@kya-os/mcp-i-core 1.2.2-canary.24 → 1.2.2-canary.25

package/dist/services/provider-resolver.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Provider Resolver
+ *
+ * Resolves OAuth provider for tools using priority-based resolution strategy.
+ * Supports Phase 2+ tool-specific providers with backward compatibility for Phase 1.
+ *
+ * @package @kya-os/mcp-i-core
+ */
+import type { ToolProtection } from "@kya-os/contracts/tool-protection";
+import type { OAuthProviderRegistry } from "./oauth-provider-registry.js";
+import type { OAuthConfigService } from "./oauth-config.service.js";
+/**
+ * Resolves OAuth provider for tools with priority-based fallback strategy
+ *
+ * Priority order:
+ * 1. Tool-specific oauthProvider field (Phase 2+ preferred)
+ * 2. Scope prefix inference (fallback)
+ * 3. First configured provider (Phase 1 compatibility fallback)
+ * 4. Error if no provider can be resolved
+ */
+export declare class ProviderResolver {
+    private registry;
+    private configService;
+    constructor(registry: OAuthProviderRegistry, configService: OAuthConfigService);
+    /**
+     * Resolve OAuth provider for a tool
+     *
+     * @param toolProtection - Tool protection configuration
+     * @param projectId - Project ID for fetching provider config
+     * @returns Provider name (never null - throws if cannot resolve)
+     * @throws Error if provider cannot be resolved
+     */
+    resolveProvider(toolProtection: ToolProtection, projectId: string): Promise<string>;
+    /**
+     * Infer provider from scope prefixes
+     *
+     * Used as Priority 2 fallback when oauthProvider is not specified.
+     * Examples:
+     * - github:repo:read → github
+     * - gmail:read → google
+     * - microsoft:calendar:read → microsoft
+     *
+     * @param scopes - Required scopes for the tool
+     * @returns Provider name if uniquely inferred, null otherwise
+     */
+    private inferProviderFromScopes;
+}
+//# sourceMappingURL=provider-resolver.d.ts.map

package/dist/services/provider-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-resolver.d.ts","sourceRoot":"","sources":["../../src/services/provider-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;;;;;;;;GAQG;AACH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,aAAa;gBADb,QAAQ,EAAE,qBAAqB,EAC/B,aAAa,EAAE,kBAAkB;IAG3C;;;;;;;OAOG;IACG,eAAe,CACnB,cAAc,EAAE,cAAc,EAC9B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC;IAuDlB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,uBAAuB;CAoChC"}

package/dist/services/provider-resolver.js

@@ -0,0 +1,120 @@
+"use strict";
+/**
+ * Provider Resolver
+ *
+ * Resolves OAuth provider for tools using priority-based resolution strategy.
+ * Supports Phase 2+ tool-specific providers with backward compatibility for Phase 1.
+ *
+ * @package @kya-os/mcp-i-core
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProviderResolver = void 0;
+/**
+ * Resolves OAuth provider for tools with priority-based fallback strategy
+ *
+ * Priority order:
+ * 1. Tool-specific oauthProvider field (Phase 2+ preferred)
+ * 2. Scope prefix inference (fallback)
+ * 3. First configured provider (Phase 1 compatibility fallback)
+ * 4. Error if no provider can be resolved
+ */
+class ProviderResolver {
+    registry;
+    configService;
+    constructor(registry, configService) {
+        this.registry = registry;
+        this.configService = configService;
+    }
+    /**
+     * Resolve OAuth provider for a tool
+     *
+     * @param toolProtection - Tool protection configuration
+     * @param projectId - Project ID for fetching provider config
+     * @returns Provider name (never null - throws if cannot resolve)
+     * @throws Error if provider cannot be resolved
+     */
+    async resolveProvider(toolProtection, projectId) {
+        // Priority 1: Tool-specific provider (Phase 2+ preferred)
+        if (toolProtection.oauthProvider) {
+            // Ensure registry is loaded before checking
+            if (this.registry.getProviderNames().length === 0) {
+                await this.registry.loadFromAgentShield(projectId);
+            }
+            if (!this.registry.hasProvider(toolProtection.oauthProvider)) {
+                throw new Error(`Provider "${toolProtection.oauthProvider}" not configured for project "${projectId}". ` +
+                    `Add provider in project settings.`);
+            }
+            return toolProtection.oauthProvider;
+        }
+        // Priority 2: Scope prefix inference (fallback)
+        const inferredProvider = this.inferProviderFromScopes(toolProtection.requiredScopes || []);
+        if (inferredProvider) {
+            // Ensure registry is loaded before checking
+            if (this.registry.getProviderNames().length === 0) {
+                await this.registry.loadFromAgentShield(projectId);
+            }
+            if (this.registry.hasProvider(inferredProvider)) {
+                console.log(`[ProviderResolver] Inferred provider "${inferredProvider}" from scopes`);
+                return inferredProvider;
+            }
+        }
+        // Priority 3: First configured provider (Phase 1 compatibility fallback)
+        // Ensure registry is loaded
+        await this.registry.loadFromAgentShield(projectId);
+        const providers = this.registry.getAllProviders();
+        if (providers.length > 0) {
+            // Log deprecation warning for Phase 1 tools
+            const firstProviderName = this.registry.getProviderNames()[0];
+            console.warn(`[ProviderResolver] Tool does not specify oauthProvider. ` +
+                `Using first configured provider "${firstProviderName}" as fallback. ` +
+                `This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.`);
+            return firstProviderName;
+        }
+        // Priority 4: Error if no provider can be resolved
+        throw new Error(`Tool requires OAuth but no provider could be resolved. ` +
+            `Either specify oauthProvider in tool protection config, or configure at least one provider for project "${projectId}".`);
+    }
+    /**
+     * Infer provider from scope prefixes
+     *
+     * Used as Priority 2 fallback when oauthProvider is not specified.
+     * Examples:
+     * - github:repo:read → github
+     * - gmail:read → google
+     * - microsoft:calendar:read → microsoft
+     *
+     * @param scopes - Required scopes for the tool
+     * @returns Provider name if uniquely inferred, null otherwise
+     */
+    inferProviderFromScopes(scopes) {
+        if (!scopes || scopes.length === 0) {
+            return null;
+        }
+        // Extract first part of scope (before first colon)
+        const scopePrefixes = scopes.map((scope) => {
+            const parts = scope.split(":");
+            return parts[0].toLowerCase();
+        });
+        // Provider mapping
+        const providerMap = {
+            github: "github",
+            google: "google",
+            gmail: "google", // gmail:read → google
+            calendar: "google", // calendar:read → google (if ambiguous, use project default)
+            microsoft: "microsoft",
+            outlook: "microsoft",
+            slack: "slack",
+            auth0: "auth0",
+            okta: "okta",
+        };
+        // Find unique provider
+        const providers = new Set(scopePrefixes.map((prefix) => providerMap[prefix]).filter(Boolean));
+        if (providers.size === 1) {
+            return Array.from(providers)[0];
+        }
+        // Ambiguous or no prefix → return null (use project-level provider)
+        return null;
+    }
+}
+exports.ProviderResolver = ProviderResolver;
+//# sourceMappingURL=provider-resolver.js.map

package/dist/services/provider-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-resolver.js","sourceRoot":"","sources":["../../src/services/provider-resolver.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAMH;;;;;;;;GAQG;AACH,MAAa,gBAAgB;IAEjB;IACA;IAFV,YACU,QAA+B,EAC/B,aAAiC;QADjC,aAAQ,GAAR,QAAQ,CAAuB;QAC/B,kBAAa,GAAb,aAAa,CAAoB;IACxC,CAAC;IAEJ;;;;;;;OAOG;IACH,KAAK,CAAC,eAAe,CACnB,cAA8B,EAC9B,SAAiB;QAEjB,0DAA0D;QAC1D,IAAI,cAAc,CAAC,aAAa,EAAE,CAAC;YACjC,4CAA4C;YAC5C,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CACb,aAAa,cAAc,CAAC,aAAa,iCAAiC,SAAS,KAAK;oBACtF,mCAAmC,CACtC,CAAC;YACJ,CAAC;YACD,OAAO,cAAc,CAAC,aAAa,CAAC;QACtC,CAAC;QAED,gDAAgD;QAChD,MAAM,gBAAgB,GAAG,IAAI,CAAC,uBAAuB,CACnD,cAAc,CAAC,cAAc,IAAI,EAAE,CACpC,CAAC;QACF,IAAI,gBAAgB,EAAE,CAAC;YACrB,4CAA4C;YAC5C,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAChD,OAAO,CAAC,GAAG,CACT,yCAAyC,gBAAgB,eAAe,CACzE,CAAC;gBACF,OAAO,gBAAgB,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,4BAA4B;QAC5B,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;QAClD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,4CAA4C;YAC5C,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CACV,0DAA0D;gBACxD,oCAAoC,iBAAiB,iBAAiB;gBACtE,qFAAqF,CACxF,CAAC;YACF,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QAED,mDAAmD;QACnD,MAAM,IAAI,KAAK,CACb,yDAAyD;YACvD,2GAA2G,SAAS,IAAI,CAC3H,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACK,uBAAuB,CAAC,MAAgB;QAC9C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mDAAmD;QACnD,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACzC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,mBAAmB;QACnB,MAAM,WAAW,GAA2B;YAC1C,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,QAAQ,EAAE,sBAAsB;YACvC,QAAQ,EAAE,QAAQ,EAAE,6DAA6D;YACjF,SAAS,EAAE,WAAW;YACtB,OAAO,EAAE,WAAW;YACpB,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,MAAM;SACb,CAAC;QAEF,uBAAuB;QACvB,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CACnE,CAAC;QAEF,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QAED,oEAAoE;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAxHD,4CAwHC"}

package/dist/services/provider-validator.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Provider Validator
+ *
+ * Validates OAuth provider configurations for custom IDP support.
+ * Ensures provider configurations are valid before registration.
+ *
+ * @package @kya-os/mcp-i-core
+ */
+import type { OAuthProvider } from "@kya-os/contracts/config";
+/**
+ * Validation error for provider configuration issues
+ */
+export declare class ProviderValidationError extends Error {
+    readonly field?: string | undefined;
+    constructor(message: string, field?: string | undefined);
+}
+/**
+ * Service for validating OAuth provider configurations
+ */
+export declare class ProviderValidator {
+    /**
+     * Validate provider configuration
+     *
+     * @param provider - Provider configuration to validate
+     * @param name - Provider name (for error messages)
+     * @throws ProviderValidationError if validation fails
+     */
+    validate(provider: OAuthProvider, name: string): void;
+    /**
+     * Validate URL format
+     *
+     * @param url - URL to validate
+     * @param providerName - Provider name (for error messages)
+     * @param fieldName - Field name (for error messages)
+     * @throws ProviderValidationError if URL is invalid
+     */
+    private validateUrl;
+    /**
+     * Validate custom parameters don't override reserved OAuth parameters
+     *
+     * @param customParams - Custom parameters to validate
+     * @param providerName - Provider name (for error messages)
+     * @throws ProviderValidationError if reserved parameter is overridden
+     */
+    private validateCustomParams;
+    /**
+     * Test provider endpoint reachability (optional)
+     *
+     * @param provider - Provider configuration
+     * @param fetchProvider - Fetch implementation
+     * @returns True if endpoint is reachable, false otherwise
+     */
+    testProvider(provider: OAuthProvider, fetchProvider: typeof fetch): Promise<boolean>;
+}
+//# sourceMappingURL=provider-validator.d.ts.map

package/dist/services/provider-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-validator.d.ts","sourceRoot":"","sources":["../../src/services/provider-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAe9D;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aACH,KAAK,CAAC,EAAE,MAAM;gBAA/C,OAAO,EAAE,MAAM,EAAkB,KAAK,CAAC,EAAE,MAAM,YAAA;CAI5D;AAED;;GAEG;AACH,qBAAa,iBAAiB;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IA6CrD;;;;;;;OAOG;IACH,OAAO,CAAC,WAAW;IAoBnB;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAqB5B;;;;;;OAMG;IACG,YAAY,CAChB,QAAQ,EAAE,aAAa,EACvB,aAAa,EAAE,OAAO,KAAK,GAC1B,OAAO,CAAC,OAAO,CAAC;CAYpB"}

package/dist/services/provider-validator.js

@@ -0,0 +1,135 @@
+"use strict";
+/**
+ * Provider Validator
+ *
+ * Validates OAuth provider configurations for custom IDP support.
+ * Ensures provider configurations are valid before registration.
+ *
+ * @package @kya-os/mcp-i-core
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProviderValidator = exports.ProviderValidationError = void 0;
+/**
+ * Reserved OAuth parameters that cannot be overridden by custom parameters
+ */
+const RESERVED_PARAMETERS = [
+    "response_type",
+    "client_id",
+    "redirect_uri",
+    "scope",
+    "state",
+    "code_challenge",
+    "code_challenge_method",
+];
+/**
+ * Validation error for provider configuration issues
+ */
+class ProviderValidationError extends Error {
+    field;
+    constructor(message, field) {
+        super(message);
+        this.field = field;
+        this.name = "ProviderValidationError";
+    }
+}
+exports.ProviderValidationError = ProviderValidationError;
+/**
+ * Service for validating OAuth provider configurations
+ */
+class ProviderValidator {
+    /**
+     * Validate provider configuration
+     *
+     * @param provider - Provider configuration to validate
+     * @param name - Provider name (for error messages)
+     * @throws ProviderValidationError if validation fails
+     */
+    validate(provider, name) {
+        // Validate required fields
+        if (!provider.clientId || provider.clientId.trim().length === 0) {
+            throw new ProviderValidationError(`Provider "${name}" must have a clientId`, "clientId");
+        }
+        if (!provider.authorizationUrl || provider.authorizationUrl.trim().length === 0) {
+            throw new ProviderValidationError(`Provider "${name}" must have an authorizationUrl`, "authorizationUrl");
+        }
+        if (!provider.tokenUrl || provider.tokenUrl.trim().length === 0) {
+            throw new ProviderValidationError(`Provider "${name}" must have a tokenUrl`, "tokenUrl");
+        }
+        // Validate URL formats
+        this.validateUrl(provider.authorizationUrl, name, "authorizationUrl");
+        this.validateUrl(provider.tokenUrl, name, "tokenUrl");
+        if (provider.userInfoUrl) {
+            this.validateUrl(provider.userInfoUrl, name, "userInfoUrl");
+        }
+        // Validate proxy mode requirements
+        if (provider.proxyMode && !provider.requiresClientSecret) {
+            throw new ProviderValidationError(`Provider "${name}" with proxyMode=true must have requiresClientSecret=true`, "proxyMode");
+        }
+        // Validate custom parameters don't conflict with reserved parameters
+        if (provider.customParams) {
+            this.validateCustomParams(provider.customParams, name);
+        }
+    }
+    /**
+     * Validate URL format
+     *
+     * @param url - URL to validate
+     * @param providerName - Provider name (for error messages)
+     * @param fieldName - Field name (for error messages)
+     * @throws ProviderValidationError if URL is invalid
+     */
+    validateUrl(url, providerName, fieldName) {
+        try {
+            const parsedUrl = new URL(url);
+            if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
+                throw new ProviderValidationError(`Provider "${providerName}" ${fieldName} must use HTTP or HTTPS protocol`, fieldName);
+            }
+        }
+        catch (error) {
+            if (error instanceof ProviderValidationError) {
+                throw error;
+            }
+            throw new ProviderValidationError(`Provider "${providerName}" ${fieldName} is not a valid URL: ${error instanceof Error ? error.message : String(error)}`, fieldName);
+        }
+    }
+    /**
+     * Validate custom parameters don't override reserved OAuth parameters
+     *
+     * @param customParams - Custom parameters to validate
+     * @param providerName - Provider name (for error messages)
+     * @throws ProviderValidationError if reserved parameter is overridden
+     */
+    validateCustomParams(customParams, providerName) {
+        for (const [key, value] of Object.entries(customParams)) {
+            const normalizedKey = key.toLowerCase();
+            if (RESERVED_PARAMETERS.includes(normalizedKey)) {
+                throw new ProviderValidationError(`Provider "${providerName}" custom parameter "${key}" conflicts with reserved OAuth parameter. Reserved parameters: ${RESERVED_PARAMETERS.join(", ")}`, `customParams.${key}`);
+            }
+            if (!value || value.trim().length === 0) {
+                throw new ProviderValidationError(`Provider "${providerName}" custom parameter "${key}" has empty value`, `customParams.${key}`);
+            }
+        }
+    }
+    /**
+     * Test provider endpoint reachability (optional)
+     *
+     * @param provider - Provider configuration
+     * @param fetchProvider - Fetch implementation
+     * @returns True if endpoint is reachable, false otherwise
+     */
+    async testProvider(provider, fetchProvider) {
+        try {
+            // Test authorization URL (HEAD request to avoid triggering OAuth flow)
+            const authResponse = await fetchProvider(provider.authorizationUrl, {
+                method: "HEAD",
+                signal: AbortSignal.timeout(5000), // 5 second timeout
+            });
+            return authResponse.ok || authResponse.status === 405; // 405 Method Not Allowed is OK
+        }
+        catch (error) {
+            return false;
+        }
+    }
+}
+exports.ProviderValidator = ProviderValidator;
+//# sourceMappingURL=provider-validator.js.map

package/dist/services/provider-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-validator.js","sourceRoot":"","sources":["../../src/services/provider-validator.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAIH;;GAEG;AACH,MAAM,mBAAmB,GAAG;IAC1B,eAAe;IACf,WAAW;IACX,cAAc;IACd,OAAO;IACP,OAAO;IACP,gBAAgB;IAChB,uBAAuB;CACf,CAAC;AAEX;;GAEG;AACH,MAAa,uBAAwB,SAAQ,KAAK;IACH;IAA7C,YAAY,OAAe,EAAkB,KAAc;QACzD,KAAK,CAAC,OAAO,CAAC,CAAC;QAD4B,UAAK,GAAL,KAAK,CAAS;QAEzD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AALD,0DAKC;AAED;;GAEG;AACH,MAAa,iBAAiB;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAuB,EAAE,IAAY;QAC5C,2BAA2B;QAC3B,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,uBAAuB,CAC/B,aAAa,IAAI,wBAAwB,EACzC,UAAU,CACX,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,gBAAgB,IAAI,QAAQ,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,uBAAuB,CAC/B,aAAa,IAAI,iCAAiC,EAClD,kBAAkB,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,uBAAuB,CAC/B,aAAa,IAAI,wBAAwB,EACzC,UAAU,CACX,CAAC;QACJ,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;QACtE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAEtD,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAC9D,CAAC;QAED,mCAAmC;QACnC,IAAI,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC;YACzD,MAAM,IAAI,uBAAuB,CAC/B,aAAa,IAAI,2DAA2D,EAC5E,WAAW,CACZ,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1B,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,WAAW,CAAC,GAAW,EAAE,YAAoB,EAAE,SAAiB;QACtE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACtE,MAAM,IAAI,uBAAuB,CAC/B,aAAa,YAAY,KAAK,SAAS,kCAAkC,EACzE,SAAS,CACV,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;gBAC7C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,aAAa,YAAY,KAAK,SAAS,wBAAwB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACvH,SAAS,CACV,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,oBAAoB,CAC1B,YAAoC,EACpC,YAAoB;QAEpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACxD,MAAM,aAAa,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YACxC,IAAI,mBAAmB,CAAC,QAAQ,CAAC,aAAoB,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,uBAAuB,CAC/B,aAAa,YAAY,uBAAuB,GAAG,mEAAmE,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACtJ,gBAAgB,GAAG,EAAE,CACtB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,uBAAuB,CAC/B,aAAa,YAAY,uBAAuB,GAAG,mBAAmB,EACtE,gBAAgB,GAAG,EAAE,CACtB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAChB,QAAuB,EACvB,aAA2B;QAE3B,IAAI,CAAC;YACH,uEAAuE;YACvE,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,gBAAgB,EAAE;gBAClE,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,mBAAmB;aACvD,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,EAAE,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,+BAA+B;QACxF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAnID,8CAmIC"}

package/dist/services/tool-context-builder.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Tool Context Builder
+ *
+ * Builds ToolExecutionContext for tool handlers by resolving IDP tokens
+ * based on tool protection configuration and user identity.
+ *
+ * @package @kya-os/mcp-i-core
+ */
+import type { ToolExecutionContext } from "@kya-os/contracts/config";
+import type { IdpTokenResolver } from "../identity/idp-token-resolver.js";
+import type { ToolProtection } from "../types/tool-protection.js";
+import type { OAuthConfigService } from "./oauth-config.service.js";
+import type { ProviderResolver } from "./provider-resolver.js";
+export interface ToolContextBuilderConfig {
+    /** IDP token resolver for resolving tokens from User DID */
+    tokenResolver: IdpTokenResolver;
+    /** OAuth config service for fetching provider configurations */
+    configService: OAuthConfigService;
+    /** Provider resolver for resolving OAuth providers for tools */
+    providerResolver: ProviderResolver;
+    /** Project ID for fetching OAuth config */
+    projectId: string;
+    /** Optional logger callback for diagnostics */
+    logger?: (message: string, data?: unknown) => void;
+}
+/**
+ * Builder for tool execution context
+ *
+ * Resolves IDP tokens and builds context for tool handlers.
+ * Phase 1: Uses configured provider as temporary fallback.
+ * Phase 2+: Requires explicit oauthProvider on tool protection.
+ */
+export declare class ToolContextBuilder {
+    private config;
+    constructor(config: ToolContextBuilderConfig);
+    /**
+     * Build tool execution context
+     *
+     * @param toolName - Name of the tool being executed
+     * @param userDid - User DID (optional, required for OAuth)
+     * @param sessionId - Session ID (optional)
+     * @param delegationToken - Delegation token (optional)
+     * @param toolProtection - Tool protection configuration (optional)
+     * @returns Tool execution context or undefined if not needed
+     */
+    buildContext(toolName: string, userDid: string | undefined, sessionId: string | undefined, delegationToken: string | undefined, toolProtection: ToolProtection | null): Promise<ToolExecutionContext | undefined>;
+    /**
+     * Resolve OAuth provider for a tool
+     *
+     * Phase 2: Uses ProviderResolver with priority-based resolution
+     *
+     * @param toolProtection - Tool protection configuration
+     * @returns Provider name or throws error if not found
+     */
+    private resolveProvider;
+}
+//# sourceMappingURL=tool-context-builder.d.ts.map

package/dist/services/tool-context-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-context-builder.d.ts","sourceRoot":"","sources":["../../src/services/tool-context-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG/D,MAAM,WAAW,wBAAwB;IACvC,4DAA4D;IAC5D,aAAa,EAAE,gBAAgB,CAAC;IAEhC,gEAAgE;IAChE,aAAa,EAAE,kBAAkB,CAAC;IAElC,gEAAgE;IAChE,gBAAgB,EAAE,gBAAgB,CAAC;IAEnC,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAElB,+CAA+C;IAC/C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACpD;AAED;;;;;;GAMG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAEZ;gBAEU,MAAM,EAAE,wBAAwB;IAU5C;;;;;;;;;OASG;IACG,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,cAAc,EAAE,cAAc,GAAG,IAAI,GACpC,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAqE5C;;;;;;;OAOG;YACW,eAAe;CAsB9B"}

package/dist/services/tool-context-builder.js

@@ -0,0 +1,125 @@
+"use strict";
+/**
+ * Tool Context Builder
+ *
+ * Builds ToolExecutionContext for tool handlers by resolving IDP tokens
+ * based on tool protection configuration and user identity.
+ *
+ * @package @kya-os/mcp-i-core
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ToolContextBuilder = void 0;
+const oauth_required_error_js_1 = require("../types/oauth-required-error.js");
+/**
+ * Builder for tool execution context
+ *
+ * Resolves IDP tokens and builds context for tool handlers.
+ * Phase 1: Uses configured provider as temporary fallback.
+ * Phase 2+: Requires explicit oauthProvider on tool protection.
+ */
+class ToolContextBuilder {
+    config;
+    constructor(config) {
+        this.config = {
+            tokenResolver: config.tokenResolver,
+            configService: config.configService,
+            providerResolver: config.providerResolver,
+            projectId: config.projectId,
+            logger: config.logger || (() => { }),
+        };
+    }
+    /**
+     * Build tool execution context
+     *
+     * @param toolName - Name of the tool being executed
+     * @param userDid - User DID (optional, required for OAuth)
+     * @param sessionId - Session ID (optional)
+     * @param delegationToken - Delegation token (optional)
+     * @param toolProtection - Tool protection configuration (optional)
+     * @returns Tool execution context or undefined if not needed
+     */
+    async buildContext(toolName, userDid, sessionId, delegationToken, toolProtection) {
+        // Only build context if tool requires OAuth
+        if (!toolProtection?.requiredScopes?.length || !userDid) {
+            return undefined;
+        }
+        // Phase 2: Resolve provider using ProviderResolver
+        // ProviderResolver handles priority-based resolution with fallbacks
+        let provider;
+        try {
+            provider = await this.resolveProvider(toolProtection);
+        }
+        catch (error) {
+            // Provider resolution failed - cannot build context
+            this.config.logger("[ToolContextBuilder] Provider not resolved", {
+                toolName,
+                userDid: userDid.substring(0, 20) + "...",
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return undefined;
+        }
+        // Resolve IDP token
+        const idpToken = await this.config.tokenResolver.resolveTokenFromDid(userDid, provider, toolProtection.requiredScopes);
+        if (!idpToken) {
+            // Token not available - throw OAuthRequiredError to trigger OAuth flow
+            this.config.logger("[ToolContextBuilder] Token not available, throwing OAuthRequiredError", {
+                toolName,
+                userDid: userDid.substring(0, 20) + "...",
+                provider,
+                scopes: toolProtection.requiredScopes,
+            });
+            // Throw error with provider and scopes info
+            // OAuth URL will be built by the Cloudflare layer (agent.ts)
+            throw new oauth_required_error_js_1.OAuthRequiredError({
+                toolName,
+                requiredScopes: toolProtection.requiredScopes,
+                provider,
+                oauthUrl: "", // Will be populated by Cloudflare layer
+                userDid,
+                sessionId,
+            });
+        }
+        // Build context with token
+        const context = {
+            idpToken,
+            provider,
+            scopes: toolProtection.requiredScopes,
+            userDid,
+            sessionId,
+            delegationToken,
+        };
+        this.config.logger("[ToolContextBuilder] Context built successfully", {
+            toolName,
+            userDid: userDid.substring(0, 20) + "...",
+            provider,
+            hasToken: !!idpToken,
+        });
+        return context;
+    }
+    /**
+     * Resolve OAuth provider for a tool
+     *
+     * Phase 2: Uses ProviderResolver with priority-based resolution
+     *
+     * @param toolProtection - Tool protection configuration
+     * @returns Provider name or throws error if not found
+     */
+    async resolveProvider(toolProtection) {
+        try {
+            const provider = await this.config.providerResolver.resolveProvider(toolProtection, this.config.projectId);
+            this.config.logger("[ToolContextBuilder] Provider resolved", {
+                provider,
+            });
+            return provider;
+        }
+        catch (error) {
+            this.config.logger("[ToolContextBuilder] Provider resolution failed", {
+                error: error instanceof Error ? error.message : String(error),
+                projectId: this.config.projectId,
+            });
+            throw error; // Re-throw to let caller handle
+        }
+    }
+}
+exports.ToolContextBuilder = ToolContextBuilder;
+//# sourceMappingURL=tool-context-builder.js.map

package/dist/services/tool-context-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-context-builder.js","sourceRoot":"","sources":["../../src/services/tool-context-builder.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAOH,8EAAsE;AAmBtE;;;;;;GAMG;AACH,MAAa,kBAAkB;IACrB,MAAM,CAEZ;IAEF,YAAY,MAAgC;QAC1C,IAAI,CAAC,MAAM,GAAG;YACZ,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;SACpC,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,OAA2B,EAC3B,SAA6B,EAC7B,eAAmC,EACnC,cAAqC;QAErC,4CAA4C;QAC5C,IAAI,CAAC,cAAc,EAAE,cAAc,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACxD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,mDAAmD;QACnD,oEAAoE;QACpE,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oDAAoD;YACpD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,4CAA4C,EAAE;gBAC/D,QAAQ;gBACR,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACzC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,oBAAoB;QACpB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAClE,OAAO,EACP,QAAQ,EACR,cAAc,CAAC,cAAc,CAC9B,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,uEAAuE;YACvE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,uEAAuE,EAAE;gBAC1F,QAAQ;gBACR,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACzC,QAAQ;gBACR,MAAM,EAAE,cAAc,CAAC,cAAc;aACtC,CAAC,CAAC;YAEH,4CAA4C;YAC5C,6DAA6D;YAC7D,MAAM,IAAI,4CAAkB,CAAC;gBAC3B,QAAQ;gBACR,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,QAAQ;gBACR,QAAQ,EAAE,EAAE,EAAE,wCAAwC;gBACtD,OAAO;gBACP,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAED,2BAA2B;QAC3B,MAAM,OAAO,GAAyB;YACpC,QAAQ;YACR,QAAQ;YACR,MAAM,EAAE,cAAc,CAAC,cAAc;YACrC,OAAO;YACP,SAAS;YACT,eAAe;SAChB,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,iDAAiD,EAAE;YACpE,QAAQ;YACR,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;YACzC,QAAQ;YACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;SACrB,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,eAAe,CAC3B,cAA8B;QAE9B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,eAAe,CACjE,cAAc,EACd,IAAI,CAAC,MAAM,CAAC,SAAS,CACtB,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,wCAAwC,EAAE;gBAC3D,QAAQ;aACT,CAAC,CAAC;YAEH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,iDAAiD,EAAE;gBACpE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;aACjC,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,CAAC,gCAAgC;QAC/C,CAAC;IACH,CAAC;CACF;AAlID,gDAkIC"}

package/dist/services/tool-protection.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-protection.service.d.ts","sourceRoot":"","sources":["../../src/services/tool-protection.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,2BAA2B,EAE5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAwD7E;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAA8B;IAC5C,OAAO,CAAC,KAAK,CAAsB;gBAEvB,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,mBAAmB;IAK3E;;;OAGG;IACH,YAAY,IAAI,MAAM,GAAG,SAAS;IAIlC;;;;;;;;OAQG;YACW,aAAa;IA4C3B;;;;;;;;;;OAUG;IACG,uBAAuB,CAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,CAAC;IAgWhC;;;;;;OAMG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IA8BjC;;;;;OAKG;YACW,YAAY;IAsG1B;;;;;;;OAOG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAgBlD"}
+{"version":3,"file":"tool-protection.service.d.ts","sourceRoot":"","sources":["../../src/services/tool-protection.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,2BAA2B,EAE5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AA8D7E;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAA8B;IAC5C,OAAO,CAAC,KAAK,CAAsB;gBAEvB,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,mBAAmB;IAK3E;;;OAGG;IACH,YAAY,IAAI,MAAM,GAAG,SAAS;IAIlC;;;;;;;;OAQG;YACW,aAAa;IA4C3B;;;;;;;;;;OAUG;IACG,uBAAuB,CAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,CAAC;IAuYhC;;;;;;OAMG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IA8BjC;;;;;OAKG;YACW,YAAY;IAsG1B;;;;;;;OAOG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAgBlD"}

package/dist/services/tool-protection.service.js

@@ -226,9 +226,18 @@ class ToolProtectionService {
                         toolConfig.required_scopes ??
                         toolConfig.scopes ??
                         [];
+                    // NEW: Parse oauthProvider (camelCase and snake_case support)
+                    const oauthProvider = toolConfig.oauthProvider ??
+                        toolConfig.oauth_provider ??
+                        undefined;
+                    const riskLevel = toolConfig.riskLevel ??
+                        toolConfig.risk_level ??
+                        undefined;
                     toolProtections[toolName] = {
                         requiresDelegation,
                         requiredScopes,
+                        ...(oauthProvider && { oauthProvider }), // Only include if present
+                        ...(riskLevel && { riskLevel }), // Only include if present
                     };
                 }
             }
@@ -252,9 +261,18 @@ class ToolProtectionService {
                             tool.required_scopes ??
                             tool.scopes ??
                             [];
+                        // NEW: Parse oauthProvider
+                        const oauthProvider = tool.oauthProvider ??
+                            tool.oauth_provider ??
+                            undefined;
+                        const riskLevel = tool.riskLevel ??
+                            tool.risk_level ??
+                            undefined;
                         toolProtections[toolName] = {
                             requiresDelegation,
                             requiredScopes,
+                            ...(oauthProvider && { oauthProvider }),
+                            ...(riskLevel && { riskLevel }),
                         };
                     }
                 }
@@ -269,9 +287,18 @@ class ToolProtectionService {
                             toolConfig.required_scopes ??
                             toolConfig.scopes ??
                             [];
+                        // NEW: Parse oauthProvider
+                        const oauthProvider = toolConfig.oauthProvider ??
+                            toolConfig.oauth_provider ??
+                            undefined;
+                        const riskLevel = toolConfig.riskLevel ??
+                            toolConfig.risk_level ??
+                            undefined;
                         toolProtections[toolName] = {
                             requiresDelegation,
                             requiredScopes,
+                            ...(oauthProvider && { oauthProvider }),
+                            ...(riskLevel && { riskLevel }),
                         };
                     }
                 }