@kya-os/mcp-i-cloudflare 1.6.25 → 1.6.27

package/dist/services/credential-auth.handler.js

@@ -0,0 +1,203 @@
+/**
+ * Credential Auth Handler
+ *
+ * Handles credential-based authentication (email/password) for customers
+ * who don't use OAuth and want direct login to their services.
+ *
+ * @package @kya-os/mcp-i-cloudflare
+ * @see TICKET_CRED-003_XMCPI_CREDENTIAL_HANDLER.md
+ */
+/**
+ * Create a credential authentication handler
+ *
+ * @param config - Handler configuration
+ * @returns Credential auth handler instance
+ */
+export function createCredentialAuthHandler(config) {
+    const logger = config.logger || (() => { });
+    return {
+        async authenticate(provider, credentials) {
+            logger("[CredentialAuthHandler] Starting authentication", {
+                authEndpoint: provider.authEndpoint,
+                hasSuccessCheck: !!provider.successCheck,
+            });
+            // 1. Build request body from template
+            const requestBody = {};
+            for (const [apiFieldName, template] of Object.entries(provider.requestBodyTemplate)) {
+                const match = template.match(/\{\{(\w+)\}\}/);
+                if (match) {
+                    const formFieldName = match[1];
+                    if (credentials[formFieldName] === undefined) {
+                        logger("[CredentialAuthHandler] Missing required field", {
+                            field: formFieldName,
+                        });
+                        return {
+                            success: false,
+                            error: `Missing required field: ${formFieldName}`,
+                        };
+                    }
+                    requestBody[apiFieldName] = credentials[formFieldName];
+                }
+                else {
+                    // Static value (no placeholder)
+                    requestBody[apiFieldName] = template;
+                }
+            }
+            // 2. Call auth endpoint
+            try {
+                logger("[CredentialAuthHandler] Calling auth endpoint", {
+                    endpoint: provider.authEndpoint,
+                    bodyKeys: Object.keys(requestBody),
+                });
+                const response = await config.fetch(provider.authEndpoint, {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/json",
+                        ...provider.headers,
+                    },
+                    body: JSON.stringify(requestBody),
+                });
+                // 3. Parse response body
+                const data = (await response.json());
+                // 4. Validate success if configured
+                if (provider.successCheck) {
+                    const checkValue = getNestedValue(data, provider.successCheck.path);
+                    const expectedValue = provider.successCheck.expectedValue;
+                    // Handle type coercion for comparison (true vs "true")
+                    const isMatch = String(checkValue) === String(expectedValue) ||
+                        checkValue === expectedValue;
+                    if (!isMatch) {
+                        const errorMsg = getNestedValue(data, "error") ||
+                            getNestedValue(data, "message") ||
+                            "Authentication failed";
+                        logger("[CredentialAuthHandler] Success check failed", {
+                            path: provider.successCheck.path,
+                            expected: expectedValue,
+                            actual: checkValue,
+                            error: errorMsg,
+                        });
+                        return { success: false, error: String(errorMsg) };
+                    }
+                }
+                else if (!response.ok) {
+                    // No success check configured - fall back to HTTP status
+                    logger("[CredentialAuthHandler] HTTP error", {
+                        status: response.status,
+                    });
+                    return { success: false, error: `HTTP ${response.status}` };
+                }
+                // 5. Extract session token - handle "cookie" special case
+                let sessionToken;
+                if (provider.responseFields.sessionToken === "cookie") {
+                    // Try Set-Cookie header first
+                    const setCookie = response.headers.get("Set-Cookie");
+                    if (setCookie) {
+                        // Try common cookie name patterns
+                        const cookieMatch = setCookie.match(/(?:CIX|session|token|sid|auth)=([^;]+)/i);
+                        if (cookieMatch) {
+                            // Known cookie name pattern - extract value
+                            sessionToken = cookieMatch[1];
+                        }
+                        else {
+                            // Unknown cookie name - extract value from first cookie (name=value;...)
+                            // Split by ";" first to get "name=value", then split by "=" to get just value
+                            const firstCookie = setCookie.split(";")[0];
+                            const valueIndex = firstCookie.indexOf("=");
+                            sessionToken =
+                                valueIndex > 0 ? firstCookie.substring(valueIndex + 1) : undefined;
+                        }
+                        logger("[CredentialAuthHandler] Extracted token from Set-Cookie", {
+                            hasMatch: !!cookieMatch,
+                        });
+                    }
+                    // Also check response body for "cookie" field
+                    if (!sessionToken) {
+                        sessionToken = getNestedValue(data, "cookie");
+                        if (sessionToken) {
+                            logger("[CredentialAuthHandler] Extracted token from response.cookie");
+                        }
+                    }
+                }
+                else {
+                    // Extract from JSON path
+                    sessionToken = getNestedValue(data, provider.responseFields.sessionToken);
+                }
+                if (!sessionToken) {
+                    logger("[CredentialAuthHandler] Session token not found", {
+                        path: provider.responseFields.sessionToken,
+                    });
+                    return {
+                        success: false,
+                        error: `Session token not found at path: ${provider.responseFields.sessionToken}`,
+                    };
+                }
+                // 6. Extract optional user data
+                const userId = provider.responseFields.userId
+                    ? getNestedValue(data, provider.responseFields.userId)
+                    : undefined;
+                const userEmail = provider.responseFields.userEmail
+                    ? getNestedValue(data, provider.responseFields.userEmail)
+                    : undefined;
+                const userDisplayName = provider.responseFields.userDisplayName
+                    ? getNestedValue(data, provider.responseFields.userDisplayName)
+                    : undefined;
+                const expiresInStr = provider.responseFields.expiresIn
+                    ? getNestedValue(data, provider.responseFields.expiresIn)
+                    : undefined;
+                const expiresIn = expiresInStr ? parseInt(expiresInStr, 10) : undefined;
+                logger("[CredentialAuthHandler] Authentication successful", {
+                    hasUserId: !!userId,
+                    hasUserEmail: !!userEmail,
+                    hasDisplayName: !!userDisplayName,
+                    expiresIn,
+                });
+                return {
+                    success: true,
+                    sessionToken,
+                    userId,
+                    userEmail,
+                    userDisplayName,
+                    expiresIn: isNaN(expiresIn ?? NaN) ? undefined : expiresIn,
+                };
+            }
+            catch (error) {
+                const errorMsg = error instanceof Error ? error.message : "Unknown error";
+                logger("[CredentialAuthHandler] Network error", { error: errorMsg });
+                return {
+                    success: false,
+                    error: `Network error: ${errorMsg}`,
+                };
+            }
+        },
+    };
+}
+/**
+ * Get nested value from object using dot notation path
+ *
+ * @param obj - Object to traverse
+ * @param path - Dot-notation path (e.g., "customer.Email")
+ * @returns Value at path or undefined if not found
+ *
+ * @example
+ * getNestedValue({ customer: { Email: "test@example.com" } }, "customer.Email")
+ * // Returns: "test@example.com"
+ */
+function getNestedValue(obj, path) {
+    const parts = path.split(".");
+    let current = obj;
+    for (const part of parts) {
+        if (current && typeof current === "object" && part in current) {
+            current = current[part];
+        }
+        else {
+            return undefined;
+        }
+    }
+    if (current === null || current === undefined) {
+        return undefined;
+    }
+    return typeof current === "string" ? current : String(current);
+}
+// Export getNestedValue for testing
+export { getNestedValue };
+//# sourceMappingURL=credential-auth.handler.js.map

package/dist/services/credential-auth.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-auth.handler.js","sourceRoot":"","sources":["../../src/services/credential-auth.handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAmDH;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAmC;IAEnC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAE3C,OAAO;QACL,KAAK,CAAC,YAAY,CAChB,QAAkC,EAClC,WAAmC;YAEnC,MAAM,CAAC,iDAAiD,EAAE;gBACxD,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,eAAe,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY;aACzC,CAAC,CAAC;YAEH,sCAAsC;YACtC,MAAM,WAAW,GAA2B,EAAE,CAAC;YAC/C,KAAK,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CACnD,QAAQ,CAAC,mBAAmB,CAC7B,EAAE,CAAC;gBACF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gBAC9C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC/B,IAAI,WAAW,CAAC,aAAa,CAAC,KAAK,SAAS,EAAE,CAAC;wBAC7C,MAAM,CAAC,gDAAgD,EAAE;4BACvD,KAAK,EAAE,aAAa;yBACrB,CAAC,CAAC;wBACH,OAAO;4BACL,OAAO,EAAE,KAAK;4BACd,KAAK,EAAE,2BAA2B,aAAa,EAAE;yBAClD,CAAC;oBACJ,CAAC;oBACD,WAAW,CAAC,YAAY,CAAC,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC;gBACzD,CAAC;qBAAM,CAAC;oBACN,gCAAgC;oBAChC,WAAW,CAAC,YAAY,CAAC,GAAG,QAAQ,CAAC;gBACvC,CAAC;YACH,CAAC;YAED,wBAAwB;YACxB,IAAI,CAAC;gBACH,MAAM,CAAC,+CAA+C,EAAE;oBACtD,QAAQ,EAAE,QAAQ,CAAC,YAAY;oBAC/B,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;iBACnC,CAAC,CAAC;gBAEH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE;oBACzD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,GAAG,QAAQ,CAAC,OAAO;qBACpB;oBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;iBAClC,CAAC,CAAC;gBAEH,yBAAyB;gBACzB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;gBAEhE,oCAAoC;gBACpC,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;oBAC1B,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;oBACpE,MAAM,aAAa,GAAG,QAAQ,CAAC,YAAY,CAAC,aAAa,CAAC;oBAE1D,uDAAuD;oBACvD,MAAM,OAAO,GACX,MAAM,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC,aAAa,CAAC;wBAC5C,UAAU,KAAK,aAAa,CAAC;oBAE/B,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,MAAM,QAAQ,GACZ,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC;4BAC7B,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC;4BAC/B,uBAAuB,CAAC;wBAE1B,MAAM,CAAC,8CAA8C,EAAE;4BACrD,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI;4BAChC,QAAQ,EAAE,aAAa;4BACvB,MAAM,EAAE,UAAU;4BAClB,KAAK,EAAE,QAAQ;yBAChB,CAAC,CAAC;wBAEH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACrD,CAAC;gBACH,CAAC;qBAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACxB,yDAAyD;oBACzD,MAAM,CAAC,oCAAoC,EAAE;wBAC3C,MAAM,EAAE,QAAQ,CAAC,MAAM;qBACxB,CAAC,CAAC;oBACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC9D,CAAC;gBAED,0DAA0D;gBAC1D,IAAI,YAAgC,CAAC;gBAErC,IAAI,QAAQ,CAAC,cAAc,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;oBACtD,8BAA8B;oBAC9B,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;oBACrD,IAAI,SAAS,EAAE,CAAC;wBACd,kCAAkC;wBAClC,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CACjC,yCAAyC,CAC1C,CAAC;wBAEF,IAAI,WAAW,EAAE,CAAC;4BAChB,4CAA4C;4BAC5C,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;wBAChC,CAAC;6BAAM,CAAC;4BACN,yEAAyE;4BACzE,8EAA8E;4BAC9E,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;4BAC5C,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;4BAC5C,YAAY;gCACV,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;wBACvE,CAAC;wBAED,MAAM,CAAC,yDAAyD,EAAE;4BAChE,QAAQ,EAAE,CAAC,CAAC,WAAW;yBACxB,CAAC,CAAC;oBACL,CAAC;oBAED,8CAA8C;oBAC9C,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,YAAY,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;wBAC9C,IAAI,YAAY,EAAE,CAAC;4BACjB,MAAM,CACJ,8DAA8D,CAC/D,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,yBAAyB;oBACzB,YAAY,GAAG,cAAc,CAC3B,IAAI,EACJ,QAAQ,CAAC,cAAc,CAAC,YAAY,CACrC,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,CAAC,iDAAiD,EAAE;wBACxD,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,YAAY;qBAC3C,CAAC,CAAC;oBACH,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,oCAAoC,QAAQ,CAAC,cAAc,CAAC,YAAY,EAAE;qBAClF,CAAC;gBACJ,CAAC;gBAED,gCAAgC;gBAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,CAAC,MAAM;oBAC3C,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC;oBACtD,CAAC,CAAC,SAAS,CAAC;gBAEd,MAAM,SAAS,GAAG,QAAQ,CAAC,cAAc,CAAC,SAAS;oBACjD,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,SAAS,CAAC;oBACzD,CAAC,CAAC,SAAS,CAAC;gBAEd,MAAM,eAAe,GAAG,QAAQ,CAAC,cAAc,CAAC,eAAe;oBAC7D,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,eAAe,CAAC;oBAC/D,CAAC,CAAC,SAAS,CAAC;gBAEd,MAAM,YAAY,GAAG,QAAQ,CAAC,cAAc,CAAC,SAAS;oBACpD,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,SAAS,CAAC;oBACzD,CAAC,CAAC,SAAS,CAAC;gBACd,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAExE,MAAM,CAAC,mDAAmD,EAAE;oBAC1D,SAAS,EAAE,CAAC,CAAC,MAAM;oBACnB,YAAY,EAAE,CAAC,CAAC,SAAS;oBACzB,cAAc,EAAE,CAAC,CAAC,eAAe;oBACjC,SAAS;iBACV,CAAC,CAAC;gBAEH,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,YAAY;oBACZ,MAAM;oBACN,SAAS;oBACT,eAAe;oBACf,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;iBAC3D,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,QAAQ,GACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBAC3D,MAAM,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACrE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,kBAAkB,QAAQ,EAAE;iBACpC,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,cAAc,CAAC,GAAY,EAAE,IAAY;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAY,GAAG,CAAC;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC;YAC9D,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,oCAAoC;AACpC,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/dist/services/idp-token-storage.d.ts

@@ -6,12 +6,60 @@
  *
  * Storage key format: `idp_token:user:{userDid}:provider:{provider}:scopes:{scopeHash}`
  *
+ * Supports both OAuth tokens and credential-based session tokens (CRED-003).
+ *
  * @package @kya-os/mcp-i-cloudflare
  */
 import type { KVNamespace } from "@cloudflare/workers-types";
 import type { IdpTokens } from "@kya-os/contracts/config";
 import type { IIdpTokenStorage } from "@kya-os/mcp-i-core";
 import { OAuthSecurityService } from "./oauth-security.service";
+/**
+ * Token usage metadata for credential providers
+ *
+ * Specifies how the token should be used in subsequent API calls.
+ */
+export interface TokenUsageMetadata {
+    /**
+     * How to use the token in requests
+     * - "cookie": Send as Cookie header
+     * - "bearer": Send as Authorization: Bearer xxx
+     * - "header": Send as custom header (specify tokenHeader)
+     */
+    tokenUsage: "cookie" | "bearer" | "header";
+    /** Custom header name when tokenUsage is "header" */
+    tokenHeader?: string;
+    /**
+     * Cookie format template when tokenUsage is "cookie"
+     * Use {{token}} placeholder for the token value
+     * @example "CIX={{token}}; customerCookie={{token}}"
+     */
+    cookieFormat?: string;
+    /** Additional headers to include in API calls */
+    apiHeaders?: Record<string, string>;
+}
+/**
+ * Extended token data that includes usage metadata
+ */
+export interface StoredTokenData extends TokenUsageMetadata {
+    /** Access/session token */
+    access_token: string;
+    /** Refresh token (OAuth only, optional) */
+    refresh_token?: string;
+    /** Token expiration timestamp (milliseconds since epoch) */
+    expires_at: number;
+    /** Token type (e.g., "Bearer" for OAuth, or custom for credentials) */
+    token_type: string;
+    /** Granted scopes */
+    scope?: string;
+    /** When the token was stored */
+    stored_at: number;
+}
+/**
+ * Extended IdpTokens with usage metadata
+ */
+export interface IdpTokensWithMetadata extends IdpTokens, Partial<TokenUsageMetadata> {
+}
 export interface IdpTokenStorageConfig {
     /** KV namespace for storing tokens */
     storage: KVNamespace;
@@ -32,20 +80,20 @@ export declare class IdpTokenStorage implements IIdpTokenStorage {
      * Store IDP tokens encrypted in KV storage
      *
      * @param userDid - User DID to associate tokens with
-     * @param provider - OAuth provider name (e.g., "github", "google")
+     * @param provider - OAuth provider name (e.g., "github", "google") or credential provider
      * @param scopes - Scopes granted for these tokens
-     * @param tokens - IDP tokens to store
+     * @param tokens - IDP tokens to store (may include usage metadata for credentials)
      */
-    storeToken(userDid: string, provider: string, scopes: string[], tokens: IdpTokens): Promise<void>;
+    storeToken(userDid: string, provider: string, scopes: string[], tokens: IdpTokensWithMetadata): Promise<void>;
     /**
      * Retrieve IDP tokens from KV storage
      *
      * @param userDid - User DID to retrieve tokens for
-     * @param provider - OAuth provider name
+     * @param provider - OAuth provider name or credential provider
      * @param scopes - Scopes to retrieve tokens for
-     * @returns IDP tokens or null if not found
+     * @returns IDP tokens with usage metadata or null if not found
      */
-    getToken(userDid: string, provider: string, scopes: string[]): Promise<IdpTokens | null>;
+    getToken(userDid: string, provider: string, scopes: string[]): Promise<IdpTokensWithMetadata | null>;
     /**
      * Delete IDP tokens from storage
      *

package/dist/services/idp-token-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"idp-token-storage.d.ts","sourceRoot":"","sources":["../../src/services/idp-token-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,MAAM,WAAW,qBAAqB;IACpC,sCAAsC;IACtC,OAAO,EAAE,WAAW,CAAC;IAErB,4CAA4C;IAC5C,oBAAoB,EAAE,oBAAoB,CAAC;IAE3C,+CAA+C;IAC/C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACpD;AAED;;;;GAIG;AACH,qBAAa,eAAgB,YAAW,gBAAgB;IACtD,OAAO,CAAC,MAAM,CAEZ;gBAEU,MAAM,EAAE,qBAAqB;IAQzC;;;;;;;OAOG;IACG,UAAU,CACd,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,EAChB,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC,IAAI,CAAC;IAyChB;;;;;;;OAOG;IACG,QAAQ,CACZ,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,GACf,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAqD5B;;;;;;OAMG;IACG,WAAW,CACf,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,GACf,OAAO,CAAC,IAAI,CAAC;IAchB;;;;;;;;OAQG;IACH,OAAO,CAAC,UAAU;CAcnB"}
+{"version":3,"file":"idp-token-storage.d.ts","sourceRoot":"","sources":["../../src/services/idp-token-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,UAAU,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAE3C,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD,2BAA2B;IAC3B,YAAY,EAAE,MAAM,CAAC;IAErB,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IAEnB,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IAEnB,qBAAqB;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC;CAAG;AAExF,MAAM,WAAW,qBAAqB;IACpC,sCAAsC;IACtC,OAAO,EAAE,WAAW,CAAC;IAErB,4CAA4C;IAC5C,oBAAoB,EAAE,oBAAoB,CAAC;IAE3C,+CAA+C;IAC/C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACpD;AAED;;;;GAIG;AACH,qBAAa,eAAgB,YAAW,gBAAgB;IACtD,OAAO,CAAC,MAAM,CAEZ;gBAEU,MAAM,EAAE,qBAAqB;IAQzC;;;;;;;OAOG;IACG,UAAU,CACd,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,EAChB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,IAAI,CAAC;IAgDhB;;;;;;;OAOG;IACG,QAAQ,CACZ,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,GACf,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IA2DxC;;;;;;OAMG;IACG,WAAW,CACf,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,GACf,OAAO,CAAC,IAAI,CAAC;IAchB;;;;;;;;OAQG;IACH,OAAO,CAAC,UAAU;CAcnB"}

package/dist/services/idp-token-storage.js

@@ -6,6 +6,8 @@
  *
  * Storage key format: `idp_token:user:{userDid}:provider:{provider}:scopes:{scopeHash}`
  *
+ * Supports both OAuth tokens and credential-based session tokens (CRED-003).
+ *
  * @package @kya-os/mcp-i-cloudflare
  */
 /**
@@ -26,14 +28,14 @@ export class IdpTokenStorage {
      * Store IDP tokens encrypted in KV storage
      *
      * @param userDid - User DID to associate tokens with
-     * @param provider - OAuth provider name (e.g., "github", "google")
+     * @param provider - OAuth provider name (e.g., "github", "google") or credential provider
      * @param scopes - Scopes granted for these tokens
-     * @param tokens - IDP tokens to store
+     * @param tokens - IDP tokens to store (may include usage metadata for credentials)
      */
     async storeToken(userDid, provider, scopes, tokens) {
         const scopeHash = this.hashScopes(scopes);
         const key = `idp_token:user:${userDid}:provider:${provider}:scopes:${scopeHash}`;
-        // Prepare token data for storage
+        // Prepare token data for storage, including credential metadata if present
         const tokenData = {
             access_token: tokens.access_token,
             refresh_token: tokens.refresh_token,
@@ -41,6 +43,11 @@ export class IdpTokenStorage {
             token_type: tokens.token_type,
             scope: tokens.scope,
             stored_at: Date.now(),
+            // CRED-003: Include credential provider metadata
+            tokenUsage: tokens.tokenUsage || "bearer", // Default to bearer for OAuth
+            tokenHeader: tokens.tokenHeader,
+            cookieFormat: tokens.cookieFormat,
+            apiHeaders: tokens.apiHeaders,
         };
         // Encrypt token data before storage
         const encrypted = await this.config.oauthSecurityService.encryptToken(JSON.stringify(tokenData));
@@ -58,15 +65,17 @@ export class IdpTokenStorage {
             scopeHash,
             expiresAt: new Date(expiresAt).toISOString(),
             ttl,
+            tokenUsage: tokenData.tokenUsage,
+            hasCookieFormat: !!tokenData.cookieFormat,
         });
     }
     /**
      * Retrieve IDP tokens from KV storage
      *
      * @param userDid - User DID to retrieve tokens for
-     * @param provider - OAuth provider name
+     * @param provider - OAuth provider name or credential provider
      * @param scopes - Scopes to retrieve tokens for
-     * @returns IDP tokens or null if not found
+     * @returns IDP tokens with usage metadata or null if not found
      */
     async getToken(userDid, provider, scopes) {
         const scopeHash = this.hashScopes(scopes);
@@ -85,7 +94,7 @@ export class IdpTokenStorage {
             // Decrypt token data
             const decrypted = await this.config.oauthSecurityService.decryptToken(encrypted);
             const tokenData = JSON.parse(decrypted);
-            // Reconstruct IdpTokens object
+            // Reconstruct IdpTokens object with usage metadata (CRED-003)
             const tokens = {
                 access_token: tokenData.access_token,
                 refresh_token: tokenData.refresh_token,
@@ -95,6 +104,11 @@ export class IdpTokenStorage {
                 expires_in: tokenData.expires_at
                     ? Math.floor((tokenData.expires_at - Date.now()) / 1000)
                     : undefined,
+                // CRED-003: Include credential usage metadata
+                tokenUsage: tokenData.tokenUsage,
+                tokenHeader: tokenData.tokenHeader,
+                cookieFormat: tokenData.cookieFormat,
+                apiHeaders: tokenData.apiHeaders,
             };
             this.config.logger("[IdpTokenStorage] Token retrieved", {
                 userDid: userDid.substring(0, 20) + "...",
@@ -102,6 +116,7 @@ export class IdpTokenStorage {
                 scopes,
                 expiresAt: new Date(tokens.expires_at).toISOString(),
                 isExpired: tokens.expires_at < Date.now(),
+                tokenUsage: tokens.tokenUsage,
             });
             return tokens;
         }

package/dist/services/idp-token-storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"idp-token-storage.js","sourceRoot":"","sources":["../../src/services/idp-token-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAkBH;;;;GAIG;AACH,MAAM,OAAO,eAAe;IAClB,MAAM,CAEZ;IAEF,YAAY,MAA6B;QACvC,IAAI,CAAC,MAAM,GAAG;YACZ,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;YACjD,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;SACpC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CACd,OAAe,EACf,QAAgB,EAChB,MAAgB,EAChB,MAAiB;QAEjB,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,kBAAkB,OAAO,aAAa,QAAQ,WAAW,SAAS,EAAE,CAAC;QAEjF,iCAAiC;QACjC,MAAM,SAAS,GAAG;YAChB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,oCAAoC;QACpC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,YAAY,CACnE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAC1B,CAAC;QAEF,6DAA6D;QAC7D,gDAAgD;QAChD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAClB,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAC5C,CAAC;QAEF,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE;YAC5C,aAAa,EAAE,GAAG;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,gCAAgC,EAAE;YACnD,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;YACzC,QAAQ;YACR,MAAM;YACN,SAAS;YACT,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;YAC5C,GAAG;SACJ,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,QAAQ,CACZ,OAAe,EACf,QAAgB,EAChB,MAAgB;QAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,kBAAkB,OAAO,aAAa,QAAQ,WAAW,SAAS,EAAE,CAAC;QAEjF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,mCAAmC,EAAE;gBACtD,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACzC,QAAQ;gBACR,MAAM;gBACN,SAAS;aACV,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,qBAAqB;YACrB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,YAAY,CACnE,SAAS,CACV,CAAC;YACF,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAExC,+BAA+B;YAC/B,MAAM,MAAM,GAAc;gBACxB,YAAY,EAAE,SAAS,CAAC,YAAY;gBACpC,aAAa,EAAE,SAAS,CAAC,aAAa;gBACtC,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,UAAU,EAAE,SAAS,CAAC,UAAU;oBAC9B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;oBACxD,CAAC,CAAC,SAAS;aACd,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,mCAAmC,EAAE;gBACtD,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACzC,QAAQ;gBACR,MAAM;gBACN,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;gBACpD,SAAS,EAAE,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE;aAC1C,CAAC,CAAC;YAEH,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,2CAA2C,EAAE;gBAC9D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACzC,QAAQ;aACT,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CACf,OAAe,EACf,QAAgB,EAChB,MAAgB;QAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,kBAAkB,OAAO,aAAa,QAAQ,WAAW,SAAS,EAAE,CAAC;QAEjF,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAEtC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,iCAAiC,EAAE;YACpD,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;YACzC,QAAQ;YACR,MAAM;YACN,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACK,UAAU,CAAC,MAAgB;QACjC,8CAA8C;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEvC,iEAAiE;QACjE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB;QAE3D,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,CAAC;aAC3C,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvB,CAAC;CACF"}
+{"version":3,"file":"idp-token-storage.js","sourceRoot":"","sources":["../../src/services/idp-token-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA0EH;;;;GAIG;AACH,MAAM,OAAO,eAAe;IAClB,MAAM,CAEZ;IAEF,YAAY,MAA6B;QACvC,IAAI,CAAC,MAAM,GAAG;YACZ,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;YACjD,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;SACpC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CACd,OAAe,EACf,QAAgB,EAChB,MAAgB,EAChB,MAA6B;QAE7B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,kBAAkB,OAAO,aAAa,QAAQ,WAAW,SAAS,EAAE,CAAC;QAEjF,2EAA2E;QAC3E,MAAM,SAAS,GAAoB;YACjC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,iDAAiD;YACjD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,QAAQ,EAAE,8BAA8B;YACzE,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;QAEF,oCAAoC;QACpC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,YAAY,CACnE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAC1B,CAAC;QAEF,6DAA6D;QAC7D,gDAAgD;QAChD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAClB,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAC5C,CAAC;QAEF,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE;YAC5C,aAAa,EAAE,GAAG;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,gCAAgC,EAAE;YACnD,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;YACzC,QAAQ;YACR,MAAM;YACN,SAAS;YACT,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;YAC5C,GAAG;YACH,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,eAAe,EAAE,CAAC,CAAC,SAAS,CAAC,YAAY;SAC1C,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,QAAQ,CACZ,OAAe,EACf,QAAgB,EAChB,MAAgB;QAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,kBAAkB,OAAO,aAAa,QAAQ,WAAW,SAAS,EAAE,CAAC;QAEjF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,mCAAmC,EAAE;gBACtD,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACzC,QAAQ;gBACR,MAAM;gBACN,SAAS;aACV,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,qBAAqB;YACrB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,YAAY,CACnE,SAAS,CACV,CAAC;YACF,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAoB,CAAC;YAE3D,8DAA8D;YAC9D,MAAM,MAAM,GAA0B;gBACpC,YAAY,EAAE,SAAS,CAAC,YAAY;gBACpC,aAAa,EAAE,SAAS,CAAC,aAAa;gBACtC,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,UAAU,EAAE,SAAS,CAAC,UAAU;oBAC9B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;oBACxD,CAAC,CAAC,SAAS;gBACb,8CAA8C;gBAC9C,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,YAAY,EAAE,SAAS,CAAC,YAAY;gBACpC,UAAU,EAAE,SAAS,CAAC,UAAU;aACjC,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,mCAAmC,EAAE;gBACtD,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACzC,QAAQ;gBACR,MAAM;gBACN,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;gBACpD,SAAS,EAAE,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE;gBACzC,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAC;YAEH,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,2CAA2C,EAAE;gBAC9D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACzC,QAAQ;aACT,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CACf,OAAe,EACf,QAAgB,EAChB,MAAgB;QAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,kBAAkB,OAAO,aAAa,QAAQ,WAAW,SAAS,EAAE,CAAC;QAEjF,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAEtC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,iCAAiC,EAAE;YACpD,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;YACzC,QAAQ;YACR,MAAM;YACN,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACK,UAAU,CAAC,MAAgB;QACjC,8CAA8C;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEvC,iEAAiE;QACjE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB;QAE3D,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,CAAC;aAC3C,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvB,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/mcp-i-cloudflare",
-  "version": "1.6.25",
+  "version": "1.6.27",
   "description": "Cloudflare Workers adapter for MCP-I framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -17,8 +17,8 @@
     "prepublishOnly": "npm run build && node ../create-mcpi-app/scripts/validate-no-workspace.js"
   },
   "dependencies": {
-    "@kya-os/contracts": "^1.6.4",
-    "@kya-os/mcp-i-core": "^1.3.10",
+    "@kya-os/contracts": "^1.6.5",
+    "@kya-os/mcp-i-core": "^1.3.12",
     "@modelcontextprotocol/sdk": "^1.19.1",
     "agents": "^0.2.21",
     "base-x": "^5.0.0",

package/dist/__tests__/e2e/test-config.d.ts

@@ -1,37 +0,0 @@
-/**
- * E2E Test Configuration
- *
- * This file contains configuration for end-to-end tests that use real AgentShield API.
- * Set these environment variables before running E2E tests:
- *
- * ```bash
- * export E2E_AGENTSHIELD_API_KEY="sk_test_..."
- * export E2E_AGENTSHIELD_PROJECT_ID="test-project-id"
- * export E2E_AGENTSHIELD_API_URL="https://kya.vouched.id"  # Optional, defaults to production
- * ```
- *
- * Or create a `.env.e2e` file in the package root:
- * ```
- * E2E_AGENTSHIELD_API_KEY=sk_test_...
- * E2E_AGENTSHIELD_PROJECT_ID=test-project-id
- * ```
- */
-export interface E2ETestConfig {
-    apiKey: string;
-    projectId: string;
-    apiUrl: string;
-    enabled: boolean;
-}
-/**
- * Load E2E test configuration from environment variables
- */
-export declare function loadE2EConfig(): E2ETestConfig | null;
-/**
- * Check if E2E tests should run
- */
-export declare function shouldRunE2ETests(): boolean;
-/**
- * Get E2E test configuration or throw if not configured
- */
-export declare function getE2EConfig(): E2ETestConfig;
-//# sourceMappingURL=test-config.d.ts.map

package/dist/__tests__/e2e/test-config.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"test-config.d.ts","sourceRoot":"","sources":["../../../src/__tests__/e2e/test-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAWH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,aAAa,GAAG,IAAI,CAyBpD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAG3C;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,aAAa,CAU5C"}

package/dist/__tests__/e2e/test-config.js

@@ -1,62 +0,0 @@
-/**
- * E2E Test Configuration
- *
- * This file contains configuration for end-to-end tests that use real AgentShield API.
- * Set these environment variables before running E2E tests:
- *
- * ```bash
- * export E2E_AGENTSHIELD_API_KEY="sk_test_..."
- * export E2E_AGENTSHIELD_PROJECT_ID="test-project-id"
- * export E2E_AGENTSHIELD_API_URL="https://kya.vouched.id"  # Optional, defaults to production
- * ```
- *
- * Or create a `.env.e2e` file in the package root:
- * ```
- * E2E_AGENTSHIELD_API_KEY=sk_test_...
- * E2E_AGENTSHIELD_PROJECT_ID=test-project-id
- * ```
- */
-/**
- * Load E2E test configuration from environment variables
- */
-export function loadE2EConfig() {
-    // Access environment variables - works in Node.js (vitest) environment
-    const apiKey = typeof process !== "undefined" && process.env
-        ? process.env.E2E_AGENTSHIELD_API_KEY
-        : undefined;
-    const projectId = typeof process !== "undefined" && process.env
-        ? process.env.E2E_AGENTSHIELD_PROJECT_ID
-        : undefined;
-    const apiUrl = typeof process !== "undefined" && process.env
-        ? process.env.E2E_AGENTSHIELD_API_URL || "https://kya.vouched.id"
-        : "https://kya.vouched.id";
-    if (!apiKey || !projectId) {
-        return null;
-    }
-    return {
-        apiKey,
-        projectId,
-        apiUrl,
-        enabled: true,
-    };
-}
-/**
- * Check if E2E tests should run
- */
-export function shouldRunE2ETests() {
-    const config = loadE2EConfig();
-    return config !== null && config.enabled;
-}
-/**
- * Get E2E test configuration or throw if not configured
- */
-export function getE2EConfig() {
-    const config = loadE2EConfig();
-    if (!config) {
-        throw new Error("E2E tests require E2E_AGENTSHIELD_API_KEY and E2E_AGENTSHIELD_PROJECT_ID environment variables.\n" +
-            "Set them in your environment or create a .env.e2e file.\n" +
-            "See packages/mcp-i-cloudflare/src/__tests__/e2e/test-config.ts for details.");
-    }
-    return config;
-}
-//# sourceMappingURL=test-config.js.map

package/dist/__tests__/e2e/test-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"test-config.js","sourceRoot":"","sources":["../../../src/__tests__/e2e/test-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAkBH;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,uEAAuE;IACvE,MAAM,MAAM,GACV,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG;QAC3C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB;QACrC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,SAAS,GACb,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG;QAC3C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B;QACxC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,MAAM,GACV,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG;QAC3C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,wBAAwB;QACjE,CAAC,CAAC,wBAAwB,CAAC;IAE/B,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,MAAM;QACN,SAAS;QACT,MAAM;QACN,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,mGAAmG;YACjG,2DAA2D;YAC3D,6EAA6E,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/utils/client-info.d.ts

@@ -1,69 +0,0 @@
-/**
- * Client Info Utilities
- *
- * Handles MCP client information extraction, normalization, and handshake payload preparation.
- * This consolidates logic for working with client metadata across initialize and handshake.
- */
-import type { HandshakeRequest, MCPClientCapabilities } from "@kya-os/contracts/handshake";
-import type { MCPClientInfo as SessionClientInfo } from "../types/client";
-/**
- * Initialize context with client information
- */
-export interface InitializeContext {
-    timestamp: number;
-    protocolVersion?: string;
-    capabilities?: MCPClientCapabilities;
-    clientInfo?: Partial<SessionClientInfo>;
-}
-/**
- * Normalize client info from various formats
- *
- * @param value Client info from request (could be from initialize or handshake)
- * @returns Normalized client info or undefined if invalid
- */
-export declare function normalizeClientInfo(value: unknown): Partial<SessionClientInfo> | undefined;
-/**
- * Extract MCP client information from handshake request and initialize context
- *
- * @param request Handshake request
- * @param initializeContext Optional context from previous initialize call
- * @returns Extracted and normalized client info or undefined
- */
-export declare function extractMCPClient(request: HandshakeRequest, initializeContext?: InitializeContext): SessionClientInfo | undefined;
-/**
- * Prepare handshake payload with client information from initialize context
- *
- * @param params Original handshake request parameters
- * @param initializeContext Optional context from previous initialize call
- * @returns Enhanced handshake request with client info
- */
-export declare function prepareHandshakePayload(params: HandshakeRequest, initializeContext?: InitializeContext): HandshakeRequest;
-/**
- * Clone capabilities object (deep copy)
- *
- * @param capabilities Capabilities to clone
- * @returns Cloned capabilities or undefined
- */
-export declare function cloneCapabilities(capabilities: unknown): MCPClientCapabilities | undefined;
-/**
- * Type guard for record objects
- *
- * @param value Value to check
- * @returns true if value is a record object
- */
-export declare function isRecord(value: unknown): value is Record<string, unknown>;
-/**
- * Extract client ID from client info if available
- *
- * @param clientInfo Client info object
- * @returns Client ID or undefined
- */
-export declare function extractClientId(clientInfo: unknown): string | undefined;
-/**
- * Merge client info from multiple sources
- *
- * @param sources Array of potential client info sources (later sources override earlier)
- * @returns Merged client info
- */
-export declare function mergeClientInfo(...sources: (Partial<SessionClientInfo> | undefined)[]): Partial<SessionClientInfo>;
-//# sourceMappingURL=client-info.d.ts.map

package/dist/utils/client-info.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client-info.d.ts","sourceRoot":"","sources":["../../src/utils/client-info.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,IAAI,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,UAAU,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACzC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAuCxC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,gBAAgB,EACzB,iBAAiB,CAAC,EAAE,iBAAiB,GACpC,iBAAiB,GAAG,SAAS,CAkD/B;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,gBAAgB,EACxB,iBAAiB,CAAC,EAAE,iBAAiB,GACpC,gBAAgB,CA8BlB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,OAAO,GACpB,qBAAqB,GAAG,SAAS,CAMnC;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAWvE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,GAAG,OAAO,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC,EAAE,GACrD,OAAO,CAAC,iBAAiB,CAAC,CAU5B"}