@kya-os/mcp-i-core 1.2.3-canary.7 → 1.3.0-canary.clientinfo.20251126003544

package/dist/services/provider-resolver.js

@@ -0,0 +1,120 @@
+"use strict";
+/**
+ * Provider Resolver
+ *
+ * Resolves OAuth provider for tools using priority-based resolution strategy.
+ * Supports Phase 2+ tool-specific providers with backward compatibility for Phase 1.
+ *
+ * @package @kya-os/mcp-i-core
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProviderResolver = void 0;
+/**
+ * Resolves OAuth provider for tools with priority-based fallback strategy
+ *
+ * Priority order:
+ * 1. Tool-specific oauthProvider field (Phase 2+ preferred)
+ * 2. Scope prefix inference (fallback)
+ * 3. First configured provider (Phase 1 compatibility fallback)
+ * 4. Error if no provider can be resolved
+ */
+class ProviderResolver {
+    registry;
+    configService;
+    constructor(registry, configService) {
+        this.registry = registry;
+        this.configService = configService;
+    }
+    /**
+     * Resolve OAuth provider for a tool
+     *
+     * @param toolProtection - Tool protection configuration
+     * @param projectId - Project ID for fetching provider config
+     * @returns Provider name (never null - throws if cannot resolve)
+     * @throws Error if provider cannot be resolved
+     */
+    async resolveProvider(toolProtection, projectId) {
+        // Priority 1: Tool-specific provider (Phase 2+ preferred)
+        if (toolProtection.oauthProvider) {
+            // Ensure registry is loaded before checking
+            if (this.registry.getProviderNames().length === 0) {
+                await this.registry.loadFromAgentShield(projectId);
+            }
+            if (!this.registry.hasProvider(toolProtection.oauthProvider)) {
+                throw new Error(`Provider "${toolProtection.oauthProvider}" not configured for project "${projectId}". ` +
+                    `Add provider in project settings.`);
+            }
+            return toolProtection.oauthProvider;
+        }
+        // Priority 2: Scope prefix inference (fallback)
+        const inferredProvider = this.inferProviderFromScopes(toolProtection.requiredScopes || []);
+        if (inferredProvider) {
+            // Ensure registry is loaded before checking
+            if (this.registry.getProviderNames().length === 0) {
+                await this.registry.loadFromAgentShield(projectId);
+            }
+            if (this.registry.hasProvider(inferredProvider)) {
+                console.log(`[ProviderResolver] Inferred provider "${inferredProvider}" from scopes`);
+                return inferredProvider;
+            }
+        }
+        // Priority 3: First configured provider (Phase 1 compatibility fallback)
+        // Ensure registry is loaded
+        await this.registry.loadFromAgentShield(projectId);
+        const providers = this.registry.getAllProviders();
+        if (providers.length > 0) {
+            // Log deprecation warning for Phase 1 tools
+            const firstProviderName = this.registry.getProviderNames()[0];
+            console.warn(`[ProviderResolver] Tool does not specify oauthProvider. ` +
+                `Using first configured provider "${firstProviderName}" as fallback. ` +
+                `This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.`);
+            return firstProviderName;
+        }
+        // Priority 4: Error if no provider can be resolved
+        throw new Error(`Tool requires OAuth but no provider could be resolved. ` +
+            `Either specify oauthProvider in tool protection config, or configure at least one provider for project "${projectId}".`);
+    }
+    /**
+     * Infer provider from scope prefixes
+     *
+     * Used as Priority 2 fallback when oauthProvider is not specified.
+     * Examples:
+     * - github:repo:read → github
+     * - gmail:read → google
+     * - microsoft:calendar:read → microsoft
+     *
+     * @param scopes - Required scopes for the tool
+     * @returns Provider name if uniquely inferred, null otherwise
+     */
+    inferProviderFromScopes(scopes) {
+        if (!scopes || scopes.length === 0) {
+            return null;
+        }
+        // Extract first part of scope (before first colon)
+        const scopePrefixes = scopes.map((scope) => {
+            const parts = scope.split(":");
+            return parts[0].toLowerCase();
+        });
+        // Provider mapping
+        const providerMap = {
+            github: "github",
+            google: "google",
+            gmail: "google", // gmail:read → google
+            calendar: "google", // calendar:read → google (if ambiguous, use project default)
+            microsoft: "microsoft",
+            outlook: "microsoft",
+            slack: "slack",
+            auth0: "auth0",
+            okta: "okta",
+        };
+        // Find unique provider
+        const providers = new Set(scopePrefixes.map((prefix) => providerMap[prefix]).filter(Boolean));
+        if (providers.size === 1) {
+            return Array.from(providers)[0];
+        }
+        // Ambiguous or no prefix → return null (use project-level provider)
+        return null;
+    }
+}
+exports.ProviderResolver = ProviderResolver;
+//# sourceMappingURL=provider-resolver.js.map

package/dist/services/provider-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-resolver.js","sourceRoot":"","sources":["../../src/services/provider-resolver.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAMH;;;;;;;;GAQG;AACH,MAAa,gBAAgB;IAEjB;IACA;IAFV,YACU,QAA+B,EAC/B,aAAiC;QADjC,aAAQ,GAAR,QAAQ,CAAuB;QAC/B,kBAAa,GAAb,aAAa,CAAoB;IACxC,CAAC;IAEJ;;;;;;;OAOG;IACH,KAAK,CAAC,eAAe,CACnB,cAA8B,EAC9B,SAAiB;QAEjB,0DAA0D;QAC1D,IAAI,cAAc,CAAC,aAAa,EAAE,CAAC;YACjC,4CAA4C;YAC5C,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CACb,aAAa,cAAc,CAAC,aAAa,iCAAiC,SAAS,KAAK;oBACtF,mCAAmC,CACtC,CAAC;YACJ,CAAC;YACD,OAAO,cAAc,CAAC,aAAa,CAAC;QACtC,CAAC;QAED,gDAAgD;QAChD,MAAM,gBAAgB,GAAG,IAAI,CAAC,uBAAuB,CACnD,cAAc,CAAC,cAAc,IAAI,EAAE,CACpC,CAAC;QACF,IAAI,gBAAgB,EAAE,CAAC;YACrB,4CAA4C;YAC5C,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAChD,OAAO,CAAC,GAAG,CACT,yCAAyC,gBAAgB,eAAe,CACzE,CAAC;gBACF,OAAO,gBAAgB,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,4BAA4B;QAC5B,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;QAClD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,4CAA4C;YAC5C,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CACV,0DAA0D;gBACxD,oCAAoC,iBAAiB,iBAAiB;gBACtE,qFAAqF,CACxF,CAAC;YACF,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QAED,mDAAmD;QACnD,MAAM,IAAI,KAAK,CACb,yDAAyD;YACvD,2GAA2G,SAAS,IAAI,CAC3H,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACK,uBAAuB,CAAC,MAAgB;QAC9C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mDAAmD;QACnD,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACzC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,mBAAmB;QACnB,MAAM,WAAW,GAA2B;YAC1C,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,QAAQ,EAAE,sBAAsB;YACvC,QAAQ,EAAE,QAAQ,EAAE,6DAA6D;YACjF,SAAS,EAAE,WAAW;YACtB,OAAO,EAAE,WAAW;YACpB,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,MAAM;SACb,CAAC;QAEF,uBAAuB;QACvB,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CACnE,CAAC;QAEF,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QAED,oEAAoE;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAxHD,4CAwHC"}

package/dist/services/provider-validator.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Provider Validator
+ *
+ * Validates OAuth provider configurations for custom IDP support.
+ * Ensures provider configurations are valid before registration.
+ *
+ * @package @kya-os/mcp-i-core
+ */
+import type { OAuthProvider } from "@kya-os/contracts/config";
+/**
+ * Validation error for provider configuration issues
+ */
+export declare class ProviderValidationError extends Error {
+    readonly field?: string | undefined;
+    constructor(message: string, field?: string | undefined);
+}
+/**
+ * Service for validating OAuth provider configurations
+ */
+export declare class ProviderValidator {
+    /**
+     * Validate provider configuration
+     *
+     * @param provider - Provider configuration to validate
+     * @param name - Provider name (for error messages)
+     * @throws ProviderValidationError if validation fails
+     */
+    validate(provider: OAuthProvider, name: string): void;
+    /**
+     * Validate URL format
+     *
+     * @param url - URL to validate
+     * @param providerName - Provider name (for error messages)
+     * @param fieldName - Field name (for error messages)
+     * @throws ProviderValidationError if URL is invalid
+     */
+    private validateUrl;
+    /**
+     * Validate custom parameters don't override reserved OAuth parameters
+     *
+     * @param customParams - Custom parameters to validate
+     * @param providerName - Provider name (for error messages)
+     * @throws ProviderValidationError if reserved parameter is overridden
+     */
+    private validateCustomParams;
+    /**
+     * Test provider endpoint reachability (optional)
+     *
+     * @param provider - Provider configuration
+     * @param fetchProvider - Fetch implementation
+     * @returns True if endpoint is reachable, false otherwise
+     */
+    testProvider(provider: OAuthProvider, fetchProvider: typeof fetch): Promise<boolean>;
+}
+//# sourceMappingURL=provider-validator.d.ts.map

package/dist/services/provider-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-validator.d.ts","sourceRoot":"","sources":["../../src/services/provider-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAe9D;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aACH,KAAK,CAAC,EAAE,MAAM;gBAA/C,OAAO,EAAE,MAAM,EAAkB,KAAK,CAAC,EAAE,MAAM,YAAA;CAI5D;AAED;;GAEG;AACH,qBAAa,iBAAiB;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IA6CrD;;;;;;;OAOG;IACH,OAAO,CAAC,WAAW;IAoBnB;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAqB5B;;;;;;OAMG;IACG,YAAY,CAChB,QAAQ,EAAE,aAAa,EACvB,aAAa,EAAE,OAAO,KAAK,GAC1B,OAAO,CAAC,OAAO,CAAC;CAYpB"}

package/dist/services/provider-validator.js

@@ -0,0 +1,135 @@
+"use strict";
+/**
+ * Provider Validator
+ *
+ * Validates OAuth provider configurations for custom IDP support.
+ * Ensures provider configurations are valid before registration.
+ *
+ * @package @kya-os/mcp-i-core
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProviderValidator = exports.ProviderValidationError = void 0;
+/**
+ * Reserved OAuth parameters that cannot be overridden by custom parameters
+ */
+const RESERVED_PARAMETERS = [
+    "response_type",
+    "client_id",
+    "redirect_uri",
+    "scope",
+    "state",
+    "code_challenge",
+    "code_challenge_method",
+];
+/**
+ * Validation error for provider configuration issues
+ */
+class ProviderValidationError extends Error {
+    field;
+    constructor(message, field) {
+        super(message);
+        this.field = field;
+        this.name = "ProviderValidationError";
+    }
+}
+exports.ProviderValidationError = ProviderValidationError;
+/**
+ * Service for validating OAuth provider configurations
+ */
+class ProviderValidator {
+    /**
+     * Validate provider configuration
+     *
+     * @param provider - Provider configuration to validate
+     * @param name - Provider name (for error messages)
+     * @throws ProviderValidationError if validation fails
+     */
+    validate(provider, name) {
+        // Validate required fields
+        if (!provider.clientId || provider.clientId.trim().length === 0) {
+            throw new ProviderValidationError(`Provider "${name}" must have a clientId`, "clientId");
+        }
+        if (!provider.authorizationUrl || provider.authorizationUrl.trim().length === 0) {
+            throw new ProviderValidationError(`Provider "${name}" must have an authorizationUrl`, "authorizationUrl");
+        }
+        if (!provider.tokenUrl || provider.tokenUrl.trim().length === 0) {
+            throw new ProviderValidationError(`Provider "${name}" must have a tokenUrl`, "tokenUrl");
+        }
+        // Validate URL formats
+        this.validateUrl(provider.authorizationUrl, name, "authorizationUrl");
+        this.validateUrl(provider.tokenUrl, name, "tokenUrl");
+        if (provider.userInfoUrl) {
+            this.validateUrl(provider.userInfoUrl, name, "userInfoUrl");
+        }
+        // Validate proxy mode requirements
+        if (provider.proxyMode && !provider.requiresClientSecret) {
+            throw new ProviderValidationError(`Provider "${name}" with proxyMode=true must have requiresClientSecret=true`, "proxyMode");
+        }
+        // Validate custom parameters don't conflict with reserved parameters
+        if (provider.customParams) {
+            this.validateCustomParams(provider.customParams, name);
+        }
+    }
+    /**
+     * Validate URL format
+     *
+     * @param url - URL to validate
+     * @param providerName - Provider name (for error messages)
+     * @param fieldName - Field name (for error messages)
+     * @throws ProviderValidationError if URL is invalid
+     */
+    validateUrl(url, providerName, fieldName) {
+        try {
+            const parsedUrl = new URL(url);
+            if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
+                throw new ProviderValidationError(`Provider "${providerName}" ${fieldName} must use HTTP or HTTPS protocol`, fieldName);
+            }
+        }
+        catch (error) {
+            if (error instanceof ProviderValidationError) {
+                throw error;
+            }
+            throw new ProviderValidationError(`Provider "${providerName}" ${fieldName} is not a valid URL: ${error instanceof Error ? error.message : String(error)}`, fieldName);
+        }
+    }
+    /**
+     * Validate custom parameters don't override reserved OAuth parameters
+     *
+     * @param customParams - Custom parameters to validate
+     * @param providerName - Provider name (for error messages)
+     * @throws ProviderValidationError if reserved parameter is overridden
+     */
+    validateCustomParams(customParams, providerName) {
+        for (const [key, value] of Object.entries(customParams)) {
+            const normalizedKey = key.toLowerCase();
+            if (RESERVED_PARAMETERS.includes(normalizedKey)) {
+                throw new ProviderValidationError(`Provider "${providerName}" custom parameter "${key}" conflicts with reserved OAuth parameter. Reserved parameters: ${RESERVED_PARAMETERS.join(", ")}`, `customParams.${key}`);
+            }
+            if (!value || value.trim().length === 0) {
+                throw new ProviderValidationError(`Provider "${providerName}" custom parameter "${key}" has empty value`, `customParams.${key}`);
+            }
+        }
+    }
+    /**
+     * Test provider endpoint reachability (optional)
+     *
+     * @param provider - Provider configuration
+     * @param fetchProvider - Fetch implementation
+     * @returns True if endpoint is reachable, false otherwise
+     */
+    async testProvider(provider, fetchProvider) {
+        try {
+            // Test authorization URL (HEAD request to avoid triggering OAuth flow)
+            const authResponse = await fetchProvider(provider.authorizationUrl, {
+                method: "HEAD",
+                signal: AbortSignal.timeout(5000), // 5 second timeout
+            });
+            return authResponse.ok || authResponse.status === 405; // 405 Method Not Allowed is OK
+        }
+        catch (error) {
+            return false;
+        }
+    }
+}
+exports.ProviderValidator = ProviderValidator;
+//# sourceMappingURL=provider-validator.js.map

package/dist/services/provider-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-validator.js","sourceRoot":"","sources":["../../src/services/provider-validator.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAIH;;GAEG;AACH,MAAM,mBAAmB,GAAG;IAC1B,eAAe;IACf,WAAW;IACX,cAAc;IACd,OAAO;IACP,OAAO;IACP,gBAAgB;IAChB,uBAAuB;CACf,CAAC;AAEX;;GAEG;AACH,MAAa,uBAAwB,SAAQ,KAAK;IACH;IAA7C,YAAY,OAAe,EAAkB,KAAc;QACzD,KAAK,CAAC,OAAO,CAAC,CAAC;QAD4B,UAAK,GAAL,KAAK,CAAS;QAEzD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AALD,0DAKC;AAED;;GAEG;AACH,MAAa,iBAAiB;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAuB,EAAE,IAAY;QAC5C,2BAA2B;QAC3B,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,uBAAuB,CAC/B,aAAa,IAAI,wBAAwB,EACzC,UAAU,CACX,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,gBAAgB,IAAI,QAAQ,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,uBAAuB,CAC/B,aAAa,IAAI,iCAAiC,EAClD,kBAAkB,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,uBAAuB,CAC/B,aAAa,IAAI,wBAAwB,EACzC,UAAU,CACX,CAAC;QACJ,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;QACtE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAEtD,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAC9D,CAAC;QAED,mCAAmC;QACnC,IAAI,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC;YACzD,MAAM,IAAI,uBAAuB,CAC/B,aAAa,IAAI,2DAA2D,EAC5E,WAAW,CACZ,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1B,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,WAAW,CAAC,GAAW,EAAE,YAAoB,EAAE,SAAiB;QACtE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACtE,MAAM,IAAI,uBAAuB,CAC/B,aAAa,YAAY,KAAK,SAAS,kCAAkC,EACzE,SAAS,CACV,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;gBAC7C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,aAAa,YAAY,KAAK,SAAS,wBAAwB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACvH,SAAS,CACV,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,oBAAoB,CAC1B,YAAoC,EACpC,YAAoB;QAEpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACxD,MAAM,aAAa,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YACxC,IAAI,mBAAmB,CAAC,QAAQ,CAAC,aAAoB,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,uBAAuB,CAC/B,aAAa,YAAY,uBAAuB,GAAG,mEAAmE,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACtJ,gBAAgB,GAAG,EAAE,CACtB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,uBAAuB,CAC/B,aAAa,YAAY,uBAAuB,GAAG,mBAAmB,EACtE,gBAAgB,GAAG,EAAE,CACtB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAChB,QAAuB,EACvB,aAA2B;QAE3B,IAAI,CAAC;YACH,uEAAuE;YACvE,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,gBAAgB,EAAE;gBAClE,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,mBAAmB;aACvD,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,EAAE,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,+BAA+B;QACxF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAnID,8CAmIC"}

package/dist/services/session-registration.service.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Session Registration Service
+ *
+ * Registers MCP sessions with the AgentShield dashboard, enabling
+ * visibility into which MCP clients are connecting to agents.
+ *
+ * This is a fire-and-forget service - session registration should not
+ * block tool execution or affect the user experience.
+ *
+ * @package @kya-os/mcp-i-core
+ */
+import type { RegisterSessionRequest } from "@kya-os/contracts/agentshield-api";
+import type { FetchProvider } from "../providers/base.js";
+/**
+ * Configuration for the session registration service
+ */
+export interface SessionRegistrationServiceConfig {
+    /** Base URL for the AgentShield API (e.g., "https://kya.vouched.id") */
+    baseUrl: string;
+    /** API key for authentication */
+    apiKey: string;
+    /** Fetch provider for making HTTP requests (platform-agnostic) */
+    fetchProvider: FetchProvider;
+    /** Optional logger callback for diagnostics */
+    logger?: (message: string, data?: unknown) => void;
+    /** Timeout in milliseconds for the registration request (default: 5000) */
+    timeoutMs?: number;
+}
+/**
+ * Result of a session registration attempt
+ */
+export interface SessionRegistrationResult {
+    /** Whether registration was successful */
+    success: boolean;
+    /** Session ID that was registered */
+    sessionId: string;
+    /** Error message if registration failed */
+    error?: string;
+}
+/**
+ * Session Registration Service
+ *
+ * Registers MCP sessions with AgentShield for dashboard visibility.
+ * Designed to be non-blocking - failures are logged but don't throw.
+ */
+export declare class SessionRegistrationService {
+    private config;
+    constructor(config: SessionRegistrationServiceConfig);
+    /**
+     * Register a session with AgentShield
+     *
+     * This is a fire-and-forget operation. Failures are logged but don't throw.
+     * The method returns quickly and doesn't block the caller.
+     *
+     * @param request - Session registration request data
+     * @returns Result indicating success or failure
+     */
+    registerSession(request: RegisterSessionRequest): Promise<SessionRegistrationResult>;
+    /**
+     * Fire-and-forget session registration
+     *
+     * Starts registration in the background without waiting for completion.
+     * Useful when you want to register a session but not delay the response.
+     *
+     * @param request - Session registration request data
+     */
+    registerSessionAsync(request: RegisterSessionRequest): void;
+}
+/**
+ * Create a session registration service from common runtime config
+ *
+ * Helper function to create the service from typical environment config.
+ */
+export declare function createSessionRegistrationService(options: {
+    apiUrl: string;
+    apiKey: string;
+    fetchProvider: FetchProvider;
+    logger?: (message: string, data?: unknown) => void;
+}): SessionRegistrationService | null;
+//# sourceMappingURL=session-registration.service.d.ts.map

package/dist/services/session-registration.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-registration.service.d.ts","sourceRoot":"","sources":["../../src/services/session-registration.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EACV,sBAAsB,EAEvB,MAAM,mCAAmC,CAAC;AAM3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAEhB,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;IAEf,kEAAkE;IAClE,aAAa,EAAE,aAAa,CAAC;IAE7B,+CAA+C;IAC/C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAEnD,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,MAAM,CAKZ;gBAEU,MAAM,EAAE,gCAAgC;IAUpD;;;;;;;;OAQG;IACG,eAAe,CACnB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,yBAAyB,CAAC;IA6GrC;;;;;;;OAOG;IACH,oBAAoB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI;CAW5D;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACpD,GAAG,0BAA0B,GAAG,IAAI,CAmBpC"}

package/dist/services/session-registration.service.js

@@ -0,0 +1,172 @@
+"use strict";
+/**
+ * Session Registration Service
+ *
+ * Registers MCP sessions with the AgentShield dashboard, enabling
+ * visibility into which MCP clients are connecting to agents.
+ *
+ * This is a fire-and-forget service - session registration should not
+ * block tool execution or affect the user experience.
+ *
+ * @package @kya-os/mcp-i-core
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionRegistrationService = void 0;
+exports.createSessionRegistrationService = createSessionRegistrationService;
+const agentshield_api_1 = require("@kya-os/contracts/agentshield-api");
+/**
+ * Session Registration Service
+ *
+ * Registers MCP sessions with AgentShield for dashboard visibility.
+ * Designed to be non-blocking - failures are logged but don't throw.
+ */
+class SessionRegistrationService {
+    config;
+    constructor(config) {
+        this.config = {
+            baseUrl: config.baseUrl,
+            apiKey: config.apiKey,
+            fetchProvider: config.fetchProvider,
+            logger: config.logger || (() => { }),
+            timeoutMs: config.timeoutMs ?? 5000,
+        };
+    }
+    /**
+     * Register a session with AgentShield
+     *
+     * This is a fire-and-forget operation. Failures are logged but don't throw.
+     * The method returns quickly and doesn't block the caller.
+     *
+     * @param request - Session registration request data
+     * @returns Result indicating success or failure
+     */
+    async registerSession(request) {
+        const sessionId = request.session_id;
+        try {
+            // Validate request
+            const validationResult = agentshield_api_1.registerSessionRequestSchema.safeParse(request);
+            if (!validationResult.success) {
+                const errorMsg = `Invalid session registration request: ${validationResult.error.message}`;
+                this.config.logger("[SessionRegistration] Validation failed", {
+                    sessionId,
+                    error: errorMsg,
+                });
+                return { success: false, sessionId, error: errorMsg };
+            }
+            const url = `${this.config.baseUrl}${agentshield_api_1.AGENTSHIELD_ENDPOINTS.SESSIONS}`;
+            this.config.logger("[SessionRegistration] Registering session", {
+                sessionId,
+                agentDid: request.agent_did,
+                clientName: request.client_info.name,
+                url,
+            });
+            // Make the request with timeout
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), this.config.timeoutMs);
+            try {
+                const response = await this.config.fetchProvider.fetch(url, {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/json",
+                        Authorization: `Bearer ${this.config.apiKey}`,
+                    },
+                    body: JSON.stringify(request),
+                    signal: controller.signal,
+                });
+                clearTimeout(timeoutId);
+                if (!response.ok) {
+                    // Log error but don't throw - this is fire-and-forget
+                    const errorText = await response.text().catch(() => "Unknown error");
+                    this.config.logger("[SessionRegistration] Registration failed", {
+                        sessionId,
+                        status: response.status,
+                        error: errorText,
+                    });
+                    return {
+                        success: false,
+                        sessionId,
+                        error: `HTTP ${response.status}: ${errorText}`,
+                    };
+                }
+                // Parse response
+                const responseData = (await response.json());
+                const parseResult = agentshield_api_1.registerSessionResponseSchema.safeParse(responseData.data || responseData);
+                if (!parseResult.success) {
+                    this.config.logger("[SessionRegistration] Invalid response format", {
+                        sessionId,
+                        response: responseData,
+                    });
+                    // Still consider it a success if we got a 200 OK
+                    return { success: true, sessionId };
+                }
+                this.config.logger("[SessionRegistration] Session registered", {
+                    sessionId,
+                    registered: parseResult.data.registered,
+                });
+                return { success: true, sessionId };
+            }
+            finally {
+                clearTimeout(timeoutId);
+            }
+        }
+        catch (error) {
+            // Handle abort/timeout
+            if (error instanceof Error && error.name === "AbortError") {
+                this.config.logger("[SessionRegistration] Request timed out", {
+                    sessionId,
+                    timeoutMs: this.config.timeoutMs,
+                });
+                return { success: false, sessionId, error: "Request timed out" };
+            }
+            // Log any other error
+            const errorMsg = error instanceof Error ? error.message : "Unknown error";
+            this.config.logger("[SessionRegistration] Unexpected error", {
+                sessionId,
+                error: errorMsg,
+            });
+            return { success: false, sessionId, error: errorMsg };
+        }
+    }
+    /**
+     * Fire-and-forget session registration
+     *
+     * Starts registration in the background without waiting for completion.
+     * Useful when you want to register a session but not delay the response.
+     *
+     * @param request - Session registration request data
+     */
+    registerSessionAsync(request) {
+        // Start registration in background - don't await
+        this.registerSession(request).catch((error) => {
+            // This should never happen since registerSession catches all errors,
+            // but just in case
+            this.config.logger("[SessionRegistration] Background registration failed", {
+                sessionId: request.session_id,
+                error: error instanceof Error ? error.message : "Unknown error",
+            });
+        });
+    }
+}
+exports.SessionRegistrationService = SessionRegistrationService;
+/**
+ * Create a session registration service from common runtime config
+ *
+ * Helper function to create the service from typical environment config.
+ */
+function createSessionRegistrationService(options) {
+    // Validate required config
+    if (!options.apiUrl || !options.apiKey) {
+        options.logger?.("[SessionRegistration] Missing required config - session registration disabled", {
+            hasApiUrl: !!options.apiUrl,
+            hasApiKey: !!options.apiKey,
+        });
+        return null;
+    }
+    return new SessionRegistrationService({
+        baseUrl: options.apiUrl,
+        apiKey: options.apiKey,
+        fetchProvider: options.fetchProvider,
+        logger: options.logger,
+    });
+}
+//# sourceMappingURL=session-registration.service.js.map

package/dist/services/session-registration.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-registration.service.js","sourceRoot":"","sources":["../../src/services/session-registration.service.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAuNH,4EAwBC;AAzOD,uEAI2C;AAmC3C;;;;;GAKG;AACH,MAAa,0BAA0B;IAC7B,MAAM,CAKZ;IAEF,YAAY,MAAwC;QAClD,IAAI,CAAC,MAAM,GAAG;YACZ,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;YACnC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;SACpC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CACnB,OAA+B;QAE/B,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;QAErC,IAAI,CAAC;YACH,mBAAmB;YACnB,MAAM,gBAAgB,GAAG,8CAA4B,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACzE,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,yCAAyC,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC3F,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,yCAAyC,EAAE;oBAC5D,SAAS;oBACT,KAAK,EAAE,QAAQ;iBAChB,CAAC,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;YACxD,CAAC;YAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,uCAAqB,CAAC,QAAQ,EAAE,CAAC;YAEtE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,2CAA2C,EAAE;gBAC9D,SAAS;gBACT,QAAQ,EAAE,OAAO,CAAC,SAAS;gBAC3B,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI;gBACpC,GAAG;aACJ,CAAC,CAAC;YAEH,gCAAgC;YAChC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAC1B,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,IAAI,CAAC,MAAM,CAAC,SAAS,CACtB,CAAC;YAEF,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE;oBAC1D,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;qBAC9C;oBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;oBAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,YAAY,CAAC,SAAS,CAAC,CAAC;gBAExB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,sDAAsD;oBACtD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;oBACrE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,2CAA2C,EAAE;wBAC9D,SAAS;wBACT,MAAM,EAAE,QAAQ,CAAC,MAAM;wBACvB,KAAK,EAAE,SAAS;qBACjB,CAAC,CAAC;oBACH,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,SAAS;wBACT,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE;qBAC/C,CAAC;gBACJ,CAAC;gBAED,iBAAiB;gBACjB,MAAM,YAAY,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAEhB,CAAC;gBAC5B,MAAM,WAAW,GAAG,+CAA6B,CAAC,SAAS,CACzD,YAAY,CAAC,IAAI,IAAI,YAAY,CAClC,CAAC;gBAEF,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;oBACzB,IAAI,CAAC,MAAM,CAAC,MAAM,CAChB,+CAA+C,EAC/C;wBACE,SAAS;wBACT,QAAQ,EAAE,YAAY;qBACvB,CACF,CAAC;oBACF,iDAAiD;oBACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;gBACtC,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,0CAA0C,EAAE;oBAC7D,SAAS;oBACT,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,UAAU;iBACxC,CAAC,CAAC;gBAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YACtC,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uBAAuB;YACvB,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,yCAAyC,EAAE;oBAC5D,SAAS;oBACT,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;iBACjC,CAAC,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;YACnE,CAAC;YAED,sBAAsB;YACtB,MAAM,QAAQ,GACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,wCAAwC,EAAE;gBAC3D,SAAS;gBACT,KAAK,EAAE,QAAQ;aAChB,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,oBAAoB,CAAC,OAA+B;QAClD,iDAAiD;QACjD,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAC5C,qEAAqE;YACrE,mBAAmB;YACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,sDAAsD,EAAE;gBACzE,SAAS,EAAE,OAAO,CAAC,UAAU;gBAC7B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;aAChE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AA7JD,gEA6JC;AAED;;;;GAIG;AACH,SAAgB,gCAAgC,CAAC,OAKhD;IACC,2BAA2B;IAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACvC,OAAO,CAAC,MAAM,EAAE,CACd,+EAA+E,EAC/E;YACE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM;YAC3B,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM;SAC5B,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,0BAA0B,CAAC;QACpC,OAAO,EAAE,OAAO,CAAC,MAAM;QACvB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;AACL,CAAC"}

package/dist/services/tool-context-builder.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Tool Context Builder
+ *
+ * Builds ToolExecutionContext for tool handlers by resolving IDP tokens
+ * based on tool protection configuration and user identity.
+ *
+ * @package @kya-os/mcp-i-core
+ */
+import type { ToolExecutionContext } from "@kya-os/contracts/config";
+import type { IdpTokenResolver } from "../identity/idp-token-resolver.js";
+import type { ToolProtection } from "../types/tool-protection.js";
+import type { OAuthConfigService } from "./oauth-config.service.js";
+import type { ProviderResolver } from "./provider-resolver.js";
+export interface ToolContextBuilderConfig {
+    /** IDP token resolver for resolving tokens from User DID */
+    tokenResolver: IdpTokenResolver;
+    /** OAuth config service for fetching provider configurations */
+    configService: OAuthConfigService;
+    /** Provider resolver for resolving OAuth providers for tools */
+    providerResolver: ProviderResolver;
+    /** Project ID for fetching OAuth config */
+    projectId: string;
+    /** Optional logger callback for diagnostics */
+    logger?: (message: string, data?: unknown) => void;
+}
+/**
+ * Builder for tool execution context
+ *
+ * Resolves IDP tokens and builds context for tool handlers.
+ * Phase 1: Uses configured provider as temporary fallback.
+ * Phase 2+: Requires explicit oauthProvider on tool protection.
+ */
+export declare class ToolContextBuilder {
+    private config;
+    constructor(config: ToolContextBuilderConfig);
+    /**
+     * Build tool execution context
+     *
+     * @param toolName - Name of the tool being executed
+     * @param userDid - User DID (optional, required for OAuth)
+     * @param sessionId - Session ID (optional)
+     * @param delegationToken - Delegation token (optional)
+     * @param toolProtection - Tool protection configuration (optional)
+     * @returns Tool execution context or undefined if not needed
+     */
+    buildContext(toolName: string, userDid: string | undefined, sessionId: string | undefined, delegationToken: string | undefined, toolProtection: ToolProtection | null): Promise<ToolExecutionContext | undefined>;
+    /**
+     * Resolve OAuth provider for a tool
+     *
+     * Phase 2: Uses ProviderResolver with priority-based resolution
+     *
+     * @param toolProtection - Tool protection configuration
+     * @returns Provider name or throws error if not found
+     */
+    private resolveProvider;
+}
+//# sourceMappingURL=tool-context-builder.d.ts.map

package/dist/services/tool-context-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-context-builder.d.ts","sourceRoot":"","sources":["../../src/services/tool-context-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG/D,MAAM,WAAW,wBAAwB;IACvC,4DAA4D;IAC5D,aAAa,EAAE,gBAAgB,CAAC;IAEhC,gEAAgE;IAChE,aAAa,EAAE,kBAAkB,CAAC;IAElC,gEAAgE;IAChE,gBAAgB,EAAE,gBAAgB,CAAC;IAEnC,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAElB,+CAA+C;IAC/C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACpD;AAED;;;;;;GAMG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAEZ;gBAEU,MAAM,EAAE,wBAAwB;IAU5C;;;;;;;;;OASG;IACG,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,cAAc,EAAE,cAAc,GAAG,IAAI,GACpC,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAqE5C;;;;;;;OAOG;YACW,eAAe;CAsB9B"}