@kya-os/mcp-i-core 1.3.13 → 1.3.15

package/src/config/remote-config.ts

@@ -1,264 +0,0 @@
-/**
- * Remote Configuration Fetching
- *
- * Service for fetching configuration from remote APIs (AgentShield dashboard)
- * with caching support for performance optimization.
- *
- * @module @kya-os/mcp-i-core/config/remote-config
- */
-
-import type { MCPIConfig } from '@kya-os/contracts/config';
-import type { MergedMCPIServerConfig } from '@kya-os/contracts/dashboard-config';
-import type { ToolProtection, ToolProtectionMap } from '@kya-os/contracts/tool-protection';
-import { AGENTSHIELD_ENDPOINTS } from '@kya-os/contracts/agentshield-api';
-
-/**
- * Options for fetching remote configuration
- */
-export interface RemoteConfigOptions {
-  /**
-   * API base URL
-   * @example 'https://kya.vouched.id'
-   */
-  apiUrl: string;
-
-  /**
-   * API key for authentication
-   */
-  apiKey: string;
-
-  /**
-   * Project ID (optional, preferred over agentDid)
-   * Used for project-scoped configuration
-   */
-  projectId?: string;
-
-  /**
-   * Agent DID (optional, used when projectId not available)
-   * Used for agent-scoped configuration
-   */
-  agentDid?: string;
-
-  /**
-   * Cache TTL in milliseconds
-   * @default 300000 (5 minutes)
-   */
-  cacheTtl?: number;
-
-  /**
-   * Fetch provider function
-   * Platform-agnostic fetch implementation
-   */
-  fetchProvider: (url: string, options: RequestInit) => Promise<Response>;
-}
-
-/**
- * Cache interface for remote configuration
- * Abstracts platform-specific caching (KV, Redis, Memory, etc.)
- */
-export interface RemoteConfigCache {
-  /**
-   * Get a cached value
-   */
-  get(key: string): Promise<string | null>;
-
-  /**
-   * Set a cached value with TTL
-   */
-  set(key: string, value: string, ttl: number): Promise<void>;
-}
-
-/**
- * Fetch configuration from remote API (AgentShield dashboard)
- *
- * Attempts to fetch configuration from the AgentShield API with caching support.
- * Falls back gracefully if remote fetch fails.
- *
- * @param options - Remote config options
- * @param cache - Optional cache implementation
- * @returns Configuration object or null if fetch fails
- */
-export async function fetchRemoteConfig(
-  options: RemoteConfigOptions,
-  cache?: RemoteConfigCache
-): Promise<MCPIConfig | null> {
-  const { apiUrl, apiKey, projectId, agentDid, cacheTtl = 300000, fetchProvider } = options;
-
-  // Generate cache key
-  const cacheKey = projectId 
-    ? `config:project:${projectId}`
-    : agentDid 
-    ? `config:agent:${agentDid}`
-    : null;
-
-  // Try cache first
-  if (cache && cacheKey) {
-    try {
-      const cached = await cache.get(cacheKey);
-      if (cached) {
-        try {
-          const parsed = JSON.parse(cached) as { config: MCPIConfig; expiresAt: number };
-          if (parsed.expiresAt > Date.now()) {
-            return parsed.config;
-          }
-        } catch {
-          // Invalid cache entry, continue to fetch
-        }
-      }
-    } catch (error) {
-      // Cache read failed, continue to fetch
-      console.warn('[RemoteConfig] Cache read failed:', error);
-    }
-  }
-
-  // Fetch from API
-  try {
-    // Build API URL
-    let url: string;
-    if (projectId) {
-      // Use project-scoped endpoint (preferred)
-      url = `${apiUrl}${AGENTSHIELD_ENDPOINTS.CONFIG(projectId)}`;
-    } else if (agentDid) {
-      // Use agent-scoped endpoint
-      url = `${apiUrl}/api/v1/bouncer/config?agent_did=${encodeURIComponent(agentDid)}`;
-    } else {
-      console.warn('[RemoteConfig] Neither projectId nor agentDid provided');
-      return null;
-    }
-
-    const response = await fetchProvider(url, {
-      headers: {
-        'Authorization': `Bearer ${apiKey}`,
-        'Content-Type': 'application/json'
-      }
-    });
-
-    if (!response.ok) {
-      console.warn(`[RemoteConfig] API returned ${response.status}: ${response.statusText}`);
-      return null;
-    }
-
-    const data = await response.json();
-    
-    // Extract config from API response
-    // API response format: { success: boolean, data: { config: MCPIConfig } }
-    const responseData = data as { config?: MCPIConfig; data?: { config?: MCPIConfig }; success?: boolean };
-    const config = responseData.config || responseData.data?.config || (responseData.success ? responseData.data as MCPIConfig | null : null) as MCPIConfig | null;
-
-    if (!config) {
-      console.warn('[RemoteConfig] No config found in API response');
-      return null;
-    }
-
-    // Cache the result
-    if (cache && cacheKey) {
-      try {
-        await cache.set(
-          cacheKey,
-          JSON.stringify({
-            config,
-            expiresAt: Date.now() + cacheTtl
-          }),
-          cacheTtl
-        );
-      } catch (error) {
-        // Cache write failed, but we got the config so continue
-        console.warn('[RemoteConfig] Cache write failed:', error);
-      }
-    }
-
-    return config as MCPIConfig;
-  } catch (error) {
-    console.warn('[RemoteConfig] Failed to fetch config:', error);
-    return null;
-  }
-}
-
-/**
- * Get tool protection for a specific tool from a merged config
- *
- * This helper function extracts tool protection from a merged config response.
- * It handles both the new format (toolProtection.tools) and returns null
- * for unprotected or unknown tools.
- *
- * @param config - Merged config object (must have toolProtection.tools)
- * @param toolName - Name of the tool to look up
- * @returns Tool protection or null if tool not protected or not found
- *
- * @since 1.6.0
- */
-export function getToolProtection(
-  config: { toolProtection?: { tools?: ToolProtectionMap } },
-  toolName: string
-): ToolProtection | null {
-  const tools = config?.toolProtection?.tools;
-  
-  if (!tools) {
-    return null;
-  }
-
-  // Check for specific tool protection first
-  let protection = tools[toolName];
-  
-  // Fall back to wildcard protection if specific tool not found
-  if (!protection && tools['*']) {
-    protection = tools['*'];
-  }
-  
-  // Return null for unprotected tools (requiresDelegation: false) or unknown tools
-  if (!protection || !protection.requiresDelegation) {
-    return null;
-  }
-  
-  return protection;
-}
-
-/**
- * Extract tool protections map from merged config
- *
- * This helper function extracts the tool protections map from a merged config.
- * Returns an empty object if no tools are found.
- *
- * @param config - Config object that may contain toolProtection.tools
- * @returns Tool protection map or empty object
- *
- * @since 1.6.0
- */
-export function extractToolProtections(
-  config: { toolProtection?: { tools?: ToolProtectionMap } } | null | undefined
-): ToolProtectionMap {
-  if (!config?.toolProtection?.tools) {
-    return {};
-  }
-  return config.toolProtection.tools;
-}
-
-/**
- * Check if config has embedded tool protections
- *
- * Utility to check if a config response is in the new merged format
- * with embedded tool protections.
- *
- * @param config - Config object to check
- * @returns True if config has embedded tools, false otherwise
- *
- * @since 1.6.0
- */
-export function hasMergedToolProtections(
-  config: unknown
-): config is { toolProtection: { tools: ToolProtectionMap } } {
-  if (!config || typeof config !== 'object') {
-    return false;
-  }
-  
-  const c = config as { toolProtection?: { tools?: unknown } };
-  return (
-    c.toolProtection !== undefined &&
-    typeof c.toolProtection === 'object' &&
-    c.toolProtection !== null &&
-    'tools' in c.toolProtection &&
-    typeof c.toolProtection.tools === 'object' &&
-    c.toolProtection.tools !== null // typeof null === 'object' in JS
-  );
-}
-

package/src/config.ts

@@ -1,312 +0,0 @@
-/**
- * Provider-based Runtime Configuration
- *
- * Core configuration for MCP-I runtime using the provider pattern.
- * This is the foundation for all platform-specific implementations.
- *
- * @module @kya-os/mcp-i-core/config
- */
-
-import type {
-  MCPIBaseConfig,
-  RuntimeIdentityConfig,
-  ProofingConfig,
-  DelegationConfig,
-  ToolProtectionSourceConfig
-} from '@kya-os/contracts/config';
-
-import type {
-  CryptoProvider,
-  ClockProvider,
-  FetchProvider,
-  StorageProvider,
-  NonceCacheProvider,
-  IdentityProvider
-} from './providers/base';
-
-import type { ToolProtectionService } from './services/tool-protection.service';
-
-/**
- * Provider-based runtime configuration
- *
- * This configuration is used internally by MCPIRuntimeBase and provides
- * the foundation for all platform-specific implementations. It uses the
- * provider pattern for platform abstraction, allowing different implementations
- * for Node.js, Cloudflare Workers, and other environments.
- */
-export interface ProviderRuntimeConfig extends MCPIBaseConfig {
-  /**
-   * Cryptographic operations provider
-   * Handles signing, verification, and key generation
-   */
-  cryptoProvider: CryptoProvider;
-
-  /**
-   * Time operations provider
-   * Provides current time and timestamp generation
-   */
-  clockProvider: ClockProvider;
-
-  /**
-   * HTTP fetch operations provider
-   * Handles external API calls
-   */
-  fetchProvider: FetchProvider;
-
-  /**
-   * Storage operations provider
-   * Handles persistent data storage
-   */
-  storageProvider: StorageProvider;
-
-  /**
-   * Nonce cache provider
-   * Handles replay prevention
-   */
-  nonceCacheProvider: NonceCacheProvider;
-
-  /**
-   * Identity management provider
-   * Handles agent identity and DID operations
-   */
-  identityProvider: IdentityProvider;
-
-  /**
-   * Session configuration
-   * Controls session handling and timeouts
-   */
-  session?: {
-    /**
-     * Allowed timestamp skew in seconds
-     * @default 120
-     */
-    timestampSkewSeconds?: number;
-
-    /**
-     * Session TTL in minutes
-     * @default 30
-     */
-    ttlMinutes?: number;
-  };
-
-  /**
-   * Identity configuration (optional)
-   * When provided, enables identity features
-   */
-  identity?: RuntimeIdentityConfig;
-
-  /**
-   * Proofing configuration (optional)
-   * When provided, enables proof generation
-   */
-  proofing?: ProofingConfig;
-
-  /**
-   * Delegation configuration (optional)
-   * When provided, enables delegation verification
-   */
-  delegation?: DelegationConfig;
-
-  /**
-   * Tool protection service (optional)
-   * When provided, enables runtime tool protection
-   * Note: This is different from tool registry which is compile-time
-   */
-  toolProtectionService?: ToolProtectionService;
-
-  /**
-   * Tool protection source configuration (optional)
-   * Alternative to toolProtectionService for configuration-based setup
-   */
-  toolProtection?: ToolProtectionSourceConfig;
-}
-
-/**
- * Builder for provider runtime configuration
- * Helps create valid configurations with proper defaults
- */
-export class ProviderRuntimeConfigBuilder {
-  private config: Partial<ProviderRuntimeConfig> = {
-    environment: 'development'
-  };
-
-  /**
-   * Set the providers (required)
-   */
-  withProviders(providers: {
-    cryptoProvider: CryptoProvider;
-    clockProvider: ClockProvider;
-    fetchProvider: FetchProvider;
-    storageProvider: StorageProvider;
-    nonceCacheProvider: NonceCacheProvider;
-    identityProvider: IdentityProvider;
-  }): this {
-    Object.assign(this.config, providers);
-    return this;
-  }
-
-  /**
-   * Set the environment
-   */
-  withEnvironment(env: 'development' | 'production'): this {
-    this.config.environment = env;
-    return this;
-  }
-
-  /**
-   * Configure session handling
-   */
-  withSession(session: {
-    timestampSkewSeconds?: number;
-    ttlMinutes?: number;
-  }): this {
-    this.config.session = session;
-    return this;
-  }
-
-  /**
-   * Enable identity features
-   */
-  withIdentity(identity: RuntimeIdentityConfig): this {
-    this.config.identity = identity;
-    return this;
-  }
-
-  /**
-   * Enable proofing features
-   */
-  withProofing(proofing: ProofingConfig): this {
-    this.config.proofing = proofing;
-    return this;
-  }
-
-  /**
-   * Enable delegation features
-   */
-  withDelegation(delegation: DelegationConfig): this {
-    this.config.delegation = delegation;
-    return this;
-  }
-
-  /**
-   * Set tool protection service
-   */
-  withToolProtectionService(service: ToolProtectionService): this {
-    this.config.toolProtectionService = service;
-    return this;
-  }
-
-  /**
-   * Set tool protection configuration
-   */
-  withToolProtection(config: ToolProtectionSourceConfig): this {
-    this.config.toolProtection = config;
-    return this;
-  }
-
-  /**
-   * Enable audit features
-   */
-  withAudit(audit: {
-    enabled: boolean;
-    includeProofHashes?: boolean;
-  }): this {
-    this.config.audit = audit;
-    return this;
-  }
-
-  /**
-   * Enable well-known endpoints
-   */
-  withWellKnown(wellKnown: {
-    enabled: boolean;
-    serviceName?: string;
-  }): this {
-    this.config.wellKnown = wellKnown;
-    return this;
-  }
-
-  /**
-   * Build the configuration
-   * Validates that all required providers are set
-   */
-  build(): ProviderRuntimeConfig {
-    const required = [
-      'cryptoProvider',
-      'clockProvider',
-      'fetchProvider',
-      'storageProvider',
-      'nonceCacheProvider',
-      'identityProvider'
-    ];
-
-    for (const field of required) {
-      if (!(field in this.config)) {
-        throw new Error(`Missing required provider: ${field}`);
-      }
-    }
-
-    // Apply defaults
-    return {
-      environment: 'development',
-      session: {
-        timestampSkewSeconds: 120,
-        ttlMinutes: 30
-      },
-      ...this.config
-    } as ProviderRuntimeConfig;
-  }
-}
-
-/**
- * Re-export base types for convenience
- */
-export type {
-  MCPIBaseConfig,
-  RuntimeIdentityConfig as BaseIdentityConfig,
-  ProofingConfig,
-  DelegationConfig,
-  ToolProtectionSourceConfig
-} from '@kya-os/contracts/config';
-
-/**
- * Re-export remote config utilities
- */
-export {
-  fetchRemoteConfig,
-  getToolProtection,
-  extractToolProtections,
-  hasMergedToolProtections,
-  type RemoteConfigOptions,
-  type RemoteConfigCache
-} from './config/remote-config';
-
-/**
- * Create a provider runtime configuration
- * Convenience function for creating configurations
- */
-export function createProviderRuntimeConfig(
-  providers: {
-    cryptoProvider: CryptoProvider;
-    clockProvider: ClockProvider;
-    fetchProvider: FetchProvider;
-    storageProvider: StorageProvider;
-    nonceCacheProvider: NonceCacheProvider;
-    identityProvider: IdentityProvider;
-  },
-  options?: Partial<Omit<ProviderRuntimeConfig, keyof typeof providers>>
-): ProviderRuntimeConfig {
-  return new ProviderRuntimeConfigBuilder()
-    .withProviders(providers)
-    .withEnvironment(options?.environment || 'development')
-    .withSession(options?.session || {})
-    .withIdentity(options?.identity || { enabled: false, environment: 'development' })
-    .withProofing(options?.proofing || { enabled: false })
-    .withDelegation(options?.delegation || {
-      enabled: false,
-      verifier: { type: 'memory' }
-    })
-    .withAudit(options?.audit || { enabled: false })
-    .withWellKnown(options?.wellKnown || { enabled: true })
-    .build();
-}

package/src/delegation/__tests__/audience-validator.test.ts

@@ -1,112 +0,0 @@
-/**
- * Tests for Delegation Audience Validation
- *
- * @package @kya-os/mcp-i-core/delegation/__tests__
- */
-
-import { describe, it, expect } from "vitest";
-import { verifyDelegationAudience } from "../audience-validator";
-import type { DelegationRecord } from "@kya-os/contracts/delegation";
-
-describe("verifyDelegationAudience", () => {
-  const serverDid = "did:web:server.example.com";
-
-  it("should return true when delegation has no audience", () => {
-    const delegation: DelegationRecord = {
-      id: "del_001",
-      issuerDid: "did:web:user.com",
-      subjectDid: "did:key:zagent123",
-      controller: "user_alice",
-      vcId: "vc_001",
-      constraints: {
-        scopes: ["tool:execute"],
-        // No audience field
-      },
-      createdAt: Date.now(),
-      expiresAt: Date.now() + 3600000,
-    };
-
-    expect(verifyDelegationAudience(delegation, serverDid)).toBe(true);
-  });
-
-  it("should return true when delegation audience matches server DID", () => {
-    const delegation: DelegationRecord = {
-      id: "del_002",
-      issuerDid: "did:web:user.com",
-      subjectDid: "did:key:zagent123",
-      controller: "user_bob",
-      vcId: "vc_002",
-      constraints: {
-        scopes: ["tool:execute"],
-        audience: serverDid, // Matches server DID
-      },
-      createdAt: Date.now(),
-      expiresAt: Date.now() + 3600000,
-    };
-
-    expect(verifyDelegationAudience(delegation, serverDid)).toBe(true);
-  });
-
-  it("should return false when delegation audience does not match server DID", () => {
-    const delegation: DelegationRecord = {
-      id: "del_003",
-      issuerDid: "did:web:user.com",
-      subjectDid: "did:key:zagent123",
-      controller: "user_charlie",
-      vcId: "vc_003",
-      constraints: {
-        scopes: ["tool:execute"],
-        audience: "did:web:other-server.com", // Different server
-      },
-      createdAt: Date.now(),
-      expiresAt: Date.now() + 3600000,
-    };
-
-    expect(verifyDelegationAudience(delegation, serverDid)).toBe(false);
-  });
-
-  it("should return true when server DID is in audience array", () => {
-    const delegation: DelegationRecord = {
-      id: "del_004",
-      issuerDid: "did:web:user.com",
-      subjectDid: "did:key:zagent123",
-      controller: "user_dave",
-      vcId: "vc_004",
-      constraints: {
-        scopes: ["tool:execute"],
-        audience: [
-          "did:web:server1.com",
-          serverDid, // Server DID is in array
-          "did:web:server3.com",
-        ],
-      },
-      createdAt: Date.now(),
-      expiresAt: Date.now() + 3600000,
-    };
-
-    expect(verifyDelegationAudience(delegation, serverDid)).toBe(true);
-  });
-
-  it("should return false when server DID is not in audience array", () => {
-    const delegation: DelegationRecord = {
-      id: "del_005",
-      issuerDid: "did:web:user.com",
-      subjectDid: "did:key:zagent123",
-      controller: "user_eve",
-      vcId: "vc_005",
-      constraints: {
-        scopes: ["tool:execute"],
-        audience: [
-          "did:web:server1.com",
-          "did:web:server2.com",
-          // serverDid not in array
-        ],
-      },
-      createdAt: Date.now(),
-      expiresAt: Date.now() + 3600000,
-    };
-
-    expect(verifyDelegationAudience(delegation, serverDid)).toBe(false);
-  });
-});
-