@kya-os/mcp-i-core 1.2.3-canary.7 → 1.3.0-canary.clientinfo.20251126003544

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (239) hide show
  1. package/.turbo/turbo-build.log +4 -0
  2. package/.turbo/turbo-test$colon$coverage.log +4239 -0
  3. package/.turbo/turbo-test.log +2973 -0
  4. package/COMPLIANCE_IMPROVEMENT_REPORT.md +483 -0
  5. package/Composer 3.md +615 -0
  6. package/GPT-5.md +1169 -0
  7. package/OPUS-plan.md +352 -0
  8. package/PHASE_3_AND_4.1_SUMMARY.md +585 -0
  9. package/PHASE_3_SUMMARY.md +317 -0
  10. package/PHASE_4.1.3_SUMMARY.md +428 -0
  11. package/PHASE_4.1_COMPLETE.md +525 -0
  12. package/PHASE_4_USER_DID_IDENTITY_LINKING_PLAN.md +1240 -0
  13. package/SCHEMA_COMPLIANCE_REPORT.md +275 -0
  14. package/TEST_PLAN.md +571 -0
  15. package/coverage/coverage-final.json +57 -0
  16. package/dist/__tests__/utils/mock-providers.d.ts +1 -2
  17. package/dist/__tests__/utils/mock-providers.d.ts.map +1 -1
  18. package/dist/__tests__/utils/mock-providers.js.map +1 -1
  19. package/dist/cache/oauth-config-cache.d.ts +69 -0
  20. package/dist/cache/oauth-config-cache.d.ts.map +1 -0
  21. package/dist/cache/oauth-config-cache.js +76 -0
  22. package/dist/cache/oauth-config-cache.js.map +1 -0
  23. package/dist/identity/idp-token-resolver.d.ts +53 -0
  24. package/dist/identity/idp-token-resolver.d.ts.map +1 -0
  25. package/dist/identity/idp-token-resolver.js +108 -0
  26. package/dist/identity/idp-token-resolver.js.map +1 -0
  27. package/dist/identity/idp-token-storage.interface.d.ts +42 -0
  28. package/dist/identity/idp-token-storage.interface.d.ts.map +1 -0
  29. package/dist/identity/idp-token-storage.interface.js +12 -0
  30. package/dist/identity/idp-token-storage.interface.js.map +1 -0
  31. package/dist/identity/user-did-manager.d.ts +39 -1
  32. package/dist/identity/user-did-manager.d.ts.map +1 -1
  33. package/dist/identity/user-did-manager.js +69 -3
  34. package/dist/identity/user-did-manager.js.map +1 -1
  35. package/dist/index.d.ts +24 -0
  36. package/dist/index.d.ts.map +1 -1
  37. package/dist/index.js +43 -1
  38. package/dist/index.js.map +1 -1
  39. package/dist/runtime/audit-logger.d.ts +37 -0
  40. package/dist/runtime/audit-logger.d.ts.map +1 -0
  41. package/dist/runtime/audit-logger.js +9 -0
  42. package/dist/runtime/audit-logger.js.map +1 -0
  43. package/dist/runtime/base.d.ts +58 -2
  44. package/dist/runtime/base.d.ts.map +1 -1
  45. package/dist/runtime/base.js +266 -11
  46. package/dist/runtime/base.js.map +1 -1
  47. package/dist/services/access-control.service.d.ts.map +1 -1
  48. package/dist/services/access-control.service.js +200 -35
  49. package/dist/services/access-control.service.js.map +1 -1
  50. package/dist/services/authorization/authorization-registry.d.ts +29 -0
  51. package/dist/services/authorization/authorization-registry.d.ts.map +1 -0
  52. package/dist/services/authorization/authorization-registry.js +57 -0
  53. package/dist/services/authorization/authorization-registry.js.map +1 -0
  54. package/dist/services/authorization/types.d.ts +53 -0
  55. package/dist/services/authorization/types.d.ts.map +1 -0
  56. package/dist/services/authorization/types.js +10 -0
  57. package/dist/services/authorization/types.js.map +1 -0
  58. package/dist/services/batch-delegation.service.d.ts +53 -0
  59. package/dist/services/batch-delegation.service.d.ts.map +1 -0
  60. package/dist/services/batch-delegation.service.js +95 -0
  61. package/dist/services/batch-delegation.service.js.map +1 -0
  62. package/dist/services/index.d.ts +2 -0
  63. package/dist/services/index.d.ts.map +1 -1
  64. package/dist/services/index.js +4 -1
  65. package/dist/services/index.js.map +1 -1
  66. package/dist/services/oauth-config.service.d.ts +53 -0
  67. package/dist/services/oauth-config.service.d.ts.map +1 -0
  68. package/dist/services/oauth-config.service.js +117 -0
  69. package/dist/services/oauth-config.service.js.map +1 -0
  70. package/dist/services/oauth-provider-registry.d.ts +77 -0
  71. package/dist/services/oauth-provider-registry.d.ts.map +1 -0
  72. package/dist/services/oauth-provider-registry.js +112 -0
  73. package/dist/services/oauth-provider-registry.js.map +1 -0
  74. package/dist/services/oauth-service.d.ts +77 -0
  75. package/dist/services/oauth-service.d.ts.map +1 -0
  76. package/dist/services/oauth-service.js +348 -0
  77. package/dist/services/oauth-service.js.map +1 -0
  78. package/dist/services/oauth-token-retrieval.service.d.ts +49 -0
  79. package/dist/services/oauth-token-retrieval.service.d.ts.map +1 -0
  80. package/dist/services/oauth-token-retrieval.service.js +150 -0
  81. package/dist/services/oauth-token-retrieval.service.js.map +1 -0
  82. package/dist/services/provider-resolver.d.ts +48 -0
  83. package/dist/services/provider-resolver.d.ts.map +1 -0
  84. package/dist/services/provider-resolver.js +120 -0
  85. package/dist/services/provider-resolver.js.map +1 -0
  86. package/dist/services/provider-validator.d.ts +55 -0
  87. package/dist/services/provider-validator.d.ts.map +1 -0
  88. package/dist/services/provider-validator.js +135 -0
  89. package/dist/services/provider-validator.js.map +1 -0
  90. package/dist/services/session-registration.service.d.ts +80 -0
  91. package/dist/services/session-registration.service.d.ts.map +1 -0
  92. package/dist/services/session-registration.service.js +172 -0
  93. package/dist/services/session-registration.service.js.map +1 -0
  94. package/dist/services/tool-context-builder.d.ts +57 -0
  95. package/dist/services/tool-context-builder.d.ts.map +1 -0
  96. package/dist/services/tool-context-builder.js +125 -0
  97. package/dist/services/tool-context-builder.js.map +1 -0
  98. package/dist/services/tool-protection.service.d.ts +87 -10
  99. package/dist/services/tool-protection.service.d.ts.map +1 -1
  100. package/dist/services/tool-protection.service.js +282 -112
  101. package/dist/services/tool-protection.service.js.map +1 -1
  102. package/dist/types/oauth-required-error.d.ts +40 -0
  103. package/dist/types/oauth-required-error.d.ts.map +1 -0
  104. package/dist/types/oauth-required-error.js +40 -0
  105. package/dist/types/oauth-required-error.js.map +1 -0
  106. package/dist/utils/did-helpers.d.ts +33 -0
  107. package/dist/utils/did-helpers.d.ts.map +1 -1
  108. package/dist/utils/did-helpers.js +40 -0
  109. package/dist/utils/did-helpers.js.map +1 -1
  110. package/dist/utils/index.d.ts +1 -0
  111. package/dist/utils/index.d.ts.map +1 -1
  112. package/dist/utils/index.js +1 -0
  113. package/dist/utils/index.js.map +1 -1
  114. package/docs/API_REFERENCE.md +1362 -0
  115. package/docs/COMPLIANCE_MATRIX.md +691 -0
  116. package/docs/STATUSLIST2021_GUIDE.md +696 -0
  117. package/docs/W3C_VC_DELEGATION_GUIDE.md +710 -0
  118. package/package.json +24 -50
  119. package/scripts/audit-compliance.ts +724 -0
  120. package/src/__tests__/cache/tool-protection-cache.test.ts +640 -0
  121. package/src/__tests__/config/provider-runtime-config.test.ts +309 -0
  122. package/src/__tests__/delegation-e2e.test.ts +690 -0
  123. package/src/__tests__/identity/user-did-manager.test.ts +213 -0
  124. package/src/__tests__/index.test.ts +56 -0
  125. package/src/__tests__/integration/full-flow.test.ts +776 -0
  126. package/src/__tests__/integration.test.ts +281 -0
  127. package/src/__tests__/providers/base.test.ts +173 -0
  128. package/src/__tests__/providers/memory.test.ts +319 -0
  129. package/src/__tests__/regression/phase2-regression.test.ts +427 -0
  130. package/src/__tests__/runtime/audit-logger.test.ts +154 -0
  131. package/src/__tests__/runtime/base-extensions.test.ts +593 -0
  132. package/src/__tests__/runtime/base.test.ts +869 -0
  133. package/src/__tests__/runtime/delegation-flow.test.ts +164 -0
  134. package/src/__tests__/runtime/proof-client-did.test.ts +375 -0
  135. package/src/__tests__/runtime/route-interception.test.ts +686 -0
  136. package/src/__tests__/runtime/tool-protection-enforcement.test.ts +908 -0
  137. package/src/__tests__/services/agentshield-integration.test.ts +784 -0
  138. package/src/__tests__/services/provider-resolver-edge-cases.test.ts +487 -0
  139. package/src/__tests__/services/tool-protection-oauth-provider.test.ts +480 -0
  140. package/src/__tests__/services/tool-protection.service.test.ts +1366 -0
  141. package/src/__tests__/utils/mock-providers.ts +340 -0
  142. package/src/cache/oauth-config-cache.d.ts +69 -0
  143. package/src/cache/oauth-config-cache.d.ts.map +1 -0
  144. package/src/cache/oauth-config-cache.js +71 -0
  145. package/src/cache/oauth-config-cache.js.map +1 -0
  146. package/src/cache/oauth-config-cache.ts +123 -0
  147. package/src/cache/tool-protection-cache.ts +171 -0
  148. package/src/compliance/EXAMPLE.md +412 -0
  149. package/src/compliance/__tests__/schema-verifier.test.ts +797 -0
  150. package/src/compliance/index.ts +8 -0
  151. package/src/compliance/schema-registry.ts +460 -0
  152. package/src/compliance/schema-verifier.ts +708 -0
  153. package/src/config/__tests__/remote-config.spec.ts +268 -0
  154. package/src/config/remote-config.ts +174 -0
  155. package/src/config.ts +309 -0
  156. package/src/delegation/__tests__/audience-validator.test.ts +112 -0
  157. package/src/delegation/__tests__/bitstring.test.ts +346 -0
  158. package/src/delegation/__tests__/cascading-revocation.test.ts +628 -0
  159. package/src/delegation/__tests__/delegation-graph.test.ts +584 -0
  160. package/src/delegation/__tests__/utils.test.ts +152 -0
  161. package/src/delegation/__tests__/vc-issuer.test.ts +442 -0
  162. package/src/delegation/__tests__/vc-verifier.test.ts +922 -0
  163. package/src/delegation/audience-validator.ts +52 -0
  164. package/src/delegation/bitstring.ts +278 -0
  165. package/src/delegation/cascading-revocation.ts +370 -0
  166. package/src/delegation/delegation-graph.ts +299 -0
  167. package/src/delegation/index.ts +14 -0
  168. package/src/delegation/statuslist-manager.ts +353 -0
  169. package/src/delegation/storage/__tests__/memory-graph-storage.test.ts +366 -0
  170. package/src/delegation/storage/__tests__/memory-statuslist-storage.test.ts +228 -0
  171. package/src/delegation/storage/index.ts +9 -0
  172. package/src/delegation/storage/memory-graph-storage.ts +178 -0
  173. package/src/delegation/storage/memory-statuslist-storage.ts +77 -0
  174. package/src/delegation/utils.ts +42 -0
  175. package/src/delegation/vc-issuer.ts +232 -0
  176. package/src/delegation/vc-verifier.ts +568 -0
  177. package/src/identity/idp-token-resolver.ts +147 -0
  178. package/src/identity/idp-token-storage.interface.ts +59 -0
  179. package/src/identity/user-did-manager.ts +370 -0
  180. package/src/index.ts +271 -0
  181. package/src/providers/base.d.ts +91 -0
  182. package/src/providers/base.d.ts.map +1 -0
  183. package/src/providers/base.js +38 -0
  184. package/src/providers/base.js.map +1 -0
  185. package/src/providers/base.ts +96 -0
  186. package/src/providers/memory.ts +142 -0
  187. package/src/runtime/audit-logger.ts +39 -0
  188. package/src/runtime/base.ts +1329 -0
  189. package/src/services/__tests__/access-control.integration.test.ts +443 -0
  190. package/src/services/__tests__/access-control.proof-response-validation.test.ts +578 -0
  191. package/src/services/__tests__/access-control.service.test.ts +970 -0
  192. package/src/services/__tests__/batch-delegation.service.test.ts +351 -0
  193. package/src/services/__tests__/crypto.service.test.ts +531 -0
  194. package/src/services/__tests__/oauth-provider-registry.test.ts +142 -0
  195. package/src/services/__tests__/proof-verifier.integration.test.ts +485 -0
  196. package/src/services/__tests__/proof-verifier.test.ts +489 -0
  197. package/src/services/__tests__/provider-resolution.integration.test.ts +198 -0
  198. package/src/services/__tests__/provider-resolver.test.ts +217 -0
  199. package/src/services/__tests__/storage.service.test.ts +358 -0
  200. package/src/services/access-control.service.ts +990 -0
  201. package/src/services/authorization/authorization-registry.ts +66 -0
  202. package/src/services/authorization/types.ts +71 -0
  203. package/src/services/batch-delegation.service.ts +137 -0
  204. package/src/services/crypto.service.ts +302 -0
  205. package/src/services/errors.ts +76 -0
  206. package/src/services/index.ts +18 -0
  207. package/src/services/oauth-config.service.d.ts +53 -0
  208. package/src/services/oauth-config.service.d.ts.map +1 -0
  209. package/src/services/oauth-config.service.js +113 -0
  210. package/src/services/oauth-config.service.js.map +1 -0
  211. package/src/services/oauth-config.service.ts +166 -0
  212. package/src/services/oauth-provider-registry.d.ts +57 -0
  213. package/src/services/oauth-provider-registry.d.ts.map +1 -0
  214. package/src/services/oauth-provider-registry.js +73 -0
  215. package/src/services/oauth-provider-registry.js.map +1 -0
  216. package/src/services/oauth-provider-registry.ts +123 -0
  217. package/src/services/oauth-service.ts +510 -0
  218. package/src/services/oauth-token-retrieval.service.ts +245 -0
  219. package/src/services/proof-verifier.ts +478 -0
  220. package/src/services/provider-resolver.d.ts +48 -0
  221. package/src/services/provider-resolver.d.ts.map +1 -0
  222. package/src/services/provider-resolver.js +106 -0
  223. package/src/services/provider-resolver.js.map +1 -0
  224. package/src/services/provider-resolver.ts +144 -0
  225. package/src/services/provider-validator.ts +170 -0
  226. package/src/services/session-registration.service.ts +251 -0
  227. package/src/services/storage.service.ts +566 -0
  228. package/src/services/tool-context-builder.ts +172 -0
  229. package/src/services/tool-protection.service.ts +958 -0
  230. package/src/types/oauth-required-error.ts +63 -0
  231. package/src/types/tool-protection.ts +155 -0
  232. package/src/utils/__tests__/did-helpers.test.ts +101 -0
  233. package/src/utils/base64.ts +148 -0
  234. package/src/utils/cors.ts +83 -0
  235. package/src/utils/did-helpers.ts +150 -0
  236. package/src/utils/index.ts +8 -0
  237. package/src/utils/storage-keys.ts +278 -0
  238. package/tsconfig.json +21 -0
  239. package/vitest.config.ts +56 -0
@@ -0,0 +1,251 @@
1
+ /**
2
+ * Session Registration Service
3
+ *
4
+ * Registers MCP sessions with the AgentShield dashboard, enabling
5
+ * visibility into which MCP clients are connecting to agents.
6
+ *
7
+ * This is a fire-and-forget service - session registration should not
8
+ * block tool execution or affect the user experience.
9
+ *
10
+ * @package @kya-os/mcp-i-core
11
+ */
12
+
13
+ import type {
14
+ RegisterSessionRequest,
15
+ RegisterSessionResponse,
16
+ } from "@kya-os/contracts/agentshield-api";
17
+ import {
18
+ registerSessionRequestSchema,
19
+ registerSessionResponseSchema,
20
+ AGENTSHIELD_ENDPOINTS,
21
+ } from "@kya-os/contracts/agentshield-api";
22
+ import type { FetchProvider } from "../providers/base.js";
23
+
24
+ /**
25
+ * Configuration for the session registration service
26
+ */
27
+ export interface SessionRegistrationServiceConfig {
28
+ /** Base URL for the AgentShield API (e.g., "https://kya.vouched.id") */
29
+ baseUrl: string;
30
+
31
+ /** API key for authentication */
32
+ apiKey: string;
33
+
34
+ /** Fetch provider for making HTTP requests (platform-agnostic) */
35
+ fetchProvider: FetchProvider;
36
+
37
+ /** Optional logger callback for diagnostics */
38
+ logger?: (message: string, data?: unknown) => void;
39
+
40
+ /** Timeout in milliseconds for the registration request (default: 5000) */
41
+ timeoutMs?: number;
42
+ }
43
+
44
+ /**
45
+ * Result of a session registration attempt
46
+ */
47
+ export interface SessionRegistrationResult {
48
+ /** Whether registration was successful */
49
+ success: boolean;
50
+ /** Session ID that was registered */
51
+ sessionId: string;
52
+ /** Error message if registration failed */
53
+ error?: string;
54
+ }
55
+
56
+ /**
57
+ * Session Registration Service
58
+ *
59
+ * Registers MCP sessions with AgentShield for dashboard visibility.
60
+ * Designed to be non-blocking - failures are logged but don't throw.
61
+ */
62
+ export class SessionRegistrationService {
63
+ private config: Required<
64
+ Omit<SessionRegistrationServiceConfig, "logger" | "timeoutMs">
65
+ > & {
66
+ logger: NonNullable<SessionRegistrationServiceConfig["logger"]>;
67
+ timeoutMs: number;
68
+ };
69
+
70
+ constructor(config: SessionRegistrationServiceConfig) {
71
+ this.config = {
72
+ baseUrl: config.baseUrl,
73
+ apiKey: config.apiKey,
74
+ fetchProvider: config.fetchProvider,
75
+ logger: config.logger || (() => {}),
76
+ timeoutMs: config.timeoutMs ?? 5000,
77
+ };
78
+ }
79
+
80
+ /**
81
+ * Register a session with AgentShield
82
+ *
83
+ * This is a fire-and-forget operation. Failures are logged but don't throw.
84
+ * The method returns quickly and doesn't block the caller.
85
+ *
86
+ * @param request - Session registration request data
87
+ * @returns Result indicating success or failure
88
+ */
89
+ async registerSession(
90
+ request: RegisterSessionRequest
91
+ ): Promise<SessionRegistrationResult> {
92
+ const sessionId = request.session_id;
93
+
94
+ try {
95
+ // Validate request
96
+ const validationResult = registerSessionRequestSchema.safeParse(request);
97
+ if (!validationResult.success) {
98
+ const errorMsg = `Invalid session registration request: ${validationResult.error.message}`;
99
+ this.config.logger("[SessionRegistration] Validation failed", {
100
+ sessionId,
101
+ error: errorMsg,
102
+ });
103
+ return { success: false, sessionId, error: errorMsg };
104
+ }
105
+
106
+ const url = `${this.config.baseUrl}${AGENTSHIELD_ENDPOINTS.SESSIONS}`;
107
+
108
+ this.config.logger("[SessionRegistration] Registering session", {
109
+ sessionId,
110
+ agentDid: request.agent_did,
111
+ clientName: request.client_info.name,
112
+ url,
113
+ });
114
+
115
+ // Make the request with timeout
116
+ const controller = new AbortController();
117
+ const timeoutId = setTimeout(
118
+ () => controller.abort(),
119
+ this.config.timeoutMs
120
+ );
121
+
122
+ try {
123
+ const response = await this.config.fetchProvider.fetch(url, {
124
+ method: "POST",
125
+ headers: {
126
+ "Content-Type": "application/json",
127
+ Authorization: `Bearer ${this.config.apiKey}`,
128
+ },
129
+ body: JSON.stringify(request),
130
+ signal: controller.signal,
131
+ });
132
+
133
+ clearTimeout(timeoutId);
134
+
135
+ if (!response.ok) {
136
+ // Log error but don't throw - this is fire-and-forget
137
+ const errorText = await response.text().catch(() => "Unknown error");
138
+ this.config.logger("[SessionRegistration] Registration failed", {
139
+ sessionId,
140
+ status: response.status,
141
+ error: errorText,
142
+ });
143
+ return {
144
+ success: false,
145
+ sessionId,
146
+ error: `HTTP ${response.status}: ${errorText}`,
147
+ };
148
+ }
149
+
150
+ // Parse response
151
+ const responseData = (await response.json()) as {
152
+ data?: RegisterSessionResponse;
153
+ } & RegisterSessionResponse;
154
+ const parseResult = registerSessionResponseSchema.safeParse(
155
+ responseData.data || responseData
156
+ );
157
+
158
+ if (!parseResult.success) {
159
+ this.config.logger(
160
+ "[SessionRegistration] Invalid response format",
161
+ {
162
+ sessionId,
163
+ response: responseData,
164
+ }
165
+ );
166
+ // Still consider it a success if we got a 200 OK
167
+ return { success: true, sessionId };
168
+ }
169
+
170
+ this.config.logger("[SessionRegistration] Session registered", {
171
+ sessionId,
172
+ registered: parseResult.data.registered,
173
+ });
174
+
175
+ return { success: true, sessionId };
176
+ } finally {
177
+ clearTimeout(timeoutId);
178
+ }
179
+ } catch (error) {
180
+ // Handle abort/timeout
181
+ if (error instanceof Error && error.name === "AbortError") {
182
+ this.config.logger("[SessionRegistration] Request timed out", {
183
+ sessionId,
184
+ timeoutMs: this.config.timeoutMs,
185
+ });
186
+ return { success: false, sessionId, error: "Request timed out" };
187
+ }
188
+
189
+ // Log any other error
190
+ const errorMsg =
191
+ error instanceof Error ? error.message : "Unknown error";
192
+ this.config.logger("[SessionRegistration] Unexpected error", {
193
+ sessionId,
194
+ error: errorMsg,
195
+ });
196
+ return { success: false, sessionId, error: errorMsg };
197
+ }
198
+ }
199
+
200
+ /**
201
+ * Fire-and-forget session registration
202
+ *
203
+ * Starts registration in the background without waiting for completion.
204
+ * Useful when you want to register a session but not delay the response.
205
+ *
206
+ * @param request - Session registration request data
207
+ */
208
+ registerSessionAsync(request: RegisterSessionRequest): void {
209
+ // Start registration in background - don't await
210
+ this.registerSession(request).catch((error) => {
211
+ // This should never happen since registerSession catches all errors,
212
+ // but just in case
213
+ this.config.logger("[SessionRegistration] Background registration failed", {
214
+ sessionId: request.session_id,
215
+ error: error instanceof Error ? error.message : "Unknown error",
216
+ });
217
+ });
218
+ }
219
+ }
220
+
221
+ /**
222
+ * Create a session registration service from common runtime config
223
+ *
224
+ * Helper function to create the service from typical environment config.
225
+ */
226
+ export function createSessionRegistrationService(options: {
227
+ apiUrl: string;
228
+ apiKey: string;
229
+ fetchProvider: FetchProvider;
230
+ logger?: (message: string, data?: unknown) => void;
231
+ }): SessionRegistrationService | null {
232
+ // Validate required config
233
+ if (!options.apiUrl || !options.apiKey) {
234
+ options.logger?.(
235
+ "[SessionRegistration] Missing required config - session registration disabled",
236
+ {
237
+ hasApiUrl: !!options.apiUrl,
238
+ hasApiKey: !!options.apiKey,
239
+ }
240
+ );
241
+ return null;
242
+ }
243
+
244
+ return new SessionRegistrationService({
245
+ baseUrl: options.apiUrl,
246
+ apiKey: options.apiKey,
247
+ fetchProvider: options.fetchProvider,
248
+ logger: options.logger,
249
+ });
250
+ }
251
+