@kya-os/contracts 1.7.32 → 1.7.33

package/dist/tlkrc/rotation.d.ts

@@ -37,43 +37,43 @@ export declare const RotationEventSchema: z.ZodEffects<z.ZodObject<{
     /** Optional metadata */
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
 }, "strip", z.ZodTypeAny, {
+    signature: string;
     issuerDid: string;
     prevKeyId: string;
     nextKeyId: string;
     effectiveAt: number;
     issuedAt: number;
     seq: number;
-    signature: string;
     metadata?: Record<string, any> | undefined;
     prevEventHash?: string | undefined;
 }, {
+    signature: string;
     issuerDid: string;
     prevKeyId: string;
     nextKeyId: string;
     effectiveAt: number;
     issuedAt: number;
     seq: number;
-    signature: string;
     metadata?: Record<string, any> | undefined;
     prevEventHash?: string | undefined;
 }>, {
+    signature: string;
     issuerDid: string;
     prevKeyId: string;
     nextKeyId: string;
     effectiveAt: number;
     issuedAt: number;
     seq: number;
-    signature: string;
     metadata?: Record<string, any> | undefined;
     prevEventHash?: string | undefined;
 }, {
+    signature: string;
     issuerDid: string;
     prevKeyId: string;
     nextKeyId: string;
     effectiveAt: number;
     issuedAt: number;
     seq: number;
-    signature: string;
     metadata?: Record<string, any> | undefined;
     prevEventHash?: string | undefined;
 }>;
@@ -107,43 +107,43 @@ export declare const RotationChainSchema: z.ZodObject<{
         /** Optional metadata */
         metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
     }, "strip", z.ZodTypeAny, {
+        signature: string;
         issuerDid: string;
         prevKeyId: string;
         nextKeyId: string;
         effectiveAt: number;
         issuedAt: number;
         seq: number;
-        signature: string;
         metadata?: Record<string, any> | undefined;
         prevEventHash?: string | undefined;
     }, {
+        signature: string;
         issuerDid: string;
         prevKeyId: string;
         nextKeyId: string;
         effectiveAt: number;
         issuedAt: number;
         seq: number;
-        signature: string;
         metadata?: Record<string, any> | undefined;
         prevEventHash?: string | undefined;
     }>, {
+        signature: string;
         issuerDid: string;
         prevKeyId: string;
         nextKeyId: string;
         effectiveAt: number;
         issuedAt: number;
         seq: number;
-        signature: string;
         metadata?: Record<string, any> | undefined;
         prevEventHash?: string | undefined;
     }, {
+        signature: string;
         issuerDid: string;
         prevKeyId: string;
         nextKeyId: string;
         effectiveAt: number;
         issuedAt: number;
         seq: number;
-        signature: string;
         metadata?: Record<string, any> | undefined;
         prevEventHash?: string | undefined;
     }>, "many">;
@@ -157,13 +157,13 @@ export declare const RotationChainSchema: z.ZodObject<{
     valid: boolean;
     issuerDid: string;
     events: {
+        signature: string;
         issuerDid: string;
         prevKeyId: string;
         nextKeyId: string;
         effectiveAt: number;
         issuedAt: number;
         seq: number;
-        signature: string;
         metadata?: Record<string, any> | undefined;
         prevEventHash?: string | undefined;
     }[];
@@ -173,13 +173,13 @@ export declare const RotationChainSchema: z.ZodObject<{
     valid: boolean;
     issuerDid: string;
     events: {
+        signature: string;
         issuerDid: string;
         prevKeyId: string;
         nextKeyId: string;
         effectiveAt: number;
         issuedAt: number;
         seq: number;
-        signature: string;
         metadata?: Record<string, any> | undefined;
         prevEventHash?: string | undefined;
     }[];
@@ -197,23 +197,23 @@ export type RotationChain = z.infer<typeof RotationChainSchema>;
  * @returns Validation result
  */
 export declare function validateRotationEvent(event: unknown): z.SafeParseReturnType<{
+    signature: string;
     issuerDid: string;
     prevKeyId: string;
     nextKeyId: string;
     effectiveAt: number;
     issuedAt: number;
     seq: number;
-    signature: string;
     metadata?: Record<string, any> | undefined;
     prevEventHash?: string | undefined;
 }, {
+    signature: string;
     issuerDid: string;
     prevKeyId: string;
     nextKeyId: string;
     effectiveAt: number;
     issuedAt: number;
     seq: number;
-    signature: string;
     metadata?: Record<string, any> | undefined;
     prevEventHash?: string | undefined;
 }>;
@@ -243,3 +243,4 @@ export declare const DEFAULT_GRACE_PERIOD_SEC: number;
  * Maximum reasonable grace period (30 days)
  */
 export declare const MAX_GRACE_PERIOD_SEC: number;
+//# sourceMappingURL=rotation.d.ts.map

package/dist/tlkrc/rotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation.d.ts","sourceRoot":"","sources":["../../src/tlkrc/rotation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB;IAC9B,gDAAgD;;IAGhD,wCAAwC;;IAGxC,kCAAkC;;IAGlC,8DAA8D;;IAG9D,qDAAqD;;IAGrD,iDAAiD;;IAGjD,gEAAgE;;IAGhE,iDAAiD;;IAGjD,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOzB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;IAC9B,iBAAiB;;IAGjB,mCAAmC;;QA5CnC,gDAAgD;;QAGhD,wCAAwC;;QAGxC,kCAAkC;;QAGlC,8DAA8D;;QAG9D,qDAAqD;;QAGrD,iDAAiD;;QAGjD,gEAAgE;;QAGhE,iDAAiD;;QAGjD,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuBxB,4BAA4B;;IAG5B,6BAA6B;;IAG7B,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEjC,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;GAEG;AAEH;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;GAEnD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAalE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAerF;AAED;;GAEG;AAEH;;GAEG;AACH,eAAO,MAAM,wBAAwB,QAAe,CAAC;AAErD;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAoB,CAAC"}

package/dist/tlkrc/rotation.js

@@ -124,3 +124,4 @@ exports.DEFAULT_GRACE_PERIOD_SEC = 24 * 60 * 60;
  * Maximum reasonable grace period (30 days)
  */
 exports.MAX_GRACE_PERIOD_SEC = 30 * 24 * 60 * 60;
+//# sourceMappingURL=rotation.js.map

package/dist/tlkrc/rotation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation.js","sourceRoot":"","sources":["../../src/tlkrc/rotation.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAoFH,sDAEC;AAQD,oDAaC;AASD,wCAeC;AAjID,6BAAwB;AAExB;;;;;;;;;GASG;AACU,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,gDAAgD;IAChD,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5B,wCAAwC;IACxC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5B,kCAAkC;IAClC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5B,8DAA8D;IAC9D,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAExC,qDAAqD;IACrD,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAErC,iDAAiD;IACjD,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAEnC,gEAAgE;IAChE,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEpC,iDAAiD;IACjD,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5B,wBAAwB;IACxB,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,MAAM,CACP,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,EAC9C;IACE,OAAO,EAAE,iCAAiC;CAC3C,CACF,CAAC;AAIF;;;;GAIG;AACU,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,iBAAiB;IACjB,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5B,mCAAmC;IACnC,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,2BAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3C,4BAA4B;IAC5B,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/B,6BAA6B;IAC7B,KAAK,EAAE,OAAC,CAAC,OAAO,EAAE;IAElB,iCAAiC;IACjC,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAIH;;GAEG;AAEH;;;;;GAKG;AACH,SAAgB,qBAAqB,CAAC,KAAc;IAClD,OAAO,2BAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,SAAgB,oBAAoB,CAAC,KAAoB;IACvD,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uCAAuC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,KAAK,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,KAAoB,EAAE,SAAiB;IACpE,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+DAA+D;IAC/D,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,WAAW,IAAI,SAAS,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC,SAAS,CAAC;QACzB,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACnC,CAAC;AAED;;GAEG;AAEH;;GAEG;AACU,QAAA,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAErD;;GAEG;AACU,QAAA,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC"}

package/dist/tool-protection/index.d.ts

@@ -61,6 +61,11 @@ export type AuthorizationRequirement = {
     type: 'siwe';
     chainId?: number;
     domain?: string;
+} | {
+    /** API Key from per-user vault */
+    type: 'apikey';
+    envVarNames: string[];
+    headerMapping: Record<string, string>;
 } | {
     type: 'none';
 };
@@ -78,6 +83,8 @@ export declare const AUTHORIZATION_TYPES: {
     readonly WEBAUTHN: "webauthn";
     /** Sign-In with Ethereum (EIP-4361) */
     readonly SIWE: "siwe";
+    /** API Key from per-user vault */
+    readonly APIKEY: "apikey";
     readonly NONE: "none";
 };
 export type AuthorizationType = (typeof AUTHORIZATION_TYPES)[keyof typeof AUTHORIZATION_TYPES];
@@ -197,6 +204,66 @@ export interface DelegationRequiredErrorData {
      */
     reason?: string;
 }
+/**
+ * Auth Required Error Data
+ *
+ * Machine-readable error returned when a tool requires per-user auth
+ * (vault secret, OAuth, credential) but none is configured and no
+ * static env fallback exists. MCP clients use this to present
+ * actionable guidance (e.g., "Add your PulseMCP API key" with a link).
+ *
+ * Closes VAULT-11
+ */
+export interface AuthRequiredErrorData {
+    /** Discriminator — always "auth_required" */
+    error: 'auth_required';
+    /** Which auth mechanism is missing */
+    type: 'apikey' | 'oauth' | 'credential';
+    /** For apikey: which env vars are missing */
+    envVarNames?: string[];
+    /** Dashboard URL where the user can configure the missing auth */
+    configUrl: string;
+    /** Human-readable fallback message */
+    message: string;
+}
+export declare const AuthRequiredErrorDataSchema: z.ZodObject<{
+    error: z.ZodLiteral<"auth_required">;
+    type: z.ZodEnum<["apikey", "oauth", "credential"]>;
+    envVarNames: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    configUrl: z.ZodString;
+    message: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    error: "auth_required";
+    message: string;
+    type: "oauth" | "apikey" | "credential";
+    configUrl: string;
+    envVarNames?: string[] | undefined;
+}, {
+    error: "auth_required";
+    message: string;
+    type: "oauth" | "apikey" | "credential";
+    configUrl: string;
+    envVarNames?: string[] | undefined;
+}>;
+/**
+ * Error class thrown when required auth is missing and no fallback exists.
+ *
+ * Caught by the tool-call handler in agent.ts and serialized as a
+ * machine-readable MCP tool result so clients can present actionable UI.
+ */
+export declare class AuthRequiredError extends Error {
+    readonly type: AuthRequiredErrorData['type'];
+    readonly envVarNames?: string[];
+    readonly configUrl: string;
+    constructor(opts: {
+        type: AuthRequiredErrorData['type'];
+        envVarNames?: string[];
+        configUrl: string;
+        message?: string;
+    });
+    /** Serialize to the wire format MCP clients expect */
+    toJSON(): AuthRequiredErrorData;
+}
 /**
  * Legacy tool protection format (pre-authorization field)
  * Used during migration period to support both old and new formats
@@ -311,12 +378,24 @@ export declare const AuthorizationRequirementSchema: z.ZodDiscriminatedUnion<"ty
     domain: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     type: "siwe";
-    domain?: string | undefined;
     chainId?: number | undefined;
+    domain?: string | undefined;
 }, {
     type: "siwe";
-    domain?: string | undefined;
     chainId?: number | undefined;
+    domain?: string | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"apikey">;
+    envVarNames: z.ZodArray<z.ZodString, "many">;
+    headerMapping: z.ZodRecord<z.ZodString, z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "apikey";
+    envVarNames: string[];
+    headerMapping: Record<string, string>;
+}, {
+    type: "apikey";
+    envVarNames: string[];
+    headerMapping: Record<string, string>;
 }>, z.ZodObject<{
     type: z.ZodLiteral<"none">;
 }, "strip", z.ZodTypeAny, {
@@ -428,12 +507,24 @@ export declare const ToolProtectionSchema: z.ZodObject<{
         domain: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         type: "siwe";
-        domain?: string | undefined;
         chainId?: number | undefined;
+        domain?: string | undefined;
     }, {
         type: "siwe";
-        domain?: string | undefined;
         chainId?: number | undefined;
+        domain?: string | undefined;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"apikey">;
+        envVarNames: z.ZodArray<z.ZodString, "many">;
+        headerMapping: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "apikey";
+        envVarNames: string[];
+        headerMapping: Record<string, string>;
+    }, {
+        type: "apikey";
+        envVarNames: string[];
+        headerMapping: Record<string, string>;
     }>, z.ZodObject<{
         type: z.ZodLiteral<"none">;
     }, "strip", z.ZodTypeAny, {
@@ -442,8 +533,10 @@ export declare const ToolProtectionSchema: z.ZodObject<{
         type: "none";
     }>]>>;
 }, "strip", z.ZodTypeAny, {
-    requiresDelegation: boolean;
     requiredScopes: string[];
+    requiresDelegation: boolean;
+    riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
+    oauthProvider?: string | undefined;
     authorization?: {
         type: "oauth";
         provider: string;
@@ -477,16 +570,20 @@ export declare const ToolProtectionSchema: z.ZodObject<{
         userVerification?: "required" | "preferred" | "discouraged" | undefined;
     } | {
         type: "siwe";
-        domain?: string | undefined;
         chainId?: number | undefined;
+        domain?: string | undefined;
+    } | {
+        type: "apikey";
+        envVarNames: string[];
+        headerMapping: Record<string, string>;
     } | {
         type: "none";
     } | undefined;
-    riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
-    oauthProvider?: string | undefined;
 }, {
-    requiresDelegation: boolean;
     requiredScopes: string[];
+    requiresDelegation: boolean;
+    riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
+    oauthProvider?: string | undefined;
     authorization?: {
         type: "oauth";
         provider: string;
@@ -520,13 +617,15 @@ export declare const ToolProtectionSchema: z.ZodObject<{
         userVerification?: "required" | "preferred" | "discouraged" | undefined;
     } | {
         type: "siwe";
-        domain?: string | undefined;
         chainId?: number | undefined;
+        domain?: string | undefined;
+    } | {
+        type: "apikey";
+        envVarNames: string[];
+        headerMapping: Record<string, string>;
     } | {
         type: "none";
     } | undefined;
-    riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
-    oauthProvider?: string | undefined;
 }>;
 export declare const ToolProtectionMapSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     requiresDelegation: z.ZodBoolean;
@@ -632,12 +731,24 @@ export declare const ToolProtectionMapSchema: z.ZodRecord<z.ZodString, z.ZodObje
         domain: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         type: "siwe";
-        domain?: string | undefined;
         chainId?: number | undefined;
+        domain?: string | undefined;
     }, {
         type: "siwe";
-        domain?: string | undefined;
         chainId?: number | undefined;
+        domain?: string | undefined;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"apikey">;
+        envVarNames: z.ZodArray<z.ZodString, "many">;
+        headerMapping: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "apikey";
+        envVarNames: string[];
+        headerMapping: Record<string, string>;
+    }, {
+        type: "apikey";
+        envVarNames: string[];
+        headerMapping: Record<string, string>;
     }>, z.ZodObject<{
         type: z.ZodLiteral<"none">;
     }, "strip", z.ZodTypeAny, {
@@ -646,8 +757,10 @@ export declare const ToolProtectionMapSchema: z.ZodRecord<z.ZodString, z.ZodObje
         type: "none";
     }>]>>;
 }, "strip", z.ZodTypeAny, {
-    requiresDelegation: boolean;
     requiredScopes: string[];
+    requiresDelegation: boolean;
+    riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
+    oauthProvider?: string | undefined;
     authorization?: {
         type: "oauth";
         provider: string;
@@ -681,16 +794,20 @@ export declare const ToolProtectionMapSchema: z.ZodRecord<z.ZodString, z.ZodObje
         userVerification?: "required" | "preferred" | "discouraged" | undefined;
     } | {
         type: "siwe";
-        domain?: string | undefined;
         chainId?: number | undefined;
+        domain?: string | undefined;
+    } | {
+        type: "apikey";
+        envVarNames: string[];
+        headerMapping: Record<string, string>;
     } | {
         type: "none";
     } | undefined;
-    riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
-    oauthProvider?: string | undefined;
 }, {
-    requiresDelegation: boolean;
     requiredScopes: string[];
+    requiresDelegation: boolean;
+    riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
+    oauthProvider?: string | undefined;
     authorization?: {
         type: "oauth";
         provider: string;
@@ -724,13 +841,15 @@ export declare const ToolProtectionMapSchema: z.ZodRecord<z.ZodString, z.ZodObje
         userVerification?: "required" | "preferred" | "discouraged" | undefined;
     } | {
         type: "siwe";
-        domain?: string | undefined;
         chainId?: number | undefined;
+        domain?: string | undefined;
+    } | {
+        type: "apikey";
+        envVarNames: string[];
+        headerMapping: Record<string, string>;
     } | {
         type: "none";
     } | undefined;
-    riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
-    oauthProvider?: string | undefined;
 }>>;
 export declare const ToolProtectionResponseSchema: z.ZodObject<{
     toolProtections: z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -837,12 +956,24 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
             domain: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
             type: "siwe";
-            domain?: string | undefined;
             chainId?: number | undefined;
+            domain?: string | undefined;
         }, {
             type: "siwe";
-            domain?: string | undefined;
             chainId?: number | undefined;
+            domain?: string | undefined;
+        }>, z.ZodObject<{
+            type: z.ZodLiteral<"apikey">;
+            envVarNames: z.ZodArray<z.ZodString, "many">;
+            headerMapping: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            type: "apikey";
+            envVarNames: string[];
+            headerMapping: Record<string, string>;
+        }, {
+            type: "apikey";
+            envVarNames: string[];
+            headerMapping: Record<string, string>;
         }>, z.ZodObject<{
             type: z.ZodLiteral<"none">;
         }, "strip", z.ZodTypeAny, {
@@ -851,8 +982,10 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
             type: "none";
         }>]>>;
     }, "strip", z.ZodTypeAny, {
-        requiresDelegation: boolean;
         requiredScopes: string[];
+        requiresDelegation: boolean;
+        riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
+        oauthProvider?: string | undefined;
         authorization?: {
             type: "oauth";
             provider: string;
@@ -886,16 +1019,20 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
             userVerification?: "required" | "preferred" | "discouraged" | undefined;
         } | {
             type: "siwe";
-            domain?: string | undefined;
             chainId?: number | undefined;
+            domain?: string | undefined;
+        } | {
+            type: "apikey";
+            envVarNames: string[];
+            headerMapping: Record<string, string>;
         } | {
             type: "none";
         } | undefined;
-        riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
-        oauthProvider?: string | undefined;
     }, {
-        requiresDelegation: boolean;
         requiredScopes: string[];
+        requiresDelegation: boolean;
+        riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
+        oauthProvider?: string | undefined;
         authorization?: {
             type: "oauth";
             provider: string;
@@ -929,31 +1066,35 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
             userVerification?: "required" | "preferred" | "discouraged" | undefined;
         } | {
             type: "siwe";
-            domain?: string | undefined;
             chainId?: number | undefined;
+            domain?: string | undefined;
+        } | {
+            type: "apikey";
+            envVarNames: string[];
+            headerMapping: Record<string, string>;
         } | {
             type: "none";
         } | undefined;
-        riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
-        oauthProvider?: string | undefined;
     }>>;
     metadata: z.ZodOptional<z.ZodObject<{
         lastUpdated: z.ZodOptional<z.ZodString>;
         version: z.ZodOptional<z.ZodString>;
         source: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
+        lastUpdated?: string | undefined;
         version?: string | undefined;
         source?: string | undefined;
-        lastUpdated?: string | undefined;
     }, {
+        lastUpdated?: string | undefined;
         version?: string | undefined;
         source?: string | undefined;
-        lastUpdated?: string | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
     toolProtections: Record<string, {
-        requiresDelegation: boolean;
         requiredScopes: string[];
+        requiresDelegation: boolean;
+        riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
+        oauthProvider?: string | undefined;
         authorization?: {
             type: "oauth";
             provider: string;
@@ -987,23 +1128,27 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
             userVerification?: "required" | "preferred" | "discouraged" | undefined;
         } | {
             type: "siwe";
-            domain?: string | undefined;
             chainId?: number | undefined;
+            domain?: string | undefined;
+        } | {
+            type: "apikey";
+            envVarNames: string[];
+            headerMapping: Record<string, string>;
         } | {
             type: "none";
         } | undefined;
-        riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
-        oauthProvider?: string | undefined;
     }>;
     metadata?: {
+        lastUpdated?: string | undefined;
         version?: string | undefined;
         source?: string | undefined;
-        lastUpdated?: string | undefined;
     } | undefined;
 }, {
     toolProtections: Record<string, {
-        requiresDelegation: boolean;
         requiredScopes: string[];
+        requiresDelegation: boolean;
+        riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
+        oauthProvider?: string | undefined;
         authorization?: {
             type: "oauth";
             provider: string;
@@ -1037,18 +1182,20 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
             userVerification?: "required" | "preferred" | "discouraged" | undefined;
         } | {
             type: "siwe";
-            domain?: string | undefined;
             chainId?: number | undefined;
+            domain?: string | undefined;
+        } | {
+            type: "apikey";
+            envVarNames: string[];
+            headerMapping: Record<string, string>;
         } | {
             type: "none";
         } | undefined;
-        riskLevel?: "low" | "medium" | "high" | "critical" | undefined;
-        oauthProvider?: string | undefined;
     }>;
     metadata?: {
+        lastUpdated?: string | undefined;
         version?: string | undefined;
         source?: string | undefined;
-        lastUpdated?: string | undefined;
     } | undefined;
 }>;
 export declare const DelegationRequiredErrorDataSchema: z.ZodObject<{
@@ -1058,17 +1205,17 @@ export declare const DelegationRequiredErrorDataSchema: z.ZodObject<{
     authorizationUrl: z.ZodOptional<z.ZodString>;
     reason: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    toolName: string;
     requiredScopes: string[];
+    toolName: string;
+    consentUrl?: string | undefined;
     authorizationUrl?: string | undefined;
     reason?: string | undefined;
-    consentUrl?: string | undefined;
 }, {
-    toolName: string;
     requiredScopes: string[];
+    toolName: string;
+    consentUrl?: string | undefined;
     authorizationUrl?: string | undefined;
     reason?: string | undefined;
-    consentUrl?: string | undefined;
 }>;
 /**
  * Type Guards
@@ -1108,6 +1255,14 @@ export declare function hasVerifiableCredentialAuthorization(protection: ToolPro
         type: 'verifiable_credential' | 'credential';
     };
 };
+/**
+ * Type guard to check if a ToolProtection has API Key (vault) authorization
+ */
+export declare function hasApiKeyAuthorization(protection: ToolProtection): protection is ToolProtection & {
+    authorization: {
+        type: 'apikey';
+    };
+};
 /**
  * Validation Functions
  */

package/dist/tool-protection/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tool-protection/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAChC;IACE;;OAEG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B,GACD;IACE,oDAAoD;IACpD,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B,GACD;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB,GACD;IACE,IAAI,EAAE,KAAK,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GACD;IACE,IAAI,EAAE,KAAK,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;CACnD,GACD;IACE,6CAA6C;IAC7C,IAAI,EAAE,uBAAuB,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACD;IACE;;;OAGG;IACH,IAAI,EAAE,YAAY,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACD;IACE,sCAAsC;IACtC,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;CAC7D,GACD;IACE,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACD;IACE,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB;IAC9B,iEAAiE;;IAEjE,oDAAoD;;;;;;IAMpD,sCAAsC;;IAEtC,uCAAuC;;;CAG/B,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAE/F;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAE5B;;;OAGG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAEzB;;;OAGG;IACH,SAAS,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAEnD;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,aAAa,CAAC,EAAE,wBAAwB,CAAC;CAC1C;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAE/D;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AAE5D;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,SAAS,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACnD,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAC;CACjD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,eAAe,EAAE,iBAAiB,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,EAAE;QACT;;WAEG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB;;WAEG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC;QAEjB;;WAEG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAEzB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,GAAG;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG,oBAAoB,CAAC;AAExE;;GAEG;AAEH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuDzC,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAM/B,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA6C,CAAC;AAElF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOvC,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;EAM5C,CAAC;AAEH;;GAEG;AAEH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,cAAc,CAEhE;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,iBAAiB,CAEtE;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,sBAAsB,CAEhF;AAED,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,2BAA2B,CAE1F;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,wBAAwB,CAExF;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,cAAc,GACzB,UAAU,IAAI,cAAc,GAAG;IAAE,aAAa,EAAE;QAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAA;KAAE,CAAA;CAAE,CAEhF;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,cAAc,GACzB,UAAU,IAAI,cAAc,GAAG;IAAE,aAAa,EAAE;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,CAAA;CAAE,CAExE;AAED;;;;GAIG;AACH,wBAAgB,oCAAoC,CAClD,UAAU,EAAE,cAAc,GACzB,UAAU,IAAI,cAAc,GAAG;IAChC,aAAa,EAAE;QAAE,IAAI,EAAE,uBAAuB,GAAG,YAAY,CAAA;KAAE,CAAC;CACjE,CAKA;AAED;;GAEG;AAEH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,GAAG,GAAG,cAAc,CAE/D;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,GAAG,GAAG,iBAAiB,CAErE;AAED,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,GAAG,GAAG,sBAAsB,CAE/E;AAED,wBAAgB,mCAAmC,CAAC,GAAG,EAAE,GAAG,GAAG,2BAA2B,CAEzF;AAED;;GAEG;AAEH;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAGT;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,iBAAiB,GAC7B,MAAM,EAAE,CAGV;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,iBAAiB,GAC7B,cAAc,CAAC,WAAW,CAAC,GAAG,SAAS,CAEzC;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,EAAE,EACxB,UAAU,CAAC,EAAE,MAAM,GAClB,2BAA2B,CAO7B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,cAAc,GAAG,qBAAqB,GAC1C,cAAc,CAmChB;AAMD,uFAAuF;AACvF,eAAO,MAAM,sBAAsB;IACjC,sEAAsE;;IAEtE,qCAAqC;;IAErC,wEAAwE;;IAExE,yEAAyE;;IAEzE,sCAAsC;;IAEtC,yCAAyC;;CAEjC,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,OAAO,sBAAsB,CAAC,CAAC;AAEvG;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,gBAAgB,EAAE,OAAO,EACzB,cAAc,GAAE,OAAe,EAC/B,eAAe,GAAE,OAAe,EAChC,SAAS,GAAE,OAAe,GACzB,mBAAmB,CAcrB;AAGD;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,wBAAwB,GAAG,MAAM,CA6BhF;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,wBAAwB,GAAG,MAAM,CAgC9E;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,wBAAwB,EAC9B,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAAO,GACnE,wBAAwB,CA6C1B"}