpointAuthMethod?: 'client_secret_post' | 'client_secret_basic';
+    /** OAuth response type (default: "code") */
+    responseType?: string;
+    /** OAuth grant type (default: "authorization_code") */
+    grantType?: string;
+}
+/**
+ * OAuth Configuration
+ *
+ * Configuration for OAuth providers fetched from AgentShield API.
+ * Contains all available providers for a project.
+ *
+ * Note: API does NOT return a defaultProvider field (Phase 1 architecture).
+ * Phase 1 uses configured provider as temporary fallback.
+ * Phase 2+ requires tools to explicitly specify oauthProvider.
+ */
+export interface OAuthConfig {
+    /** Map of provider names to provider configurations */
+    providers: Record<string, OAuthProvider>;
+}
+/**
+ * IDP Tokens
+ *
+ * Tokens received from OAuth provider (IDP = Identity Provider)
+ */
+export interface IdpTokens {
+    /** OAuth access token for API calls */
+    access_token: string;
+    /** OAuth refresh token (optional) */
+    refresh_token?: string;
+    /** Token expiration time in seconds */
+    expires_in?: number;
+    /** Token expiration timestamp (milliseconds since epoch) */
+    expires_at: number;
+    /** Token type (usually "Bearer") */
+    token_type: string;
+    /** Granted scopes */
+    scope?: string;
+}
 /**
  * Agent identity representation
  * The actual identity data structure used at runtime

package/dist/config/index.d.ts

@@ -12,7 +12,8 @@ import type { ProofingConfig } from "./proofing.js";
 import type { DelegationConfig } from "./delegation.js";
 import type { ToolProtectionSourceConfig } from "./tool-protection.js";
 export { MCPIBaseConfig } from "./base.js";
-export { RuntimeIdentityConfig, AgentIdentity } from "./identity.js";
+export { RuntimeIdentityConfig, AgentIdentity, OAuthProvider, OAuthConfig, IdpTokens, } from "./identity.js";
+export type { ToolExecutionContext } from "./tool-context.js";
 /**
  * @deprecated Use RuntimeIdentityConfig instead
  * This export is maintained for backward compatibility

package/dist/config/tool-context.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Tool Execution Context
+ *
+ * Execution context passed to tool handlers, enabling tools to access
+ * IDP tokens for external API calls (GitHub, Google, etc.).
+ *
+ * All fields are optional for backward compatibility - tools that don't
+ * require OAuth will receive undefined context.
+ *
+ * @package @kya-os/contracts
+ */
+/**
+ * Execution context passed to tool handlers
+ *
+ * Enables tools to access IDP tokens for external API calls.
+ * Context is only provided when:
+ * - Tool requires OAuth (has requiredScopes)
+ * - User DID is available
+ * - IDP token is successfully resolved
+ */
+export interface ToolExecutionContext {
+    /** IDP access token for external API calls (e.g., GitHub, Google) */
+    idpToken?: string;
+    /** OAuth provider name (e.g., "github", "google") */
+    provider?: string;
+    /** Scopes granted for this token */
+    scopes?: string[];
+    /** User DID associated with this token */
+    userDid?: string;
+    /** Session ID */
+    sessionId?: string;
+    /** Delegation token (MCP-I internal authorization) */
+    delegationToken?: string;
+}

package/dist/config/tool-context.js

@@ -0,0 +1,13 @@
+"use strict";
+/**
+ * Tool Execution Context
+ *
+ * Execution context passed to tool handlers, enabling tools to access
+ * IDP tokens for external API calls (GitHub, Google, etc.).
+ *
+ * All fields are optional for backward compatibility - tools that don't
+ * require OAuth will receive undefined context.
+ *
+ * @package @kya-os/contracts
+ */
+Object.defineProperty(exports, "__esModule", { value: true });