@kya-os/mcp-i-core 1.3.12 → 1.3.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (254) hide show
  1. package/dist/config/remote-config.js +9 -12
  2. package/dist/runtime/base.js +11 -0
  3. package/dist/services/access-control.service.js +5 -0
  4. package/dist/services/tool-protection.service.js +17 -8
  5. package/package.json +2 -2
  6. package/.turbo/turbo-build.log +0 -4
  7. package/.turbo/turbo-test$colon$coverage.log +0 -4586
  8. package/.turbo/turbo-test.log +0 -3169
  9. package/COMPLIANCE_IMPROVEMENT_REPORT.md +0 -483
  10. package/Composer 3.md +0 -615
  11. package/GPT-5.md +0 -1169
  12. package/OPUS-plan.md +0 -352
  13. package/PHASE_3_AND_4.1_SUMMARY.md +0 -585
  14. package/PHASE_3_SUMMARY.md +0 -317
  15. package/PHASE_4.1.3_SUMMARY.md +0 -428
  16. package/PHASE_4.1_COMPLETE.md +0 -525
  17. package/PHASE_4_USER_DID_IDENTITY_LINKING_PLAN.md +0 -1240
  18. package/SCHEMA_COMPLIANCE_REPORT.md +0 -275
  19. package/TEST_PLAN.md +0 -571
  20. package/coverage/coverage-final.json +0 -60
  21. package/dist/cache/oauth-config-cache.d.ts.map +0 -1
  22. package/dist/cache/oauth-config-cache.js.map +0 -1
  23. package/dist/cache/tool-protection-cache.d.ts.map +0 -1
  24. package/dist/cache/tool-protection-cache.js.map +0 -1
  25. package/dist/compliance/index.d.ts.map +0 -1
  26. package/dist/compliance/index.js.map +0 -1
  27. package/dist/compliance/schema-registry.d.ts.map +0 -1
  28. package/dist/compliance/schema-registry.js.map +0 -1
  29. package/dist/compliance/schema-verifier.d.ts.map +0 -1
  30. package/dist/compliance/schema-verifier.js.map +0 -1
  31. package/dist/config/remote-config.d.ts.map +0 -1
  32. package/dist/config/remote-config.js.map +0 -1
  33. package/dist/config.d.ts.map +0 -1
  34. package/dist/config.js.map +0 -1
  35. package/dist/delegation/audience-validator.d.ts.map +0 -1
  36. package/dist/delegation/audience-validator.js.map +0 -1
  37. package/dist/delegation/bitstring.d.ts.map +0 -1
  38. package/dist/delegation/bitstring.js.map +0 -1
  39. package/dist/delegation/cascading-revocation.d.ts.map +0 -1
  40. package/dist/delegation/cascading-revocation.js.map +0 -1
  41. package/dist/delegation/delegation-graph.d.ts.map +0 -1
  42. package/dist/delegation/delegation-graph.js.map +0 -1
  43. package/dist/delegation/did-key-resolver.d.ts.map +0 -1
  44. package/dist/delegation/did-key-resolver.js.map +0 -1
  45. package/dist/delegation/index.d.ts.map +0 -1
  46. package/dist/delegation/index.js.map +0 -1
  47. package/dist/delegation/statuslist-manager.d.ts.map +0 -1
  48. package/dist/delegation/statuslist-manager.js.map +0 -1
  49. package/dist/delegation/storage/index.d.ts.map +0 -1
  50. package/dist/delegation/storage/index.js.map +0 -1
  51. package/dist/delegation/storage/memory-graph-storage.d.ts.map +0 -1
  52. package/dist/delegation/storage/memory-graph-storage.js.map +0 -1
  53. package/dist/delegation/storage/memory-statuslist-storage.d.ts.map +0 -1
  54. package/dist/delegation/storage/memory-statuslist-storage.js.map +0 -1
  55. package/dist/delegation/utils.d.ts.map +0 -1
  56. package/dist/delegation/utils.js.map +0 -1
  57. package/dist/delegation/vc-issuer.d.ts.map +0 -1
  58. package/dist/delegation/vc-issuer.js.map +0 -1
  59. package/dist/delegation/vc-verifier.d.ts.map +0 -1
  60. package/dist/delegation/vc-verifier.js.map +0 -1
  61. package/dist/identity/idp-token-resolver.d.ts.map +0 -1
  62. package/dist/identity/idp-token-resolver.js.map +0 -1
  63. package/dist/identity/idp-token-storage.interface.d.ts.map +0 -1
  64. package/dist/identity/idp-token-storage.interface.js.map +0 -1
  65. package/dist/identity/user-did-manager.d.ts.map +0 -1
  66. package/dist/identity/user-did-manager.js.map +0 -1
  67. package/dist/index.d.ts.map +0 -1
  68. package/dist/index.js.map +0 -1
  69. package/dist/providers/base.d.ts.map +0 -1
  70. package/dist/providers/base.js.map +0 -1
  71. package/dist/providers/memory.d.ts.map +0 -1
  72. package/dist/providers/memory.js.map +0 -1
  73. package/dist/runtime/audit-logger.d.ts.map +0 -1
  74. package/dist/runtime/audit-logger.js.map +0 -1
  75. package/dist/runtime/base.d.ts.map +0 -1
  76. package/dist/runtime/base.js.map +0 -1
  77. package/dist/services/access-control.service.d.ts.map +0 -1
  78. package/dist/services/access-control.service.js.map +0 -1
  79. package/dist/services/authorization/authorization-registry.d.ts.map +0 -1
  80. package/dist/services/authorization/authorization-registry.js.map +0 -1
  81. package/dist/services/authorization/types.d.ts.map +0 -1
  82. package/dist/services/authorization/types.js.map +0 -1
  83. package/dist/services/batch-delegation.service.d.ts.map +0 -1
  84. package/dist/services/batch-delegation.service.js.map +0 -1
  85. package/dist/services/crypto.service.d.ts.map +0 -1
  86. package/dist/services/crypto.service.js.map +0 -1
  87. package/dist/services/errors.d.ts.map +0 -1
  88. package/dist/services/errors.js.map +0 -1
  89. package/dist/services/index.d.ts.map +0 -1
  90. package/dist/services/index.js.map +0 -1
  91. package/dist/services/oauth-config.service.d.ts.map +0 -1
  92. package/dist/services/oauth-config.service.js.map +0 -1
  93. package/dist/services/oauth-provider-registry.d.ts.map +0 -1
  94. package/dist/services/oauth-provider-registry.js.map +0 -1
  95. package/dist/services/oauth-service.d.ts.map +0 -1
  96. package/dist/services/oauth-service.js.map +0 -1
  97. package/dist/services/oauth-token-retrieval.service.d.ts.map +0 -1
  98. package/dist/services/oauth-token-retrieval.service.js.map +0 -1
  99. package/dist/services/proof-verifier.d.ts.map +0 -1
  100. package/dist/services/proof-verifier.js.map +0 -1
  101. package/dist/services/provider-resolver.d.ts.map +0 -1
  102. package/dist/services/provider-resolver.js.map +0 -1
  103. package/dist/services/provider-validator.d.ts.map +0 -1
  104. package/dist/services/provider-validator.js.map +0 -1
  105. package/dist/services/session-registration.service.d.ts.map +0 -1
  106. package/dist/services/session-registration.service.js.map +0 -1
  107. package/dist/services/storage.service.d.ts.map +0 -1
  108. package/dist/services/storage.service.js.map +0 -1
  109. package/dist/services/tool-context-builder.d.ts.map +0 -1
  110. package/dist/services/tool-context-builder.js.map +0 -1
  111. package/dist/services/tool-protection.service.d.ts.map +0 -1
  112. package/dist/services/tool-protection.service.js.map +0 -1
  113. package/dist/types/oauth-required-error.d.ts.map +0 -1
  114. package/dist/types/oauth-required-error.js.map +0 -1
  115. package/dist/types/tool-protection.d.ts.map +0 -1
  116. package/dist/types/tool-protection.js.map +0 -1
  117. package/dist/utils/base58.d.ts.map +0 -1
  118. package/dist/utils/base58.js.map +0 -1
  119. package/dist/utils/base64.d.ts.map +0 -1
  120. package/dist/utils/base64.js.map +0 -1
  121. package/dist/utils/cors.d.ts.map +0 -1
  122. package/dist/utils/cors.js.map +0 -1
  123. package/dist/utils/did-helpers.d.ts.map +0 -1
  124. package/dist/utils/did-helpers.js.map +0 -1
  125. package/dist/utils/index.d.ts.map +0 -1
  126. package/dist/utils/index.js.map +0 -1
  127. package/dist/utils/storage-keys.d.ts.map +0 -1
  128. package/dist/utils/storage-keys.js.map +0 -1
  129. package/docs/API_REFERENCE.md +0 -1362
  130. package/docs/COMPLIANCE_MATRIX.md +0 -691
  131. package/docs/STATUSLIST2021_GUIDE.md +0 -696
  132. package/docs/W3C_VC_DELEGATION_GUIDE.md +0 -710
  133. package/src/__tests__/cache/tool-protection-cache.test.ts +0 -640
  134. package/src/__tests__/config/provider-runtime-config.test.ts +0 -309
  135. package/src/__tests__/delegation-e2e.test.ts +0 -690
  136. package/src/__tests__/identity/user-did-manager.test.ts +0 -232
  137. package/src/__tests__/index.test.ts +0 -56
  138. package/src/__tests__/integration/full-flow.test.ts +0 -789
  139. package/src/__tests__/integration.test.ts +0 -281
  140. package/src/__tests__/providers/base.test.ts +0 -173
  141. package/src/__tests__/providers/memory.test.ts +0 -319
  142. package/src/__tests__/regression/phase2-regression.test.ts +0 -429
  143. package/src/__tests__/runtime/audit-logger.test.ts +0 -154
  144. package/src/__tests__/runtime/base-extensions.test.ts +0 -595
  145. package/src/__tests__/runtime/base.test.ts +0 -869
  146. package/src/__tests__/runtime/delegation-flow.test.ts +0 -164
  147. package/src/__tests__/runtime/proof-client-did.test.ts +0 -376
  148. package/src/__tests__/runtime/route-interception.test.ts +0 -686
  149. package/src/__tests__/runtime/tool-protection-enforcement.test.ts +0 -908
  150. package/src/__tests__/services/agentshield-integration.test.ts +0 -791
  151. package/src/__tests__/services/cache-busting.test.ts +0 -125
  152. package/src/__tests__/services/oauth-service-pkce.test.ts +0 -556
  153. package/src/__tests__/services/provider-resolver-edge-cases.test.ts +0 -591
  154. package/src/__tests__/services/tool-protection-merged-config.test.ts +0 -485
  155. package/src/__tests__/services/tool-protection-oauth-provider.test.ts +0 -480
  156. package/src/__tests__/services/tool-protection.service.test.ts +0 -1373
  157. package/src/__tests__/utils/mock-providers.ts +0 -340
  158. package/src/cache/oauth-config-cache.d.ts +0 -69
  159. package/src/cache/oauth-config-cache.d.ts.map +0 -1
  160. package/src/cache/oauth-config-cache.js.map +0 -1
  161. package/src/cache/oauth-config-cache.ts +0 -123
  162. package/src/cache/tool-protection-cache.ts +0 -171
  163. package/src/compliance/EXAMPLE.md +0 -412
  164. package/src/compliance/__tests__/schema-verifier.test.ts +0 -797
  165. package/src/compliance/index.ts +0 -8
  166. package/src/compliance/schema-registry.ts +0 -460
  167. package/src/compliance/schema-verifier.ts +0 -708
  168. package/src/config/__tests__/merged-config.spec.ts +0 -445
  169. package/src/config/__tests__/remote-config.spec.ts +0 -268
  170. package/src/config/remote-config.ts +0 -264
  171. package/src/config.ts +0 -312
  172. package/src/delegation/__tests__/audience-validator.test.ts +0 -112
  173. package/src/delegation/__tests__/bitstring.test.ts +0 -346
  174. package/src/delegation/__tests__/cascading-revocation.test.ts +0 -628
  175. package/src/delegation/__tests__/delegation-graph.test.ts +0 -584
  176. package/src/delegation/__tests__/did-key-resolver.test.ts +0 -265
  177. package/src/delegation/__tests__/utils.test.ts +0 -152
  178. package/src/delegation/__tests__/vc-issuer.test.ts +0 -442
  179. package/src/delegation/__tests__/vc-verifier.test.ts +0 -922
  180. package/src/delegation/audience-validator.ts +0 -52
  181. package/src/delegation/bitstring.ts +0 -278
  182. package/src/delegation/cascading-revocation.ts +0 -370
  183. package/src/delegation/delegation-graph.ts +0 -299
  184. package/src/delegation/did-key-resolver.ts +0 -179
  185. package/src/delegation/index.ts +0 -14
  186. package/src/delegation/statuslist-manager.ts +0 -353
  187. package/src/delegation/storage/__tests__/memory-graph-storage.test.ts +0 -366
  188. package/src/delegation/storage/__tests__/memory-statuslist-storage.test.ts +0 -228
  189. package/src/delegation/storage/index.ts +0 -9
  190. package/src/delegation/storage/memory-graph-storage.ts +0 -178
  191. package/src/delegation/storage/memory-statuslist-storage.ts +0 -77
  192. package/src/delegation/utils.ts +0 -221
  193. package/src/delegation/vc-issuer.ts +0 -232
  194. package/src/delegation/vc-verifier.ts +0 -568
  195. package/src/identity/idp-token-resolver.ts +0 -181
  196. package/src/identity/idp-token-storage.interface.ts +0 -94
  197. package/src/identity/user-did-manager.ts +0 -526
  198. package/src/index.ts +0 -310
  199. package/src/providers/base.d.ts +0 -91
  200. package/src/providers/base.d.ts.map +0 -1
  201. package/src/providers/base.js.map +0 -1
  202. package/src/providers/base.ts +0 -96
  203. package/src/providers/memory.ts +0 -142
  204. package/src/runtime/audit-logger.ts +0 -39
  205. package/src/runtime/base.ts +0 -1392
  206. package/src/services/__tests__/access-control.integration.test.ts +0 -443
  207. package/src/services/__tests__/access-control.proof-response-validation.test.ts +0 -578
  208. package/src/services/__tests__/access-control.service.test.ts +0 -970
  209. package/src/services/__tests__/batch-delegation.service.test.ts +0 -351
  210. package/src/services/__tests__/crypto.service.test.ts +0 -531
  211. package/src/services/__tests__/oauth-provider-registry.test.ts +0 -142
  212. package/src/services/__tests__/proof-verifier.integration.test.ts +0 -485
  213. package/src/services/__tests__/proof-verifier.test.ts +0 -489
  214. package/src/services/__tests__/provider-resolution.integration.test.ts +0 -202
  215. package/src/services/__tests__/provider-resolver.test.ts +0 -213
  216. package/src/services/__tests__/storage.service.test.ts +0 -358
  217. package/src/services/access-control.service.ts +0 -990
  218. package/src/services/authorization/authorization-registry.ts +0 -66
  219. package/src/services/authorization/types.ts +0 -71
  220. package/src/services/batch-delegation.service.ts +0 -137
  221. package/src/services/crypto.service.ts +0 -302
  222. package/src/services/errors.ts +0 -76
  223. package/src/services/index.ts +0 -18
  224. package/src/services/oauth-config.service.d.ts +0 -53
  225. package/src/services/oauth-config.service.d.ts.map +0 -1
  226. package/src/services/oauth-config.service.js.map +0 -1
  227. package/src/services/oauth-config.service.ts +0 -192
  228. package/src/services/oauth-provider-registry.d.ts +0 -57
  229. package/src/services/oauth-provider-registry.d.ts.map +0 -1
  230. package/src/services/oauth-provider-registry.js.map +0 -1
  231. package/src/services/oauth-provider-registry.ts +0 -141
  232. package/src/services/oauth-service.ts +0 -544
  233. package/src/services/oauth-token-retrieval.service.ts +0 -245
  234. package/src/services/proof-verifier.ts +0 -478
  235. package/src/services/provider-resolver.d.ts +0 -48
  236. package/src/services/provider-resolver.d.ts.map +0 -1
  237. package/src/services/provider-resolver.js.map +0 -1
  238. package/src/services/provider-resolver.ts +0 -146
  239. package/src/services/provider-validator.ts +0 -170
  240. package/src/services/session-registration.service.ts +0 -251
  241. package/src/services/storage.service.ts +0 -566
  242. package/src/services/tool-context-builder.ts +0 -237
  243. package/src/services/tool-protection.service.ts +0 -1070
  244. package/src/types/oauth-required-error.ts +0 -63
  245. package/src/types/tool-protection.ts +0 -155
  246. package/src/utils/__tests__/did-helpers.test.ts +0 -156
  247. package/src/utils/base58.ts +0 -109
  248. package/src/utils/base64.ts +0 -148
  249. package/src/utils/cors.ts +0 -83
  250. package/src/utils/did-helpers.ts +0 -210
  251. package/src/utils/index.ts +0 -8
  252. package/src/utils/storage-keys.ts +0 -278
  253. package/tsconfig.json +0 -21
  254. package/vitest.config.ts +0 -56
@@ -1,48 +0,0 @@
1
- /**
2
- * Provider Resolver
3
- *
4
- * Resolves OAuth provider for tools using priority-based resolution strategy.
5
- * Supports Phase 2+ tool-specific providers with backward compatibility for Phase 1.
6
- *
7
- * @package @kya-os/mcp-i-core
8
- */
9
- import type { ToolProtection } from "@kya-os/contracts/tool-protection";
10
- import type { OAuthProviderRegistry } from "./oauth-provider-registry.js";
11
- import type { OAuthConfigService } from "./oauth-config.service.js";
12
- /**
13
- * Resolves OAuth provider for tools with priority-based fallback strategy
14
- *
15
- * Priority order:
16
- * 1. Tool-specific oauthProvider field (Phase 2+ preferred)
17
- * 2. Scope prefix inference (fallback)
18
- * 3. First configured provider (Phase 1 compatibility fallback)
19
- * 4. Error if no provider can be resolved
20
- */
21
- export declare class ProviderResolver {
22
- private registry;
23
- private configService;
24
- constructor(registry: OAuthProviderRegistry, configService: OAuthConfigService);
25
- /**
26
- * Resolve OAuth provider for a tool
27
- *
28
- * @param toolProtection - Tool protection configuration
29
- * @param projectId - Project ID for fetching provider config
30
- * @returns Provider name (never null - throws if cannot resolve)
31
- * @throws Error if provider cannot be resolved
32
- */
33
- resolveProvider(toolProtection: ToolProtection, projectId: string): Promise<string>;
34
- /**
35
- * Infer provider from scope prefixes
36
- *
37
- * Used as Priority 2 fallback when oauthProvider is not specified.
38
- * Examples:
39
- * - github:repo:read → github
40
- * - gmail:read → google
41
- * - microsoft:calendar:read → microsoft
42
- *
43
- * @param scopes - Required scopes for the tool
44
- * @returns Provider name if uniquely inferred, null otherwise
45
- */
46
- private inferProviderFromScopes;
47
- }
48
- //# sourceMappingURL=provider-resolver.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"provider-resolver.d.ts","sourceRoot":"","sources":["provider-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;;;;;;;;GAQG;AACH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,aAAa;gBADb,QAAQ,EAAE,qBAAqB,EAC/B,aAAa,EAAE,kBAAkB;IAG3C;;;;;;;OAOG;IACG,eAAe,CACnB,cAAc,EAAE,cAAc,EAC9B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC;IA6ClB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,uBAAuB;CAoChC"}
@@ -1 +0,0 @@
1
- {"version":3,"file":"provider-resolver.js","sourceRoot":"","sources":["provider-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH;;;;;;;;GAQG;AACH,MAAM,OAAO,gBAAgB;IAEjB;IACA;IAFV,YACU,QAA+B,EAC/B,aAAiC;QADjC,aAAQ,GAAR,QAAQ,CAAuB;QAC/B,kBAAa,GAAb,aAAa,CAAoB;IACxC,CAAC;IAEJ;;;;;;;OAOG;IACH,KAAK,CAAC,eAAe,CACnB,cAA8B,EAC9B,SAAiB;QAEjB,0DAA0D;QAC1D,IAAI,cAAc,CAAC,aAAa,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CACb,aAAa,cAAc,CAAC,aAAa,iCAAiC,SAAS,KAAK;oBACtF,mCAAmC,CACtC,CAAC;YACJ,CAAC;YACD,OAAO,cAAc,CAAC,aAAa,CAAC;QACtC,CAAC;QAED,gDAAgD;QAChD,MAAM,gBAAgB,GAAG,IAAI,CAAC,uBAAuB,CACnD,cAAc,CAAC,cAAc,IAAI,EAAE,CACpC,CAAC;QACF,IAAI,gBAAgB,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpE,OAAO,CAAC,GAAG,CACT,yCAAyC,gBAAgB,eAAe,CACzE,CAAC;YACF,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,yEAAyE;QACzE,4BAA4B;QAC5B,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;QAClD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,4CAA4C;YAC5C,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CACV,0DAA0D;gBACxD,oCAAoC,iBAAiB,iBAAiB;gBACtE,qFAAqF,CACxF,CAAC;YACF,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QAED,mDAAmD;QACnD,MAAM,IAAI,KAAK,CACb,yDAAyD;YACvD,2GAA2G,SAAS,IAAI,CAC3H,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACK,uBAAuB,CAAC,MAAgB;QAC9C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mDAAmD;QACnD,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACzC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,mBAAmB;QACnB,MAAM,WAAW,GAA2B;YAC1C,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,QAAQ,EAAE,sBAAsB;YACvC,QAAQ,EAAE,QAAQ,EAAE,6DAA6D;YACjF,SAAS,EAAE,WAAW;YACtB,OAAO,EAAE,WAAW;YACpB,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,MAAM;SACb,CAAC;QAEF,uBAAuB;QACvB,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CACnE,CAAC;QAEF,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QAED,oEAAoE;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
@@ -1,146 +0,0 @@
1
- /**
2
- * Provider Resolver
3
- *
4
- * Resolves OAuth provider for tools using priority-based resolution strategy.
5
- * Supports Phase 2+ tool-specific providers with backward compatibility for Phase 1.
6
- *
7
- * @package @kya-os/mcp-i-core
8
- */
9
-
10
- import type { ToolProtection } from "@kya-os/contracts/tool-protection";
11
- import type { OAuthProviderRegistry } from "./oauth-provider-registry.js";
12
- import type { OAuthConfigService } from "./oauth-config.service.js";
13
-
14
- /**
15
- * Resolves OAuth provider for tools with priority-based fallback strategy
16
- *
17
- * Priority order:
18
- * 1. Tool-specific oauthProvider field (Phase 2+ preferred)
19
- * 2. Scope prefix inference (fallback)
20
- * 3. Project-configured provider from AgentShield dashboard
21
- * 4. Error if no provider can be resolved
22
- */
23
- export class ProviderResolver {
24
- constructor(
25
- private registry: OAuthProviderRegistry,
26
- private configService: OAuthConfigService
27
- ) {}
28
-
29
- /**
30
- * Resolve OAuth provider for a tool
31
- *
32
- * @param toolProtection - Tool protection configuration
33
- * @param projectId - Project ID for fetching provider config
34
- * @returns Provider name (never null - throws if cannot resolve)
35
- * @throws Error if provider cannot be resolved
36
- */
37
- async resolveProvider(
38
- toolProtection: ToolProtection,
39
- projectId: string
40
- ): Promise<string> {
41
- // Priority 1: Tool-specific provider (Phase 2+ preferred)
42
- if (toolProtection.oauthProvider) {
43
- // Ensure registry is loaded before checking
44
- if (this.registry.getProviderNames().length === 0) {
45
- await this.registry.loadFromAgentShield(projectId);
46
- }
47
- if (!this.registry.hasProvider(toolProtection.oauthProvider)) {
48
- throw new Error(
49
- `Provider "${toolProtection.oauthProvider}" not configured for project "${projectId}". ` +
50
- `Add provider in project settings.`
51
- );
52
- }
53
- return toolProtection.oauthProvider;
54
- }
55
-
56
- // Priority 2: Scope prefix inference (fallback)
57
- const inferredProvider = this.inferProviderFromScopes(
58
- toolProtection.requiredScopes || []
59
- );
60
- if (inferredProvider) {
61
- // Ensure registry is loaded before checking
62
- if (this.registry.getProviderNames().length === 0) {
63
- await this.registry.loadFromAgentShield(projectId);
64
- }
65
- if (this.registry.hasProvider(inferredProvider)) {
66
- console.log(
67
- `[ProviderResolver] Inferred provider "${inferredProvider}" from scopes`
68
- );
69
- return inferredProvider;
70
- }
71
- }
72
-
73
- // Priority 3: Use explicitly configured provider from AgentShield dashboard
74
- // This is the provider the user has actually configured, not just any available provider
75
- await this.registry.loadFromAgentShield(projectId);
76
- const configuredProvider = this.registry.getConfiguredProvider();
77
-
78
- if (configuredProvider && this.registry.hasProvider(configuredProvider)) {
79
- console.warn(
80
- `[ProviderResolver] Tool does not specify oauthProvider. ` +
81
- `Using project-configured provider "${configuredProvider}" as fallback. ` +
82
- `Consider explicitly setting oauthProvider in tool protection config.`
83
- );
84
- return configuredProvider;
85
- }
86
-
87
- // Priority 4: Error if no provider is configured
88
- // NOTE: We intentionally do NOT fall back to "first available provider" anymore
89
- // because AgentShield returns ALL providers (even unconfigured ones).
90
- // Only use providers explicitly configured by the user.
91
- throw new Error(
92
- `Tool requires OAuth but no provider is configured for project "${projectId}". ` +
93
- `Configure an OAuth provider in AgentShield dashboard.`
94
- );
95
- }
96
-
97
- /**
98
- * Infer provider from scope prefixes
99
- *
100
- * Used as Priority 2 fallback when oauthProvider is not specified.
101
- * Examples:
102
- * - github:repo:read → github
103
- * - gmail:read → google
104
- * - microsoft:calendar:read → microsoft
105
- *
106
- * @param scopes - Required scopes for the tool
107
- * @returns Provider name if uniquely inferred, null otherwise
108
- */
109
- private inferProviderFromScopes(scopes: string[]): string | null {
110
- if (!scopes || scopes.length === 0) {
111
- return null;
112
- }
113
-
114
- // Extract first part of scope (before first colon)
115
- const scopePrefixes = scopes.map((scope) => {
116
- const parts = scope.split(":");
117
- return parts[0].toLowerCase();
118
- });
119
-
120
- // Provider mapping
121
- const providerMap: Record<string, string> = {
122
- github: "github",
123
- google: "google",
124
- gmail: "google", // gmail:read → google
125
- calendar: "google", // calendar:read → google (if ambiguous, use project default)
126
- microsoft: "microsoft",
127
- outlook: "microsoft",
128
- slack: "slack",
129
- auth0: "auth0",
130
- okta: "okta",
131
- };
132
-
133
- // Find unique provider
134
- const providers = new Set(
135
- scopePrefixes.map((prefix) => providerMap[prefix]).filter(Boolean)
136
- );
137
-
138
- if (providers.size === 1) {
139
- return Array.from(providers)[0];
140
- }
141
-
142
- // Ambiguous or no prefix → return null (use project-level provider)
143
- return null;
144
- }
145
- }
146
-
@@ -1,170 +0,0 @@
1
- /**
2
- * Provider Validator
3
- *
4
- * Validates OAuth provider configurations for custom IDP support.
5
- * Ensures provider configurations are valid before registration.
6
- *
7
- * @package @kya-os/mcp-i-core
8
- */
9
-
10
- import type { OAuthProvider } from "@kya-os/contracts/config";
11
-
12
- /**
13
- * Reserved OAuth parameters that cannot be overridden by custom parameters
14
- */
15
- const RESERVED_PARAMETERS = [
16
- "response_type",
17
- "client_id",
18
- "redirect_uri",
19
- "scope",
20
- "state",
21
- "code_challenge",
22
- "code_challenge_method",
23
- ] as const;
24
-
25
- /**
26
- * Validation error for provider configuration issues
27
- */
28
- export class ProviderValidationError extends Error {
29
- constructor(message: string, public readonly field?: string) {
30
- super(message);
31
- this.name = "ProviderValidationError";
32
- }
33
- }
34
-
35
- /**
36
- * Service for validating OAuth provider configurations
37
- */
38
- export class ProviderValidator {
39
- /**
40
- * Validate provider configuration
41
- *
42
- * @param provider - Provider configuration to validate
43
- * @param name - Provider name (for error messages)
44
- * @throws ProviderValidationError if validation fails
45
- */
46
- validate(provider: OAuthProvider, name: string): void {
47
- // Validate required fields
48
- if (!provider.clientId || provider.clientId.trim().length === 0) {
49
- throw new ProviderValidationError(
50
- `Provider "${name}" must have a clientId`,
51
- "clientId"
52
- );
53
- }
54
-
55
- if (!provider.authorizationUrl || provider.authorizationUrl.trim().length === 0) {
56
- throw new ProviderValidationError(
57
- `Provider "${name}" must have an authorizationUrl`,
58
- "authorizationUrl"
59
- );
60
- }
61
-
62
- if (!provider.tokenUrl || provider.tokenUrl.trim().length === 0) {
63
- throw new ProviderValidationError(
64
- `Provider "${name}" must have a tokenUrl`,
65
- "tokenUrl"
66
- );
67
- }
68
-
69
- // Validate URL formats
70
- this.validateUrl(provider.authorizationUrl, name, "authorizationUrl");
71
- this.validateUrl(provider.tokenUrl, name, "tokenUrl");
72
-
73
- if (provider.userInfoUrl) {
74
- this.validateUrl(provider.userInfoUrl, name, "userInfoUrl");
75
- }
76
-
77
- // Validate proxy mode requirements
78
- if (provider.proxyMode && !provider.requiresClientSecret) {
79
- throw new ProviderValidationError(
80
- `Provider "${name}" with proxyMode=true must have requiresClientSecret=true`,
81
- "proxyMode"
82
- );
83
- }
84
-
85
- // Validate custom parameters don't conflict with reserved parameters
86
- if (provider.customParams) {
87
- this.validateCustomParams(provider.customParams, name);
88
- }
89
- }
90
-
91
- /**
92
- * Validate URL format
93
- *
94
- * @param url - URL to validate
95
- * @param providerName - Provider name (for error messages)
96
- * @param fieldName - Field name (for error messages)
97
- * @throws ProviderValidationError if URL is invalid
98
- */
99
- private validateUrl(url: string, providerName: string, fieldName: string): void {
100
- try {
101
- const parsedUrl = new URL(url);
102
- if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
103
- throw new ProviderValidationError(
104
- `Provider "${providerName}" ${fieldName} must use HTTP or HTTPS protocol`,
105
- fieldName
106
- );
107
- }
108
- } catch (error) {
109
- if (error instanceof ProviderValidationError) {
110
- throw error;
111
- }
112
- throw new ProviderValidationError(
113
- `Provider "${providerName}" ${fieldName} is not a valid URL: ${error instanceof Error ? error.message : String(error)}`,
114
- fieldName
115
- );
116
- }
117
- }
118
-
119
- /**
120
- * Validate custom parameters don't override reserved OAuth parameters
121
- *
122
- * @param customParams - Custom parameters to validate
123
- * @param providerName - Provider name (for error messages)
124
- * @throws ProviderValidationError if reserved parameter is overridden
125
- */
126
- private validateCustomParams(
127
- customParams: Record<string, string>,
128
- providerName: string
129
- ): void {
130
- for (const [key, value] of Object.entries(customParams)) {
131
- const normalizedKey = key.toLowerCase();
132
- if (RESERVED_PARAMETERS.includes(normalizedKey as any)) {
133
- throw new ProviderValidationError(
134
- `Provider "${providerName}" custom parameter "${key}" conflicts with reserved OAuth parameter. Reserved parameters: ${RESERVED_PARAMETERS.join(", ")}`,
135
- `customParams.${key}`
136
- );
137
- }
138
- if (!value || value.trim().length === 0) {
139
- throw new ProviderValidationError(
140
- `Provider "${providerName}" custom parameter "${key}" has empty value`,
141
- `customParams.${key}`
142
- );
143
- }
144
- }
145
- }
146
-
147
- /**
148
- * Test provider endpoint reachability (optional)
149
- *
150
- * @param provider - Provider configuration
151
- * @param fetchProvider - Fetch implementation
152
- * @returns True if endpoint is reachable, false otherwise
153
- */
154
- async testProvider(
155
- provider: OAuthProvider,
156
- fetchProvider: typeof fetch
157
- ): Promise<boolean> {
158
- try {
159
- // Test authorization URL (HEAD request to avoid triggering OAuth flow)
160
- const authResponse = await fetchProvider(provider.authorizationUrl, {
161
- method: "HEAD",
162
- signal: AbortSignal.timeout(5000), // 5 second timeout
163
- });
164
- return authResponse.ok || authResponse.status === 405; // 405 Method Not Allowed is OK
165
- } catch (error) {
166
- return false;
167
- }
168
- }
169
- }
170
-
@@ -1,251 +0,0 @@
1
- /**
2
- * Session Registration Service
3
- *
4
- * Registers MCP sessions with the AgentShield dashboard, enabling
5
- * visibility into which MCP clients are connecting to agents.
6
- *
7
- * This is a fire-and-forget service - session registration should not
8
- * block tool execution or affect the user experience.
9
- *
10
- * @package @kya-os/mcp-i-core
11
- */
12
-
13
- import type {
14
- RegisterSessionRequest,
15
- RegisterSessionResponse,
16
- } from "@kya-os/contracts/agentshield-api";
17
- import {
18
- registerSessionRequestSchema,
19
- registerSessionResponseSchema,
20
- AGENTSHIELD_ENDPOINTS,
21
- } from "@kya-os/contracts/agentshield-api";
22
- import type { FetchProvider } from "../providers/base.js";
23
-
24
- /**
25
- * Configuration for the session registration service
26
- */
27
- export interface SessionRegistrationServiceConfig {
28
- /** Base URL for the AgentShield API (e.g., "https://kya.vouched.id") */
29
- baseUrl: string;
30
-
31
- /** API key for authentication */
32
- apiKey: string;
33
-
34
- /** Fetch provider for making HTTP requests (platform-agnostic) */
35
- fetchProvider: FetchProvider;
36
-
37
- /** Optional logger callback for diagnostics */
38
- logger?: (message: string, data?: unknown) => void;
39
-
40
- /** Timeout in milliseconds for the registration request (default: 5000) */
41
- timeoutMs?: number;
42
- }
43
-
44
- /**
45
- * Result of a session registration attempt
46
- */
47
- export interface SessionRegistrationResult {
48
- /** Whether registration was successful */
49
- success: boolean;
50
- /** Session ID that was registered */
51
- sessionId: string;
52
- /** Error message if registration failed */
53
- error?: string;
54
- }
55
-
56
- /**
57
- * Session Registration Service
58
- *
59
- * Registers MCP sessions with AgentShield for dashboard visibility.
60
- * Designed to be non-blocking - failures are logged but don't throw.
61
- */
62
- export class SessionRegistrationService {
63
- private config: Required<
64
- Omit<SessionRegistrationServiceConfig, "logger" | "timeoutMs">
65
- > & {
66
- logger: NonNullable<SessionRegistrationServiceConfig["logger"]>;
67
- timeoutMs: number;
68
- };
69
-
70
- constructor(config: SessionRegistrationServiceConfig) {
71
- this.config = {
72
- baseUrl: config.baseUrl,
73
- apiKey: config.apiKey,
74
- fetchProvider: config.fetchProvider,
75
- logger: config.logger || (() => {}),
76
- timeoutMs: config.timeoutMs ?? 5000,
77
- };
78
- }
79
-
80
- /**
81
- * Register a session with AgentShield
82
- *
83
- * This is a fire-and-forget operation. Failures are logged but don't throw.
84
- * The method returns quickly and doesn't block the caller.
85
- *
86
- * @param request - Session registration request data
87
- * @returns Result indicating success or failure
88
- */
89
- async registerSession(
90
- request: RegisterSessionRequest
91
- ): Promise<SessionRegistrationResult> {
92
- const sessionId = request.session_id;
93
-
94
- try {
95
- // Validate request
96
- const validationResult = registerSessionRequestSchema.safeParse(request);
97
- if (!validationResult.success) {
98
- const errorMsg = `Invalid session registration request: ${validationResult.error.message}`;
99
- this.config.logger("[SessionRegistration] Validation failed", {
100
- sessionId,
101
- error: errorMsg,
102
- });
103
- return { success: false, sessionId, error: errorMsg };
104
- }
105
-
106
- const url = `${this.config.baseUrl}${AGENTSHIELD_ENDPOINTS.SESSIONS}`;
107
-
108
- this.config.logger("[SessionRegistration] Registering session", {
109
- sessionId,
110
- agentDid: request.agent_did,
111
- clientName: request.client_info.name,
112
- url,
113
- });
114
-
115
- // Make the request with timeout
116
- const controller = new AbortController();
117
- const timeoutId = setTimeout(
118
- () => controller.abort(),
119
- this.config.timeoutMs
120
- );
121
-
122
- try {
123
- const response = await this.config.fetchProvider.fetch(url, {
124
- method: "POST",
125
- headers: {
126
- "Content-Type": "application/json",
127
- Authorization: `Bearer ${this.config.apiKey}`,
128
- },
129
- body: JSON.stringify(request),
130
- signal: controller.signal,
131
- });
132
-
133
- clearTimeout(timeoutId);
134
-
135
- if (!response.ok) {
136
- // Log error but don't throw - this is fire-and-forget
137
- const errorText = await response.text().catch(() => "Unknown error");
138
- this.config.logger("[SessionRegistration] Registration failed", {
139
- sessionId,
140
- status: response.status,
141
- error: errorText,
142
- });
143
- return {
144
- success: false,
145
- sessionId,
146
- error: `HTTP ${response.status}: ${errorText}`,
147
- };
148
- }
149
-
150
- // Parse response
151
- const responseData = (await response.json()) as {
152
- data?: RegisterSessionResponse;
153
- } & RegisterSessionResponse;
154
- const parseResult = registerSessionResponseSchema.safeParse(
155
- responseData.data || responseData
156
- );
157
-
158
- if (!parseResult.success) {
159
- this.config.logger(
160
- "[SessionRegistration] Invalid response format",
161
- {
162
- sessionId,
163
- response: responseData,
164
- }
165
- );
166
- // Still consider it a success if we got a 200 OK
167
- return { success: true, sessionId };
168
- }
169
-
170
- this.config.logger("[SessionRegistration] Session registered", {
171
- sessionId,
172
- registered: parseResult.data.registered,
173
- });
174
-
175
- return { success: true, sessionId };
176
- } finally {
177
- clearTimeout(timeoutId);
178
- }
179
- } catch (error) {
180
- // Handle abort/timeout
181
- if (error instanceof Error && error.name === "AbortError") {
182
- this.config.logger("[SessionRegistration] Request timed out", {
183
- sessionId,
184
- timeoutMs: this.config.timeoutMs,
185
- });
186
- return { success: false, sessionId, error: "Request timed out" };
187
- }
188
-
189
- // Log any other error
190
- const errorMsg =
191
- error instanceof Error ? error.message : "Unknown error";
192
- this.config.logger("[SessionRegistration] Unexpected error", {
193
- sessionId,
194
- error: errorMsg,
195
- });
196
- return { success: false, sessionId, error: errorMsg };
197
- }
198
- }
199
-
200
- /**
201
- * Fire-and-forget session registration
202
- *
203
- * Starts registration in the background without waiting for completion.
204
- * Useful when you want to register a session but not delay the response.
205
- *
206
- * @param request - Session registration request data
207
- */
208
- registerSessionAsync(request: RegisterSessionRequest): void {
209
- // Start registration in background - don't await
210
- this.registerSession(request).catch((error) => {
211
- // This should never happen since registerSession catches all errors,
212
- // but just in case
213
- this.config.logger("[SessionRegistration] Background registration failed", {
214
- sessionId: request.session_id,
215
- error: error instanceof Error ? error.message : "Unknown error",
216
- });
217
- });
218
- }
219
- }
220
-
221
- /**
222
- * Create a session registration service from common runtime config
223
- *
224
- * Helper function to create the service from typical environment config.
225
- */
226
- export function createSessionRegistrationService(options: {
227
- apiUrl: string;
228
- apiKey: string;
229
- fetchProvider: FetchProvider;
230
- logger?: (message: string, data?: unknown) => void;
231
- }): SessionRegistrationService | null {
232
- // Validate required config
233
- if (!options.apiUrl || !options.apiKey) {
234
- options.logger?.(
235
- "[SessionRegistration] Missing required config - session registration disabled",
236
- {
237
- hasApiUrl: !!options.apiUrl,
238
- hasApiKey: !!options.apiKey,
239
- }
240
- );
241
- return null;
242
- }
243
-
244
- return new SessionRegistrationService({
245
- baseUrl: options.apiUrl,
246
- apiKey: options.apiKey,
247
- fetchProvider: options.fetchProvider,
248
- logger: options.logger,
249
- });
250
- }
251
-