@kya-os/contracts 1.7.12 → 1.7.14

package/dist/handshake.d.ts

@@ -24,16 +24,16 @@ export declare const MCPClientInfoSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     name: string;
     version?: string | undefined;
+    title?: string | undefined;
     platform?: string | undefined;
     vendor?: string | undefined;
-    title?: string | undefined;
     persistentId?: string | undefined;
 }, {
     name: string;
     version?: string | undefined;
+    title?: string | undefined;
     platform?: string | undefined;
     vendor?: string | undefined;
-    title?: string | undefined;
     persistentId?: string | undefined;
 }>;
 export declare const MCPClientSessionInfoSchema: z.ZodObject<{
@@ -48,22 +48,22 @@ export declare const MCPClientSessionInfoSchema: z.ZodObject<{
     protocolVersion: z.ZodOptional<z.ZodString>;
     capabilities: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, "strip", z.ZodTypeAny, {
-    name: string;
     clientId: string;
+    name: string;
     version?: string | undefined;
+    title?: string | undefined;
     platform?: string | undefined;
     vendor?: string | undefined;
-    title?: string | undefined;
     persistentId?: string | undefined;
     protocolVersion?: string | undefined;
     capabilities?: Record<string, unknown> | undefined;
 }, {
-    name: string;
     clientId: string;
+    name: string;
     version?: string | undefined;
+    title?: string | undefined;
     platform?: string | undefined;
     vendor?: string | undefined;
-    title?: string | undefined;
     persistentId?: string | undefined;
     protocolVersion?: string | undefined;
     capabilities?: Record<string, unknown> | undefined;
@@ -84,20 +84,20 @@ export declare const HandshakeRequestSchema: z.ZodObject<{
         clientId: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         name: string;
+        clientId?: string | undefined;
         version?: string | undefined;
+        title?: string | undefined;
         platform?: string | undefined;
         vendor?: string | undefined;
-        title?: string | undefined;
         persistentId?: string | undefined;
-        clientId?: string | undefined;
     }, {
         name: string;
+        clientId?: string | undefined;
         version?: string | undefined;
+        title?: string | undefined;
         platform?: string | undefined;
         vendor?: string | undefined;
-        title?: string | undefined;
         persistentId?: string | undefined;
-        clientId?: string | undefined;
     }>>;
     clientProtocolVersion: z.ZodOptional<z.ZodString>;
     clientCapabilities: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -108,12 +108,12 @@ export declare const HandshakeRequestSchema: z.ZodObject<{
     agentDid?: string | undefined;
     clientInfo?: {
         name: string;
+        clientId?: string | undefined;
         version?: string | undefined;
+        title?: string | undefined;
         platform?: string | undefined;
         vendor?: string | undefined;
-        title?: string | undefined;
         persistentId?: string | undefined;
-        clientId?: string | undefined;
     } | undefined;
     clientProtocolVersion?: string | undefined;
     clientCapabilities?: Record<string, unknown> | undefined;
@@ -124,12 +124,12 @@ export declare const HandshakeRequestSchema: z.ZodObject<{
     agentDid?: string | undefined;
     clientInfo?: {
         name: string;
+        clientId?: string | undefined;
         version?: string | undefined;
+        title?: string | undefined;
         platform?: string | undefined;
         vendor?: string | undefined;
-        title?: string | undefined;
         persistentId?: string | undefined;
-        clientId?: string | undefined;
     } | undefined;
     clientProtocolVersion?: string | undefined;
     clientCapabilities?: Record<string, unknown> | undefined;
@@ -158,22 +158,22 @@ export declare const SessionContextSchema: z.ZodObject<{
         protocolVersion: z.ZodOptional<z.ZodString>;
         capabilities: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, "strip", z.ZodTypeAny, {
-        name: string;
         clientId: string;
+        name: string;
         version?: string | undefined;
+        title?: string | undefined;
         platform?: string | undefined;
         vendor?: string | undefined;
-        title?: string | undefined;
         persistentId?: string | undefined;
         protocolVersion?: string | undefined;
         capabilities?: Record<string, unknown> | undefined;
     }, {
-        name: string;
         clientId: string;
+        name: string;
         version?: string | undefined;
+        title?: string | undefined;
         platform?: string | undefined;
         vendor?: string | undefined;
-        title?: string | undefined;
         persistentId?: string | undefined;
         protocolVersion?: string | undefined;
         capabilities?: Record<string, unknown> | undefined;
@@ -204,65 +204,65 @@ export declare const SessionContextSchema: z.ZodObject<{
         name?: string | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
+    createdAt: number;
     nonce: string;
     audience: string;
-    sessionId: string;
-    createdAt: number;
     timestamp: number;
+    sessionId: string;
     lastActivity: number;
     ttlMinutes: number;
-    identityState: "anonymous" | "authenticated";
-    clientDid?: string | undefined;
-    userDid?: string | undefined;
+    identityState: "authenticated" | "anonymous";
     agentDid?: string | undefined;
-    oauthIdentity?: {
-        provider: string;
-        subject: string;
-        email?: string | undefined;
-        name?: string | undefined;
-    } | undefined;
     clientInfo?: {
-        name: string;
         clientId: string;
+        name: string;
         version?: string | undefined;
+        title?: string | undefined;
         platform?: string | undefined;
         vendor?: string | undefined;
-        title?: string | undefined;
         persistentId?: string | undefined;
         protocolVersion?: string | undefined;
         capabilities?: Record<string, unknown> | undefined;
     } | undefined;
     serverDid?: string | undefined;
-}, {
-    nonce: string;
-    audience: string;
-    sessionId: string;
-    createdAt: number;
-    timestamp: number;
-    lastActivity: number;
     clientDid?: string | undefined;
     userDid?: string | undefined;
-    agentDid?: string | undefined;
     oauthIdentity?: {
         provider: string;
         subject: string;
         email?: string | undefined;
         name?: string | undefined;
     } | undefined;
+}, {
+    createdAt: number;
+    nonce: string;
+    audience: string;
+    timestamp: number;
+    sessionId: string;
+    lastActivity: number;
+    agentDid?: string | undefined;
     clientInfo?: {
-        name: string;
         clientId: string;
+        name: string;
         version?: string | undefined;
+        title?: string | undefined;
         platform?: string | undefined;
         vendor?: string | undefined;
-        title?: string | undefined;
         persistentId?: string | undefined;
         protocolVersion?: string | undefined;
         capabilities?: Record<string, unknown> | undefined;
     } | undefined;
     ttlMinutes?: number | undefined;
     serverDid?: string | undefined;
-    identityState?: "anonymous" | "authenticated" | undefined;
+    clientDid?: string | undefined;
+    userDid?: string | undefined;
+    identityState?: "authenticated" | "anonymous" | undefined;
+    oauthIdentity?: {
+        provider: string;
+        subject: string;
+        email?: string | undefined;
+        name?: string | undefined;
+    } | undefined;
 }>;
 export declare const NonceCacheEntrySchema: z.ZodObject<{
     sessionId: z.ZodString;

package/dist/tool-protection/index.d.ts

@@ -16,9 +16,17 @@ import { z } from 'zod';
  * The VC output is always a DelegationCredential created on consent confirmation.
  */
 export type AuthorizationRequirement = {
+    /**
+     * @deprecated Use 'oauth2' instead. Will be removed in v2.0.0.
+     */
     type: 'oauth';
     provider: string;
     requiredScopes?: string[];
+} | {
+    /** OAuth 2.0 provider authentication (canonical) */
+    type: 'oauth2';
+    provider: string;
+    requiredScopes?: string[];
 } | {
     type: 'password';
     provider: string;
@@ -48,7 +56,10 @@ export type AuthorizationRequirement = {
 };
 /** Canonical authorization type values for type safety */
 export declare const AUTHORIZATION_TYPES: {
+    /** @deprecated Use OAUTH2 instead. Will be removed in v2.0.0. */
     readonly OAUTH: "oauth";
+    /** OAuth 2.0 provider authentication (canonical) */
+    readonly OAUTH2: "oauth2";
     readonly PASSWORD: "password";
     readonly MDL: "mdl";
     readonly IDV: "idv";
@@ -199,6 +210,18 @@ export declare const AuthorizationRequirementSchema: z.ZodDiscriminatedUnion<"ty
     type: "oauth";
     provider: string;
     requiredScopes?: string[] | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"oauth2">;
+    provider: z.ZodString;
+    requiredScopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    type: "oauth2";
+    provider: string;
+    requiredScopes?: string[] | undefined;
+}, {
+    type: "oauth2";
+    provider: string;
+    requiredScopes?: string[] | undefined;
 }>, z.ZodObject<{
     type: z.ZodLiteral<"password">;
     provider: z.ZodString;
@@ -280,6 +303,18 @@ export declare const ToolProtectionSchema: z.ZodObject<{
         type: "oauth";
         provider: string;
         requiredScopes?: string[] | undefined;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"oauth2">;
+        provider: z.ZodString;
+        requiredScopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        type: "oauth2";
+        provider: string;
+        requiredScopes?: string[] | undefined;
+    }, {
+        type: "oauth2";
+        provider: string;
+        requiredScopes?: string[] | undefined;
     }>, z.ZodObject<{
         type: z.ZodLiteral<"password">;
         provider: z.ZodString;
@@ -351,6 +386,10 @@ export declare const ToolProtectionSchema: z.ZodObject<{
         type: "oauth";
         provider: string;
         requiredScopes?: string[] | undefined;
+    } | {
+        type: "oauth2";
+        provider: string;
+        requiredScopes?: string[] | undefined;
     } | {
         type: "password";
         provider: string;
@@ -382,6 +421,10 @@ export declare const ToolProtectionSchema: z.ZodObject<{
         type: "oauth";
         provider: string;
         requiredScopes?: string[] | undefined;
+    } | {
+        type: "oauth2";
+        provider: string;
+        requiredScopes?: string[] | undefined;
     } | {
         type: "password";
         provider: string;
@@ -424,6 +467,18 @@ export declare const ToolProtectionMapSchema: z.ZodRecord<z.ZodString, z.ZodObje
         type: "oauth";
         provider: string;
         requiredScopes?: string[] | undefined;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"oauth2">;
+        provider: z.ZodString;
+        requiredScopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        type: "oauth2";
+        provider: string;
+        requiredScopes?: string[] | undefined;
+    }, {
+        type: "oauth2";
+        provider: string;
+        requiredScopes?: string[] | undefined;
     }>, z.ZodObject<{
         type: z.ZodLiteral<"password">;
         provider: z.ZodString;
@@ -495,6 +550,10 @@ export declare const ToolProtectionMapSchema: z.ZodRecord<z.ZodString, z.ZodObje
         type: "oauth";
         provider: string;
         requiredScopes?: string[] | undefined;
+    } | {
+        type: "oauth2";
+        provider: string;
+        requiredScopes?: string[] | undefined;
     } | {
         type: "password";
         provider: string;
@@ -526,6 +585,10 @@ export declare const ToolProtectionMapSchema: z.ZodRecord<z.ZodString, z.ZodObje
         type: "oauth";
         provider: string;
         requiredScopes?: string[] | undefined;
+    } | {
+        type: "oauth2";
+        provider: string;
+        requiredScopes?: string[] | undefined;
     } | {
         type: "password";
         provider: string;
@@ -569,6 +632,18 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
             type: "oauth";
             provider: string;
             requiredScopes?: string[] | undefined;
+        }>, z.ZodObject<{
+            type: z.ZodLiteral<"oauth2">;
+            provider: z.ZodString;
+            requiredScopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            type: "oauth2";
+            provider: string;
+            requiredScopes?: string[] | undefined;
+        }, {
+            type: "oauth2";
+            provider: string;
+            requiredScopes?: string[] | undefined;
         }>, z.ZodObject<{
             type: z.ZodLiteral<"password">;
             provider: z.ZodString;
@@ -640,6 +715,10 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
             type: "oauth";
             provider: string;
             requiredScopes?: string[] | undefined;
+        } | {
+            type: "oauth2";
+            provider: string;
+            requiredScopes?: string[] | undefined;
         } | {
             type: "password";
             provider: string;
@@ -671,6 +750,10 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
             type: "oauth";
             provider: string;
             requiredScopes?: string[] | undefined;
+        } | {
+            type: "oauth2";
+            provider: string;
+            requiredScopes?: string[] | undefined;
         } | {
             type: "password";
             provider: string;
@@ -717,6 +800,10 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
             type: "oauth";
             provider: string;
             requiredScopes?: string[] | undefined;
+        } | {
+            type: "oauth2";
+            provider: string;
+            requiredScopes?: string[] | undefined;
         } | {
             type: "password";
             provider: string;
@@ -755,6 +842,10 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
             type: "oauth";
             provider: string;
             requiredScopes?: string[] | undefined;
+        } | {
+            type: "oauth2";
+            provider: string;
+            requiredScopes?: string[] | undefined;
         } | {
             type: "password";
             provider: string;
@@ -818,10 +909,11 @@ export declare function isDelegationRequiredErrorData(obj: any): obj is Delegati
 export declare function isAuthorizationRequirement(obj: unknown): obj is AuthorizationRequirement;
 /**
  * Type guard to check if a ToolProtection has OAuth authorization
+ * Checks for both 'oauth' (deprecated) and 'oauth2' (canonical)
  */
 export declare function hasOAuthAuthorization(protection: ToolProtection): protection is ToolProtection & {
     authorization: {
-        type: 'oauth';
+        type: 'oauth' | 'oauth2';
     };
 };
 /**
@@ -921,21 +1013,24 @@ export declare function getAuthorizationTypeKey(auth: AuthorizationRequirement):
 /**
  * Normalize authorization requirement type
  *
- * Normalizes deprecated 'credential' type to 'verifiable_credential' and emits
- * deprecation warnings. This function should be called at runtime boundaries
- * when processing authorization requirements.
+ * Normalizes deprecated types to their canonical equivalents:
+ * - 'oauth' → 'oauth2'
+ * - 'credential' → 'verifiable_credential'
+ *
+ * This function should be called at runtime boundaries when processing
+ * authorization requirements.
  *
- * @param auth - Authorization requirement (may contain deprecated 'credential' type)
+ * @param auth - Authorization requirement (may contain deprecated types)
  * @param options - Normalization options
  * @returns Normalized authorization requirement
  *
  * @example
  * ```typescript
  * const normalized = normalizeAuthorizationType(
- *   { type: 'credential', credentialType: 'delegation' },
+ *   { type: 'oauth', provider: 'github' },
  *   { warn: true }
  * );
- * // Returns: { type: 'verifiable_credential', credentialType: 'delegation' }
+ * // Returns: { type: 'oauth2', provider: 'github' }
  * // Logs: DEPRECATION warning
  * ```
  */

package/dist/tool-protection/index.js

@@ -35,7 +35,10 @@ exports.normalizeAuthorizationType = normalizeAuthorizationType;
 const zod_1 = require("zod");
 /** Canonical authorization type values for type safety */
 exports.AUTHORIZATION_TYPES = {
+    /** @deprecated Use OAUTH2 instead. Will be removed in v2.0.0. */
     OAUTH: 'oauth',
+    /** OAuth 2.0 provider authentication (canonical) */
+    OAUTH2: 'oauth2',
     PASSWORD: 'password',
     MDL: 'mdl',
     IDV: 'idv',
@@ -46,11 +49,19 @@ exports.AUTHORIZATION_TYPES = {
  * Zod Schemas for Validation
  */
 exports.AuthorizationRequirementSchema = zod_1.z.discriminatedUnion('type', [
+    // Deprecated: 'oauth' is an alias for 'oauth2'
+    // Will be removed in v2.0.0. Use 'oauth2' instead.
     zod_1.z.object({
         type: zod_1.z.literal('oauth'),
         provider: zod_1.z.string(),
         requiredScopes: zod_1.z.array(zod_1.z.string()).optional(),
     }),
+    // OAuth 2.0 provider authentication (canonical)
+    zod_1.z.object({
+        type: zod_1.z.literal('oauth2'),
+        provider: zod_1.z.string(),
+        requiredScopes: zod_1.z.array(zod_1.z.string()).optional(),
+    }),
     zod_1.z.object({
         type: zod_1.z.literal('password'),
         provider: zod_1.z.string(),
@@ -127,9 +138,10 @@ function isAuthorizationRequirement(obj) {
 }
 /**
  * Type guard to check if a ToolProtection has OAuth authorization
+ * Checks for both 'oauth' (deprecated) and 'oauth2' (canonical)
  */
 function hasOAuthAuthorization(protection) {
-    return protection.authorization?.type === 'oauth';
+    return protection.authorization?.type === 'oauth' || protection.authorization?.type === 'oauth2';
 }
 /**
  * Type guard to check if a ToolProtection has password authorization
@@ -290,6 +302,7 @@ function determineConsentProviderType(hasOAuthIdentity, isPasswordFlow = false,
 function getAuthorizationTypeLabel(auth) {
     switch (auth.type) {
         case 'oauth':
+        case 'oauth2':
             return auth.provider
                 ? auth.provider.charAt(0).toUpperCase() + auth.provider.slice(1)
                 : 'OAuth Provider';
@@ -318,7 +331,8 @@ function getAuthorizationTypeLabel(auth) {
 function getAuthorizationTypeKey(auth) {
     switch (auth.type) {
         case 'oauth':
-            return `oauth:${auth.provider}`;
+        case 'oauth2':
+            return `oauth2:${auth.provider}`;
         case 'password':
             return `password:${auth.provider}`;
         case 'mdl':
@@ -341,26 +355,45 @@ function getAuthorizationTypeKey(auth) {
 /**
  * Normalize authorization requirement type
  *
- * Normalizes deprecated 'credential' type to 'verifiable_credential' and emits
- * deprecation warnings. This function should be called at runtime boundaries
- * when processing authorization requirements.
+ * Normalizes deprecated types to their canonical equivalents:
+ * - 'oauth' → 'oauth2'
+ * - 'credential' → 'verifiable_credential'
+ *
+ * This function should be called at runtime boundaries when processing
+ * authorization requirements.
  *
- * @param auth - Authorization requirement (may contain deprecated 'credential' type)
+ * @param auth - Authorization requirement (may contain deprecated types)
  * @param options - Normalization options
  * @returns Normalized authorization requirement
  *
  * @example
  * ```typescript
  * const normalized = normalizeAuthorizationType(
- *   { type: 'credential', credentialType: 'delegation' },
+ *   { type: 'oauth', provider: 'github' },
  *   { warn: true }
  * );
- * // Returns: { type: 'verifiable_credential', credentialType: 'delegation' }
+ * // Returns: { type: 'oauth2', provider: 'github' }
  * // Logs: DEPRECATION warning
  * ```
  */
 function normalizeAuthorizationType(auth, options = {}) {
     const { warn = true, logger = console.warn } = options;
+    // Normalize 'oauth' to 'oauth2'
+    if (auth.type === 'oauth') {
+        if (warn) {
+            logger(`DEPRECATION: Authorization type 'oauth' is deprecated and will be removed in v2.0.0. ` +
+                `Please update to 'oauth2'. ` +
+                `See https://github.com/modelcontextprotocol-identity/xmcp-i/blob/main/docs/migrations/oauth-to-oauth2.md`);
+        }
+        // Normalize to oauth2
+        const normalized = {
+            type: 'oauth2',
+            provider: auth.provider,
+            ...(auth.requiredScopes !== undefined && { requiredScopes: auth.requiredScopes }),
+        };
+        return normalized;
+    }
+    // Normalize 'credential' to 'verifiable_credential'
     if (auth.type === 'credential') {
         if (warn) {
             logger(`DEPRECATION: Authorization type 'credential' is deprecated and will be removed in v2.0.0. ` +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/contracts",
-  "version": "1.7.12",
+  "version": "1.7.14",
   "description": "Shared contracts, types, and schemas for MCP-I framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",