@kya-os/contracts 1.7.14 → 1.7.16

package/dist/delegation/schemas.js

@@ -15,7 +15,7 @@
  * Python Reference: Delegation-Documentation.md, Delegation-Service.md
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DelegationCredentialSchema = exports.DelegationCredentialSubjectSchema = exports.DELEGATION_CREDENTIAL_CONTEXT = exports.DELEGATION_STATUSES = exports.DEFAULT_DELEGATION_STATUS = exports.MAX_DELEGATION_CHAIN_DEPTH = exports.DelegationVerificationResultSchema = exports.DelegationCreationRequestSchema = exports.DelegationChainSchema = exports.DelegationChainEntrySchema = exports.DelegationRecordSchema = exports.DelegationStatusSchema = void 0;
+exports.DelegationCredentialSchema = exports.DelegationCredentialSubjectSchema = exports.DELEGATION_CREDENTIAL_CONTEXT = exports.DELEGATION_STATUSES = exports.DEFAULT_DELEGATION_STATUS = exports.MAX_DELEGATION_CHAIN_DEPTH = exports.DelegationVerificationResultSchema = exports.DelegationVerificationDetailsSchema = exports.AuthorizationInfoSchema = exports.DelegationCreationRequestSchema = exports.DelegationChainSchema = exports.DelegationChainEntrySchema = exports.DelegationRecordSchema = exports.DelegationStatusSchema = void 0;
 exports.validateDelegationRecord = validateDelegationRecord;
 exports.validateDelegationChain = validateDelegationChain;
 exports.isDelegationExpired = isDelegationExpired;
@@ -136,6 +136,71 @@ exports.DelegationCreationRequestSchema = zod_1.z.object({
     /** Optional VC ID (if not provided, will be created) */
     vcId: zod_1.z.string().optional(),
 });
+/**
+ * Authorization Info Schema
+ *
+ * Captures HOW the user verified their identity during consent.
+ * This is runtime verification metadata, separate from tool requirements.
+ *
+ * Note: This schema describes authorization info in verification results,
+ * not tool protection requirements (which use AuthorizationRequirementSchema).
+ */
+exports.AuthorizationInfoSchema = zod_1.z.object({
+    /**
+     * The authorization method used during consent
+     *
+     * - 'oauth2': OAuth 2.0 provider authentication (canonical)
+     * - 'oauth': Deprecated, use 'oauth2' (will be removed in v2.0.0)
+     * - 'password': Password/credential authentication
+     * - 'credential': Deprecated, use 'verifiable_credential' (will be removed in v2.0.0)
+     * - 'verifiable_credential': W3C Verifiable Credential
+     * - 'mdl': Mobile Driver's License
+     * - 'idv': Identity Verification
+     * - 'webauthn': WebAuthn/Passkey authentication
+     * - 'siwe': Sign-In with Ethereum (EIP-4361)
+     * - 'none': Consent-only (no authentication)
+     */
+    type: zod_1.z.enum([
+        'oauth',
+        'oauth2',
+        'password',
+        'credential',
+        'verifiable_credential',
+        'mdl',
+        'idv',
+        'webauthn',
+        'siwe',
+        'none',
+    ]),
+    /** OAuth/Password/IDV provider name (e.g., 'github', 'google', 'credentials') */
+    provider: zod_1.z.string().optional(),
+    /** Credential type for verifiable_credential or mdl auth */
+    credentialType: zod_1.z.string().optional(),
+    /** MDL issuer DID or identifier */
+    issuer: zod_1.z.string().optional(),
+    /** IDV verification level */
+    verificationLevel: zod_1.z.enum(['basic', 'enhanced', 'loa3']).optional(),
+    /** WebAuthn Relying Party ID */
+    rpId: zod_1.z.string().optional(),
+    /** WebAuthn user verification level */
+    userVerification: zod_1.z.enum(['required', 'preferred', 'discouraged']).optional(),
+    /** SIWE Ethereum chain ID */
+    chainId: zod_1.z.number().optional(),
+    /** SIWE domain */
+    domain: zod_1.z.string().optional(),
+    /** Timestamp when authorization was verified (milliseconds since epoch) */
+    verifiedAt: zod_1.z.number().int().positive().optional(),
+});
+/**
+ * Delegation Verification Details Schema
+ *
+ * Typed details object for verification results
+ */
+exports.DelegationVerificationDetailsSchema = zod_1.z.object({
+    /** Authorization info - how identity was verified during consent */
+    authorization: exports.AuthorizationInfoSchema.optional(),
+    /** Additional metadata fields (extensible) */
+}).passthrough();
 /**
  * Delegation Verification Result
  *
@@ -156,8 +221,8 @@ exports.DelegationVerificationResultSchema = zod_1.z.object({
     chainValid: zod_1.z.boolean().optional(),
     /** Timestamp of verification */
     verifiedAt: zod_1.z.number().int().positive(),
-    /** Optional verification details */
-    details: zod_1.z.record(zod_1.z.any()).optional(),
+    /** Verification details including authorization info */
+    details: exports.DelegationVerificationDetailsSchema.optional(),
 });
 /**
  * Validation Helpers

package/dist/tool-protection/index.d.ts

@@ -51,6 +51,16 @@ export type AuthorizationRequirement = {
     type: 'credential';
     credentialType: string;
     issuer?: string;
+} | {
+    /** WebAuthn/Passkey authentication */
+    type: 'webauthn';
+    rpId?: string;
+    userVerification?: 'required' | 'preferred' | 'discouraged';
+} | {
+    /** Sign-In with Ethereum (EIP-4361) */
+    type: 'siwe';
+    chainId?: number;
+    domain?: string;
 } | {
     type: 'none';
 };
@@ -64,6 +74,10 @@ export declare const AUTHORIZATION_TYPES: {
     readonly MDL: "mdl";
     readonly IDV: "idv";
     readonly VERIFIABLE_CREDENTIAL: "verifiable_credential";
+    /** WebAuthn/Passkey authentication */
+    readonly WEBAUTHN: "webauthn";
+    /** Sign-In with Ethereum (EIP-4361) */
+    readonly SIWE: "siwe";
     readonly NONE: "none";
 };
 export type AuthorizationType = (typeof AUTHORIZATION_TYPES)[keyof typeof AUTHORIZATION_TYPES];
@@ -279,6 +293,30 @@ export declare const AuthorizationRequirementSchema: z.ZodDiscriminatedUnion<"ty
     type: "credential";
     credentialType: string;
     issuer?: string | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"webauthn">;
+    rpId: z.ZodOptional<z.ZodString>;
+    userVerification: z.ZodOptional<z.ZodEnum<["required", "preferred", "discouraged"]>>;
+}, "strip", z.ZodTypeAny, {
+    type: "webauthn";
+    rpId?: string | undefined;
+    userVerification?: "required" | "preferred" | "discouraged" | undefined;
+}, {
+    type: "webauthn";
+    rpId?: string | undefined;
+    userVerification?: "required" | "preferred" | "discouraged" | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"siwe">;
+    chainId: z.ZodOptional<z.ZodNumber>;
+    domain: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "siwe";
+    chainId?: number | undefined;
+    domain?: string | undefined;
+}, {
+    type: "siwe";
+    chainId?: number | undefined;
+    domain?: string | undefined;
 }>, z.ZodObject<{
     type: z.ZodLiteral<"none">;
 }, "strip", z.ZodTypeAny, {
@@ -372,6 +410,30 @@ export declare const ToolProtectionSchema: z.ZodObject<{
         type: "credential";
         credentialType: string;
         issuer?: string | undefined;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"webauthn">;
+        rpId: z.ZodOptional<z.ZodString>;
+        userVerification: z.ZodOptional<z.ZodEnum<["required", "preferred", "discouraged"]>>;
+    }, "strip", z.ZodTypeAny, {
+        type: "webauthn";
+        rpId?: string | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+    }, {
+        type: "webauthn";
+        rpId?: string | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"siwe">;
+        chainId: z.ZodOptional<z.ZodNumber>;
+        domain: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "siwe";
+        chainId?: number | undefined;
+        domain?: string | undefined;
+    }, {
+        type: "siwe";
+        chainId?: number | undefined;
+        domain?: string | undefined;
     }>, z.ZodObject<{
         type: z.ZodLiteral<"none">;
     }, "strip", z.ZodTypeAny, {
@@ -409,6 +471,14 @@ export declare const ToolProtectionSchema: z.ZodObject<{
         type: "credential";
         credentialType: string;
         issuer?: string | undefined;
+    } | {
+        type: "webauthn";
+        rpId?: string | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+    } | {
+        type: "siwe";
+        chainId?: number | undefined;
+        domain?: string | undefined;
     } | {
         type: "none";
     } | undefined;
@@ -444,6 +514,14 @@ export declare const ToolProtectionSchema: z.ZodObject<{
         type: "credential";
         credentialType: string;
         issuer?: string | undefined;
+    } | {
+        type: "webauthn";
+        rpId?: string | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+    } | {
+        type: "siwe";
+        chainId?: number | undefined;
+        domain?: string | undefined;
     } | {
         type: "none";
     } | undefined;
@@ -536,6 +614,30 @@ export declare const ToolProtectionMapSchema: z.ZodRecord<z.ZodString, z.ZodObje
         type: "credential";
         credentialType: string;
         issuer?: string | undefined;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"webauthn">;
+        rpId: z.ZodOptional<z.ZodString>;
+        userVerification: z.ZodOptional<z.ZodEnum<["required", "preferred", "discouraged"]>>;
+    }, "strip", z.ZodTypeAny, {
+        type: "webauthn";
+        rpId?: string | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+    }, {
+        type: "webauthn";
+        rpId?: string | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"siwe">;
+        chainId: z.ZodOptional<z.ZodNumber>;
+        domain: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "siwe";
+        chainId?: number | undefined;
+        domain?: string | undefined;
+    }, {
+        type: "siwe";
+        chainId?: number | undefined;
+        domain?: string | undefined;
     }>, z.ZodObject<{
         type: z.ZodLiteral<"none">;
     }, "strip", z.ZodTypeAny, {
@@ -573,6 +675,14 @@ export declare const ToolProtectionMapSchema: z.ZodRecord<z.ZodString, z.ZodObje
         type: "credential";
         credentialType: string;
         issuer?: string | undefined;
+    } | {
+        type: "webauthn";
+        rpId?: string | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+    } | {
+        type: "siwe";
+        chainId?: number | undefined;
+        domain?: string | undefined;
     } | {
         type: "none";
     } | undefined;
@@ -608,6 +718,14 @@ export declare const ToolProtectionMapSchema: z.ZodRecord<z.ZodString, z.ZodObje
         type: "credential";
         credentialType: string;
         issuer?: string | undefined;
+    } | {
+        type: "webauthn";
+        rpId?: string | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+    } | {
+        type: "siwe";
+        chainId?: number | undefined;
+        domain?: string | undefined;
     } | {
         type: "none";
     } | undefined;
@@ -701,6 +819,30 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
             type: "credential";
             credentialType: string;
             issuer?: string | undefined;
+        }>, z.ZodObject<{
+            type: z.ZodLiteral<"webauthn">;
+            rpId: z.ZodOptional<z.ZodString>;
+            userVerification: z.ZodOptional<z.ZodEnum<["required", "preferred", "discouraged"]>>;
+        }, "strip", z.ZodTypeAny, {
+            type: "webauthn";
+            rpId?: string | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+        }, {
+            type: "webauthn";
+            rpId?: string | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+        }>, z.ZodObject<{
+            type: z.ZodLiteral<"siwe">;
+            chainId: z.ZodOptional<z.ZodNumber>;
+            domain: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            type: "siwe";
+            chainId?: number | undefined;
+            domain?: string | undefined;
+        }, {
+            type: "siwe";
+            chainId?: number | undefined;
+            domain?: string | undefined;
         }>, z.ZodObject<{
             type: z.ZodLiteral<"none">;
         }, "strip", z.ZodTypeAny, {
@@ -738,6 +880,14 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
             type: "credential";
             credentialType: string;
             issuer?: string | undefined;
+        } | {
+            type: "webauthn";
+            rpId?: string | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+        } | {
+            type: "siwe";
+            chainId?: number | undefined;
+            domain?: string | undefined;
         } | {
             type: "none";
         } | undefined;
@@ -773,6 +923,14 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
             type: "credential";
             credentialType: string;
             issuer?: string | undefined;
+        } | {
+            type: "webauthn";
+            rpId?: string | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+        } | {
+            type: "siwe";
+            chainId?: number | undefined;
+            domain?: string | undefined;
         } | {
             type: "none";
         } | undefined;
@@ -785,12 +943,12 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
         source: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         version?: string | undefined;
-        lastUpdated?: string | undefined;
         source?: string | undefined;
+        lastUpdated?: string | undefined;
     }, {
         version?: string | undefined;
-        lastUpdated?: string | undefined;
         source?: string | undefined;
+        lastUpdated?: string | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
     toolProtections: Record<string, {
@@ -823,6 +981,14 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
             type: "credential";
             credentialType: string;
             issuer?: string | undefined;
+        } | {
+            type: "webauthn";
+            rpId?: string | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+        } | {
+            type: "siwe";
+            chainId?: number | undefined;
+            domain?: string | undefined;
         } | {
             type: "none";
         } | undefined;
@@ -831,8 +997,8 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
     }>;
     metadata?: {
         version?: string | undefined;
-        lastUpdated?: string | undefined;
         source?: string | undefined;
+        lastUpdated?: string | undefined;
     } | undefined;
 }, {
     toolProtections: Record<string, {
@@ -865,6 +1031,14 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
             type: "credential";
             credentialType: string;
             issuer?: string | undefined;
+        } | {
+            type: "webauthn";
+            rpId?: string | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+        } | {
+            type: "siwe";
+            chainId?: number | undefined;
+            domain?: string | undefined;
         } | {
             type: "none";
         } | undefined;
@@ -873,8 +1047,8 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
     }>;
     metadata?: {
         version?: string | undefined;
-        lastUpdated?: string | undefined;
         source?: string | undefined;
+        lastUpdated?: string | undefined;
     } | undefined;
 }>;
 export declare const DelegationRequiredErrorDataSchema: z.ZodObject<{
@@ -886,15 +1060,15 @@ export declare const DelegationRequiredErrorDataSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     requiredScopes: string[];
     toolName: string;
-    authorizationUrl?: string | undefined;
     reason?: string | undefined;
     consentUrl?: string | undefined;
+    authorizationUrl?: string | undefined;
 }, {
     requiredScopes: string[];
     toolName: string;
-    authorizationUrl?: string | undefined;
     reason?: string | undefined;
     consentUrl?: string | undefined;
+    authorizationUrl?: string | undefined;
 }>;
 /**
  * Type Guards

package/dist/tool-protection/index.js

@@ -43,6 +43,10 @@ exports.AUTHORIZATION_TYPES = {
     MDL: 'mdl',
     IDV: 'idv',
     VERIFIABLE_CREDENTIAL: 'verifiable_credential',
+    /** WebAuthn/Passkey authentication */
+    WEBAUTHN: 'webauthn',
+    /** Sign-In with Ethereum (EIP-4361) */
+    SIWE: 'siwe',
     NONE: 'none',
 };
 /**
@@ -88,6 +92,18 @@ exports.AuthorizationRequirementSchema = zod_1.z.discriminatedUnion('type', [
         credentialType: zod_1.z.string(),
         issuer: zod_1.z.string().optional(),
     }),
+    // WebAuthn/Passkey authentication
+    zod_1.z.object({
+        type: zod_1.z.literal('webauthn'),
+        rpId: zod_1.z.string().optional(),
+        userVerification: zod_1.z.enum(['required', 'preferred', 'discouraged']).optional(),
+    }),
+    // Sign-In with Ethereum (EIP-4361)
+    zod_1.z.object({
+        type: zod_1.z.literal('siwe'),
+        chainId: zod_1.z.number().optional(),
+        domain: zod_1.z.string().optional(),
+    }),
     zod_1.z.object({
         type: zod_1.z.literal('none'),
     }),
@@ -317,6 +333,10 @@ function getAuthorizationTypeLabel(auth) {
         case 'credential':
             // Deprecated: treat as verifiable_credential
             return auth.credentialType || 'Verifiable Credential';
+        case 'webauthn':
+            return 'Passkey / WebAuthn';
+        case 'siwe':
+            return 'Sign-In with Ethereum';
         case 'none':
             return 'Consent Only';
         default:
@@ -331,6 +351,8 @@ function getAuthorizationTypeLabel(auth) {
 function getAuthorizationTypeKey(auth) {
     switch (auth.type) {
         case 'oauth':
+            // Keep original key format for backward compatibility with existing cache entries
+            return `oauth:${auth.provider}`;
         case 'oauth2':
             return `oauth2:${auth.provider}`;
         case 'password':
@@ -344,6 +366,10 @@ function getAuthorizationTypeKey(auth) {
         case 'credential':
             // Deprecated: treat as verifiable_credential
             return `vc:${auth.issuer || 'any'}:${auth.credentialType}`;
+        case 'webauthn':
+            return `webauthn:${auth.rpId || 'default'}`;
+        case 'siwe':
+            return `siwe:${auth.chainId || 1}:${auth.domain || 'any'}`;
         case 'none':
             return 'none';
         default:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/contracts",
-  "version": "1.7.14",
+  "version": "1.7.16",
   "description": "Shared contracts, types, and schemas for MCP-I framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",