@kya-os/contracts 1.7.15 → 1.7.16

package/dist/delegation/schemas.js

@@ -15,7 +15,7 @@
  * Python Reference: Delegation-Documentation.md, Delegation-Service.md
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DelegationCredentialSchema = exports.DelegationCredentialSubjectSchema = exports.DELEGATION_CREDENTIAL_CONTEXT = exports.DELEGATION_STATUSES = exports.DEFAULT_DELEGATION_STATUS = exports.MAX_DELEGATION_CHAIN_DEPTH = exports.DelegationVerificationResultSchema = exports.DelegationCreationRequestSchema = exports.DelegationChainSchema = exports.DelegationChainEntrySchema = exports.DelegationRecordSchema = exports.DelegationStatusSchema = void 0;
+exports.DelegationCredentialSchema = exports.DelegationCredentialSubjectSchema = exports.DELEGATION_CREDENTIAL_CONTEXT = exports.DELEGATION_STATUSES = exports.DEFAULT_DELEGATION_STATUS = exports.MAX_DELEGATION_CHAIN_DEPTH = exports.DelegationVerificationResultSchema = exports.DelegationVerificationDetailsSchema = exports.AuthorizationInfoSchema = exports.DelegationCreationRequestSchema = exports.DelegationChainSchema = exports.DelegationChainEntrySchema = exports.DelegationRecordSchema = exports.DelegationStatusSchema = void 0;
 exports.validateDelegationRecord = validateDelegationRecord;
 exports.validateDelegationChain = validateDelegationChain;
 exports.isDelegationExpired = isDelegationExpired;
@@ -136,6 +136,71 @@ exports.DelegationCreationRequestSchema = zod_1.z.object({
     /** Optional VC ID (if not provided, will be created) */
     vcId: zod_1.z.string().optional(),
 });
+/**
+ * Authorization Info Schema
+ *
+ * Captures HOW the user verified their identity during consent.
+ * This is runtime verification metadata, separate from tool requirements.
+ *
+ * Note: This schema describes authorization info in verification results,
+ * not tool protection requirements (which use AuthorizationRequirementSchema).
+ */
+exports.AuthorizationInfoSchema = zod_1.z.object({
+    /**
+     * The authorization method used during consent
+     *
+     * - 'oauth2': OAuth 2.0 provider authentication (canonical)
+     * - 'oauth': Deprecated, use 'oauth2' (will be removed in v2.0.0)
+     * - 'password': Password/credential authentication
+     * - 'credential': Deprecated, use 'verifiable_credential' (will be removed in v2.0.0)
+     * - 'verifiable_credential': W3C Verifiable Credential
+     * - 'mdl': Mobile Driver's License
+     * - 'idv': Identity Verification
+     * - 'webauthn': WebAuthn/Passkey authentication
+     * - 'siwe': Sign-In with Ethereum (EIP-4361)
+     * - 'none': Consent-only (no authentication)
+     */
+    type: zod_1.z.enum([
+        'oauth',
+        'oauth2',
+        'password',
+        'credential',
+        'verifiable_credential',
+        'mdl',
+        'idv',
+        'webauthn',
+        'siwe',
+        'none',
+    ]),
+    /** OAuth/Password/IDV provider name (e.g., 'github', 'google', 'credentials') */
+    provider: zod_1.z.string().optional(),
+    /** Credential type for verifiable_credential or mdl auth */
+    credentialType: zod_1.z.string().optional(),
+    /** MDL issuer DID or identifier */
+    issuer: zod_1.z.string().optional(),
+    /** IDV verification level */
+    verificationLevel: zod_1.z.enum(['basic', 'enhanced', 'loa3']).optional(),
+    /** WebAuthn Relying Party ID */
+    rpId: zod_1.z.string().optional(),
+    /** WebAuthn user verification level */
+    userVerification: zod_1.z.enum(['required', 'preferred', 'discouraged']).optional(),
+    /** SIWE Ethereum chain ID */
+    chainId: zod_1.z.number().optional(),
+    /** SIWE domain */
+    domain: zod_1.z.string().optional(),
+    /** Timestamp when authorization was verified (milliseconds since epoch) */
+    verifiedAt: zod_1.z.number().int().positive().optional(),
+});
+/**
+ * Delegation Verification Details Schema
+ *
+ * Typed details object for verification results
+ */
+exports.DelegationVerificationDetailsSchema = zod_1.z.object({
+    /** Authorization info - how identity was verified during consent */
+    authorization: exports.AuthorizationInfoSchema.optional(),
+    /** Additional metadata fields (extensible) */
+}).passthrough();
 /**
  * Delegation Verification Result
  *
@@ -156,8 +221,8 @@ exports.DelegationVerificationResultSchema = zod_1.z.object({
     chainValid: zod_1.z.boolean().optional(),
     /** Timestamp of verification */
     verifiedAt: zod_1.z.number().int().positive(),
-    /** Optional verification details */
-    details: zod_1.z.record(zod_1.z.any()).optional(),
+    /** Verification details including authorization info */
+    details: exports.DelegationVerificationDetailsSchema.optional(),
 });
 /**
  * Validation Helpers

package/dist/tool-protection/index.d.ts

@@ -51,6 +51,16 @@ export type AuthorizationRequirement = {
     type: 'credential';
     credentialType: string;
     issuer?: string;
+} | {
+    /** WebAuthn/Passkey authentication */
+    type: 'webauthn';
+    rpId?: string;
+    userVerification?: 'required' | 'preferred' | 'discouraged';
+} | {
+    /** Sign-In with Ethereum (EIP-4361) */
+    type: 'siwe';
+    chainId?: number;
+    domain?: string;
 } | {
     type: 'none';
 };
@@ -64,6 +74,10 @@ export declare const AUTHORIZATION_TYPES: {
     readonly MDL: "mdl";
     readonly IDV: "idv";
     readonly VERIFIABLE_CREDENTIAL: "verifiable_credential";
+    /** WebAuthn/Passkey authentication */
+    readonly WEBAUTHN: "webauthn";
+    /** Sign-In with Ethereum (EIP-4361) */
+    readonly SIWE: "siwe";
     readonly NONE: "none";
 };
 export type AuthorizationType = (typeof AUTHORIZATION_TYPES)[keyof typeof AUTHORIZATION_TYPES];
@@ -279,6 +293,30 @@ export declare const AuthorizationRequirementSchema: z.ZodDiscriminatedUnion<"ty
     type: "credential";
     credentialType: string;
     issuer?: string | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"webauthn">;
+    rpId: z.ZodOptional<z.ZodString>;
+    userVerification: z.ZodOptional<z.ZodEnum<["required", "preferred", "discouraged"]>>;
+}, "strip", z.ZodTypeAny, {
+    type: "webauthn";
+    rpId?: string | undefined;
+    userVerification?: "required" | "preferred" | "discouraged" | undefined;
+}, {
+    type: "webauthn";
+    rpId?: string | undefined;
+    userVerification?: "required" | "preferred" | "discouraged" | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"siwe">;
+    chainId: z.ZodOptional<z.ZodNumber>;
+    domain: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "siwe";
+    chainId?: number | undefined;
+    domain?: string | undefined;
+}, {
+    type: "siwe";
+    chainId?: number | undefined;
+    domain?: string | undefined;
 }>, z.ZodObject<{
     type: z.ZodLiteral<"none">;
 }, "strip", z.ZodTypeAny, {
@@ -372,6 +410,30 @@ export declare const ToolProtectionSchema: z.ZodObject<{
         type: "credential";
         credentialType: string;
         issuer?: string | undefined;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"webauthn">;
+        rpId: z.ZodOptional<z.ZodString>;
+        userVerification: z.ZodOptional<z.ZodEnum<["required", "preferred", "discouraged"]>>;
+    }, "strip", z.ZodTypeAny, {
+        type: "webauthn";
+        rpId?: string | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+    }, {
+        type: "webauthn";
+        rpId?: string | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"siwe">;
+        chainId: z.ZodOptional<z.ZodNumber>;
+        domain: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "siwe";
+        chainId?: number | undefined;
+        domain?: string | undefined;
+    }, {
+        type: "siwe";
+        chainId?: number | undefined;
+        domain?: string | undefined;
     }>, z.ZodObject<{
         type: z.ZodLiteral<"none">;
     }, "strip", z.ZodTypeAny, {
@@ -380,10 +442,8 @@ export declare const ToolProtectionSchema: z.ZodObject<{
         type: "none";
     }>]>>;
 }, "strip", z.ZodTypeAny, {
-    requiredScopes: string[];
     requiresDelegation: boolean;
-    riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
-    oauthProvider?: string | undefined;
+    requiredScopes: string[];
     authorization?: {
         type: "oauth";
         provider: string;
@@ -411,14 +471,22 @@ export declare const ToolProtectionSchema: z.ZodObject<{
         type: "credential";
         credentialType: string;
         issuer?: string | undefined;
+    } | {
+        type: "webauthn";
+        rpId?: string | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+    } | {
+        type: "siwe";
+        chainId?: number | undefined;
+        domain?: string | undefined;
     } | {
         type: "none";
     } | undefined;
-}, {
-    requiredScopes: string[];
-    requiresDelegation: boolean;
     riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
     oauthProvider?: string | undefined;
+}, {
+    requiresDelegation: boolean;
+    requiredScopes: string[];
     authorization?: {
         type: "oauth";
         provider: string;
@@ -446,9 +514,19 @@ export declare const ToolProtectionSchema: z.ZodObject<{
         type: "credential";
         credentialType: string;
         issuer?: string | undefined;
+    } | {
+        type: "webauthn";
+        rpId?: string | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+    } | {
+        type: "siwe";
+        chainId?: number | undefined;
+        domain?: string | undefined;
     } | {
         type: "none";
     } | undefined;
+    riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
+    oauthProvider?: string | undefined;
 }>;
 export declare const ToolProtectionMapSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     requiresDelegation: z.ZodBoolean;
@@ -536,6 +614,30 @@ export declare const ToolProtectionMapSchema: z.ZodRecord<z.ZodString, z.ZodObje
         type: "credential";
         credentialType: string;
         issuer?: string | undefined;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"webauthn">;
+        rpId: z.ZodOptional<z.ZodString>;
+        userVerification: z.ZodOptional<z.ZodEnum<["required", "preferred", "discouraged"]>>;
+    }, "strip", z.ZodTypeAny, {
+        type: "webauthn";
+        rpId?: string | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+    }, {
+        type: "webauthn";
+        rpId?: string | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"siwe">;
+        chainId: z.ZodOptional<z.ZodNumber>;
+        domain: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "siwe";
+        chainId?: number | undefined;
+        domain?: string | undefined;
+    }, {
+        type: "siwe";
+        chainId?: number | undefined;
+        domain?: string | undefined;
     }>, z.ZodObject<{
         type: z.ZodLiteral<"none">;
     }, "strip", z.ZodTypeAny, {
@@ -544,10 +646,8 @@ export declare const ToolProtectionMapSchema: z.ZodRecord<z.ZodString, z.ZodObje
         type: "none";
     }>]>>;
 }, "strip", z.ZodTypeAny, {
-    requiredScopes: string[];
     requiresDelegation: boolean;
-    riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
-    oauthProvider?: string | undefined;
+    requiredScopes: string[];
     authorization?: {
         type: "oauth";
         provider: string;
@@ -575,14 +675,22 @@ export declare const ToolProtectionMapSchema: z.ZodRecord<z.ZodString, z.ZodObje
         type: "credential";
         credentialType: string;
         issuer?: string | undefined;
+    } | {
+        type: "webauthn";
+        rpId?: string | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+    } | {
+        type: "siwe";
+        chainId?: number | undefined;
+        domain?: string | undefined;
     } | {
         type: "none";
     } | undefined;
-}, {
-    requiredScopes: string[];
-    requiresDelegation: boolean;
     riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
     oauthProvider?: string | undefined;
+}, {
+    requiresDelegation: boolean;
+    requiredScopes: string[];
     authorization?: {
         type: "oauth";
         provider: string;
@@ -610,9 +718,19 @@ export declare const ToolProtectionMapSchema: z.ZodRecord<z.ZodString, z.ZodObje
         type: "credential";
         credentialType: string;
         issuer?: string | undefined;
+    } | {
+        type: "webauthn";
+        rpId?: string | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+    } | {
+        type: "siwe";
+        chainId?: number | undefined;
+        domain?: string | undefined;
     } | {
         type: "none";
     } | undefined;
+    riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
+    oauthProvider?: string | undefined;
 }>>;
 export declare const ToolProtectionResponseSchema: z.ZodObject<{
     toolProtections: z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -701,6 +819,30 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
             type: "credential";
             credentialType: string;
             issuer?: string | undefined;
+        }>, z.ZodObject<{
+            type: z.ZodLiteral<"webauthn">;
+            rpId: z.ZodOptional<z.ZodString>;
+            userVerification: z.ZodOptional<z.ZodEnum<["required", "preferred", "discouraged"]>>;
+        }, "strip", z.ZodTypeAny, {
+            type: "webauthn";
+            rpId?: string | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+        }, {
+            type: "webauthn";
+            rpId?: string | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+        }>, z.ZodObject<{
+            type: z.ZodLiteral<"siwe">;
+            chainId: z.ZodOptional<z.ZodNumber>;
+            domain: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            type: "siwe";
+            chainId?: number | undefined;
+            domain?: string | undefined;
+        }, {
+            type: "siwe";
+            chainId?: number | undefined;
+            domain?: string | undefined;
         }>, z.ZodObject<{
             type: z.ZodLiteral<"none">;
         }, "strip", z.ZodTypeAny, {
@@ -709,10 +851,8 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
             type: "none";
         }>]>>;
     }, "strip", z.ZodTypeAny, {
-        requiredScopes: string[];
         requiresDelegation: boolean;
-        riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
-        oauthProvider?: string | undefined;
+        requiredScopes: string[];
         authorization?: {
             type: "oauth";
             provider: string;
@@ -740,14 +880,22 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
             type: "credential";
             credentialType: string;
             issuer?: string | undefined;
+        } | {
+            type: "webauthn";
+            rpId?: string | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+        } | {
+            type: "siwe";
+            chainId?: number | undefined;
+            domain?: string | undefined;
         } | {
             type: "none";
         } | undefined;
-    }, {
-        requiredScopes: string[];
-        requiresDelegation: boolean;
         riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
         oauthProvider?: string | undefined;
+    }, {
+        requiresDelegation: boolean;
+        requiredScopes: string[];
         authorization?: {
             type: "oauth";
             provider: string;
@@ -775,29 +923,37 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
             type: "credential";
             credentialType: string;
             issuer?: string | undefined;
+        } | {
+            type: "webauthn";
+            rpId?: string | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+        } | {
+            type: "siwe";
+            chainId?: number | undefined;
+            domain?: string | undefined;
         } | {
             type: "none";
         } | undefined;
+        riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
+        oauthProvider?: string | undefined;
     }>>;
     metadata: z.ZodOptional<z.ZodObject<{
         lastUpdated: z.ZodOptional<z.ZodString>;
         version: z.ZodOptional<z.ZodString>;
         source: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        lastUpdated?: string | undefined;
         version?: string | undefined;
         source?: string | undefined;
-    }, {
         lastUpdated?: string | undefined;
+    }, {
         version?: string | undefined;
         source?: string | undefined;
+        lastUpdated?: string | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
     toolProtections: Record<string, {
-        requiredScopes: string[];
         requiresDelegation: boolean;
-        riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
-        oauthProvider?: string | undefined;
+        requiredScopes: string[];
         authorization?: {
             type: "oauth";
             provider: string;
@@ -825,21 +981,29 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
             type: "credential";
             credentialType: string;
             issuer?: string | undefined;
+        } | {
+            type: "webauthn";
+            rpId?: string | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+        } | {
+            type: "siwe";
+            chainId?: number | undefined;
+            domain?: string | undefined;
         } | {
             type: "none";
         } | undefined;
+        riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
+        oauthProvider?: string | undefined;
     }>;
     metadata?: {
-        lastUpdated?: string | undefined;
         version?: string | undefined;
         source?: string | undefined;
+        lastUpdated?: string | undefined;
     } | undefined;
 }, {
     toolProtections: Record<string, {
-        requiredScopes: string[];
         requiresDelegation: boolean;
-        riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
-        oauthProvider?: string | undefined;
+        requiredScopes: string[];
         authorization?: {
             type: "oauth";
             provider: string;
@@ -867,14 +1031,24 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
             type: "credential";
             credentialType: string;
             issuer?: string | undefined;
+        } | {
+            type: "webauthn";
+            rpId?: string | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+        } | {
+            type: "siwe";
+            chainId?: number | undefined;
+            domain?: string | undefined;
         } | {
             type: "none";
         } | undefined;
+        riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
+        oauthProvider?: string | undefined;
     }>;
     metadata?: {
-        lastUpdated?: string | undefined;
         version?: string | undefined;
         source?: string | undefined;
+        lastUpdated?: string | undefined;
     } | undefined;
 }>;
 export declare const DelegationRequiredErrorDataSchema: z.ZodObject<{
@@ -886,15 +1060,15 @@ export declare const DelegationRequiredErrorDataSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     requiredScopes: string[];
     toolName: string;
+    reason?: string | undefined;
     consentUrl?: string | undefined;
     authorizationUrl?: string | undefined;
-    reason?: string | undefined;
 }, {
     requiredScopes: string[];
     toolName: string;
+    reason?: string | undefined;
     consentUrl?: string | undefined;
     authorizationUrl?: string | undefined;
-    reason?: string | undefined;
 }>;
 /**
  * Type Guards

package/dist/tool-protection/index.js

@@ -43,6 +43,10 @@ exports.AUTHORIZATION_TYPES = {
     MDL: 'mdl',
     IDV: 'idv',
     VERIFIABLE_CREDENTIAL: 'verifiable_credential',
+    /** WebAuthn/Passkey authentication */
+    WEBAUTHN: 'webauthn',
+    /** Sign-In with Ethereum (EIP-4361) */
+    SIWE: 'siwe',
     NONE: 'none',
 };
 /**
@@ -88,6 +92,18 @@ exports.AuthorizationRequirementSchema = zod_1.z.discriminatedUnion('type', [
         credentialType: zod_1.z.string(),
         issuer: zod_1.z.string().optional(),
     }),
+    // WebAuthn/Passkey authentication
+    zod_1.z.object({
+        type: zod_1.z.literal('webauthn'),
+        rpId: zod_1.z.string().optional(),
+        userVerification: zod_1.z.enum(['required', 'preferred', 'discouraged']).optional(),
+    }),
+    // Sign-In with Ethereum (EIP-4361)
+    zod_1.z.object({
+        type: zod_1.z.literal('siwe'),
+        chainId: zod_1.z.number().optional(),
+        domain: zod_1.z.string().optional(),
+    }),
     zod_1.z.object({
         type: zod_1.z.literal('none'),
     }),
@@ -317,6 +333,10 @@ function getAuthorizationTypeLabel(auth) {
         case 'credential':
             // Deprecated: treat as verifiable_credential
             return auth.credentialType || 'Verifiable Credential';
+        case 'webauthn':
+            return 'Passkey / WebAuthn';
+        case 'siwe':
+            return 'Sign-In with Ethereum';
         case 'none':
             return 'Consent Only';
         default:
@@ -346,6 +366,10 @@ function getAuthorizationTypeKey(auth) {
         case 'credential':
             // Deprecated: treat as verifiable_credential
             return `vc:${auth.issuer || 'any'}:${auth.credentialType}`;
+        case 'webauthn':
+            return `webauthn:${auth.rpId || 'default'}`;
+        case 'siwe':
+            return `siwe:${auth.chainId || 1}:${auth.domain || 'any'}`;
         case 'none':
             return 'none';
         default:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/contracts",
-  "version": "1.7.15",
+  "version": "1.7.16",
   "description": "Shared contracts, types, and schemas for MCP-I framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",