@kya-os/mcp-i-core 1.3.13 → 1.3.15

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (255) hide show
  1. package/dist/config/remote-config.js +9 -12
  2. package/dist/runtime/base.d.ts +2 -1
  3. package/dist/runtime/base.js +34 -6
  4. package/dist/services/access-control.service.js +5 -0
  5. package/dist/services/tool-protection.service.js +17 -8
  6. package/package.json +2 -2
  7. package/.turbo/turbo-build.log +0 -4
  8. package/.turbo/turbo-test$colon$coverage.log +0 -4586
  9. package/.turbo/turbo-test.log +0 -4631
  10. package/COMPLIANCE_IMPROVEMENT_REPORT.md +0 -483
  11. package/Composer 3.md +0 -615
  12. package/GPT-5.md +0 -1169
  13. package/OPUS-plan.md +0 -352
  14. package/PHASE_3_AND_4.1_SUMMARY.md +0 -585
  15. package/PHASE_3_SUMMARY.md +0 -317
  16. package/PHASE_4.1.3_SUMMARY.md +0 -428
  17. package/PHASE_4.1_COMPLETE.md +0 -525
  18. package/PHASE_4_USER_DID_IDENTITY_LINKING_PLAN.md +0 -1240
  19. package/SCHEMA_COMPLIANCE_REPORT.md +0 -275
  20. package/TEST_PLAN.md +0 -571
  21. package/coverage/coverage-final.json +0 -60
  22. package/dist/cache/oauth-config-cache.d.ts.map +0 -1
  23. package/dist/cache/oauth-config-cache.js.map +0 -1
  24. package/dist/cache/tool-protection-cache.d.ts.map +0 -1
  25. package/dist/cache/tool-protection-cache.js.map +0 -1
  26. package/dist/compliance/index.d.ts.map +0 -1
  27. package/dist/compliance/index.js.map +0 -1
  28. package/dist/compliance/schema-registry.d.ts.map +0 -1
  29. package/dist/compliance/schema-registry.js.map +0 -1
  30. package/dist/compliance/schema-verifier.d.ts.map +0 -1
  31. package/dist/compliance/schema-verifier.js.map +0 -1
  32. package/dist/config/remote-config.d.ts.map +0 -1
  33. package/dist/config/remote-config.js.map +0 -1
  34. package/dist/config.d.ts.map +0 -1
  35. package/dist/config.js.map +0 -1
  36. package/dist/delegation/audience-validator.d.ts.map +0 -1
  37. package/dist/delegation/audience-validator.js.map +0 -1
  38. package/dist/delegation/bitstring.d.ts.map +0 -1
  39. package/dist/delegation/bitstring.js.map +0 -1
  40. package/dist/delegation/cascading-revocation.d.ts.map +0 -1
  41. package/dist/delegation/cascading-revocation.js.map +0 -1
  42. package/dist/delegation/delegation-graph.d.ts.map +0 -1
  43. package/dist/delegation/delegation-graph.js.map +0 -1
  44. package/dist/delegation/did-key-resolver.d.ts.map +0 -1
  45. package/dist/delegation/did-key-resolver.js.map +0 -1
  46. package/dist/delegation/index.d.ts.map +0 -1
  47. package/dist/delegation/index.js.map +0 -1
  48. package/dist/delegation/statuslist-manager.d.ts.map +0 -1
  49. package/dist/delegation/statuslist-manager.js.map +0 -1
  50. package/dist/delegation/storage/index.d.ts.map +0 -1
  51. package/dist/delegation/storage/index.js.map +0 -1
  52. package/dist/delegation/storage/memory-graph-storage.d.ts.map +0 -1
  53. package/dist/delegation/storage/memory-graph-storage.js.map +0 -1
  54. package/dist/delegation/storage/memory-statuslist-storage.d.ts.map +0 -1
  55. package/dist/delegation/storage/memory-statuslist-storage.js.map +0 -1
  56. package/dist/delegation/utils.d.ts.map +0 -1
  57. package/dist/delegation/utils.js.map +0 -1
  58. package/dist/delegation/vc-issuer.d.ts.map +0 -1
  59. package/dist/delegation/vc-issuer.js.map +0 -1
  60. package/dist/delegation/vc-verifier.d.ts.map +0 -1
  61. package/dist/delegation/vc-verifier.js.map +0 -1
  62. package/dist/identity/idp-token-resolver.d.ts.map +0 -1
  63. package/dist/identity/idp-token-resolver.js.map +0 -1
  64. package/dist/identity/idp-token-storage.interface.d.ts.map +0 -1
  65. package/dist/identity/idp-token-storage.interface.js.map +0 -1
  66. package/dist/identity/user-did-manager.d.ts.map +0 -1
  67. package/dist/identity/user-did-manager.js.map +0 -1
  68. package/dist/index.d.ts.map +0 -1
  69. package/dist/index.js.map +0 -1
  70. package/dist/providers/base.d.ts.map +0 -1
  71. package/dist/providers/base.js.map +0 -1
  72. package/dist/providers/memory.d.ts.map +0 -1
  73. package/dist/providers/memory.js.map +0 -1
  74. package/dist/runtime/audit-logger.d.ts.map +0 -1
  75. package/dist/runtime/audit-logger.js.map +0 -1
  76. package/dist/runtime/base.d.ts.map +0 -1
  77. package/dist/runtime/base.js.map +0 -1
  78. package/dist/services/access-control.service.d.ts.map +0 -1
  79. package/dist/services/access-control.service.js.map +0 -1
  80. package/dist/services/authorization/authorization-registry.d.ts.map +0 -1
  81. package/dist/services/authorization/authorization-registry.js.map +0 -1
  82. package/dist/services/authorization/types.d.ts.map +0 -1
  83. package/dist/services/authorization/types.js.map +0 -1
  84. package/dist/services/batch-delegation.service.d.ts.map +0 -1
  85. package/dist/services/batch-delegation.service.js.map +0 -1
  86. package/dist/services/crypto.service.d.ts.map +0 -1
  87. package/dist/services/crypto.service.js.map +0 -1
  88. package/dist/services/errors.d.ts.map +0 -1
  89. package/dist/services/errors.js.map +0 -1
  90. package/dist/services/index.d.ts.map +0 -1
  91. package/dist/services/index.js.map +0 -1
  92. package/dist/services/oauth-config.service.d.ts.map +0 -1
  93. package/dist/services/oauth-config.service.js.map +0 -1
  94. package/dist/services/oauth-provider-registry.d.ts.map +0 -1
  95. package/dist/services/oauth-provider-registry.js.map +0 -1
  96. package/dist/services/oauth-service.d.ts.map +0 -1
  97. package/dist/services/oauth-service.js.map +0 -1
  98. package/dist/services/oauth-token-retrieval.service.d.ts.map +0 -1
  99. package/dist/services/oauth-token-retrieval.service.js.map +0 -1
  100. package/dist/services/proof-verifier.d.ts.map +0 -1
  101. package/dist/services/proof-verifier.js.map +0 -1
  102. package/dist/services/provider-resolver.d.ts.map +0 -1
  103. package/dist/services/provider-resolver.js.map +0 -1
  104. package/dist/services/provider-validator.d.ts.map +0 -1
  105. package/dist/services/provider-validator.js.map +0 -1
  106. package/dist/services/session-registration.service.d.ts.map +0 -1
  107. package/dist/services/session-registration.service.js.map +0 -1
  108. package/dist/services/storage.service.d.ts.map +0 -1
  109. package/dist/services/storage.service.js.map +0 -1
  110. package/dist/services/tool-context-builder.d.ts.map +0 -1
  111. package/dist/services/tool-context-builder.js.map +0 -1
  112. package/dist/services/tool-protection.service.d.ts.map +0 -1
  113. package/dist/services/tool-protection.service.js.map +0 -1
  114. package/dist/types/oauth-required-error.d.ts.map +0 -1
  115. package/dist/types/oauth-required-error.js.map +0 -1
  116. package/dist/types/tool-protection.d.ts.map +0 -1
  117. package/dist/types/tool-protection.js.map +0 -1
  118. package/dist/utils/base58.d.ts.map +0 -1
  119. package/dist/utils/base58.js.map +0 -1
  120. package/dist/utils/base64.d.ts.map +0 -1
  121. package/dist/utils/base64.js.map +0 -1
  122. package/dist/utils/cors.d.ts.map +0 -1
  123. package/dist/utils/cors.js.map +0 -1
  124. package/dist/utils/did-helpers.d.ts.map +0 -1
  125. package/dist/utils/did-helpers.js.map +0 -1
  126. package/dist/utils/index.d.ts.map +0 -1
  127. package/dist/utils/index.js.map +0 -1
  128. package/dist/utils/storage-keys.d.ts.map +0 -1
  129. package/dist/utils/storage-keys.js.map +0 -1
  130. package/docs/API_REFERENCE.md +0 -1362
  131. package/docs/COMPLIANCE_MATRIX.md +0 -691
  132. package/docs/STATUSLIST2021_GUIDE.md +0 -696
  133. package/docs/W3C_VC_DELEGATION_GUIDE.md +0 -710
  134. package/src/__tests__/cache/tool-protection-cache.test.ts +0 -640
  135. package/src/__tests__/config/provider-runtime-config.test.ts +0 -309
  136. package/src/__tests__/delegation-e2e.test.ts +0 -690
  137. package/src/__tests__/identity/user-did-manager.test.ts +0 -232
  138. package/src/__tests__/index.test.ts +0 -56
  139. package/src/__tests__/integration/full-flow.test.ts +0 -789
  140. package/src/__tests__/integration.test.ts +0 -281
  141. package/src/__tests__/providers/base.test.ts +0 -173
  142. package/src/__tests__/providers/memory.test.ts +0 -319
  143. package/src/__tests__/regression/phase2-regression.test.ts +0 -429
  144. package/src/__tests__/runtime/audit-logger.test.ts +0 -154
  145. package/src/__tests__/runtime/base-extensions.test.ts +0 -595
  146. package/src/__tests__/runtime/base.test.ts +0 -869
  147. package/src/__tests__/runtime/delegation-flow.test.ts +0 -164
  148. package/src/__tests__/runtime/proof-client-did.test.ts +0 -376
  149. package/src/__tests__/runtime/route-interception.test.ts +0 -686
  150. package/src/__tests__/runtime/tool-protection-enforcement.test.ts +0 -908
  151. package/src/__tests__/services/agentshield-integration.test.ts +0 -791
  152. package/src/__tests__/services/cache-busting.test.ts +0 -125
  153. package/src/__tests__/services/oauth-service-pkce.test.ts +0 -556
  154. package/src/__tests__/services/provider-resolver-edge-cases.test.ts +0 -591
  155. package/src/__tests__/services/tool-protection-merged-config.test.ts +0 -485
  156. package/src/__tests__/services/tool-protection-oauth-provider.test.ts +0 -480
  157. package/src/__tests__/services/tool-protection.service.test.ts +0 -1373
  158. package/src/__tests__/utils/mock-providers.ts +0 -340
  159. package/src/cache/oauth-config-cache.d.ts +0 -69
  160. package/src/cache/oauth-config-cache.d.ts.map +0 -1
  161. package/src/cache/oauth-config-cache.js.map +0 -1
  162. package/src/cache/oauth-config-cache.ts +0 -123
  163. package/src/cache/tool-protection-cache.ts +0 -171
  164. package/src/compliance/EXAMPLE.md +0 -412
  165. package/src/compliance/__tests__/schema-verifier.test.ts +0 -797
  166. package/src/compliance/index.ts +0 -8
  167. package/src/compliance/schema-registry.ts +0 -460
  168. package/src/compliance/schema-verifier.ts +0 -708
  169. package/src/config/__tests__/merged-config.spec.ts +0 -445
  170. package/src/config/__tests__/remote-config.spec.ts +0 -268
  171. package/src/config/remote-config.ts +0 -264
  172. package/src/config.ts +0 -312
  173. package/src/delegation/__tests__/audience-validator.test.ts +0 -112
  174. package/src/delegation/__tests__/bitstring.test.ts +0 -346
  175. package/src/delegation/__tests__/cascading-revocation.test.ts +0 -628
  176. package/src/delegation/__tests__/delegation-graph.test.ts +0 -584
  177. package/src/delegation/__tests__/did-key-resolver.test.ts +0 -265
  178. package/src/delegation/__tests__/utils.test.ts +0 -152
  179. package/src/delegation/__tests__/vc-issuer.test.ts +0 -442
  180. package/src/delegation/__tests__/vc-verifier.test.ts +0 -922
  181. package/src/delegation/audience-validator.ts +0 -52
  182. package/src/delegation/bitstring.ts +0 -278
  183. package/src/delegation/cascading-revocation.ts +0 -370
  184. package/src/delegation/delegation-graph.ts +0 -299
  185. package/src/delegation/did-key-resolver.ts +0 -179
  186. package/src/delegation/index.ts +0 -14
  187. package/src/delegation/statuslist-manager.ts +0 -353
  188. package/src/delegation/storage/__tests__/memory-graph-storage.test.ts +0 -366
  189. package/src/delegation/storage/__tests__/memory-statuslist-storage.test.ts +0 -228
  190. package/src/delegation/storage/index.ts +0 -9
  191. package/src/delegation/storage/memory-graph-storage.ts +0 -178
  192. package/src/delegation/storage/memory-statuslist-storage.ts +0 -77
  193. package/src/delegation/utils.ts +0 -221
  194. package/src/delegation/vc-issuer.ts +0 -232
  195. package/src/delegation/vc-verifier.ts +0 -568
  196. package/src/identity/idp-token-resolver.ts +0 -181
  197. package/src/identity/idp-token-storage.interface.ts +0 -94
  198. package/src/identity/user-did-manager.ts +0 -526
  199. package/src/index.ts +0 -310
  200. package/src/providers/base.d.ts +0 -91
  201. package/src/providers/base.d.ts.map +0 -1
  202. package/src/providers/base.js.map +0 -1
  203. package/src/providers/base.ts +0 -96
  204. package/src/providers/memory.ts +0 -142
  205. package/src/runtime/audit-logger.ts +0 -39
  206. package/src/runtime/base.ts +0 -1392
  207. package/src/services/__tests__/access-control.integration.test.ts +0 -443
  208. package/src/services/__tests__/access-control.proof-response-validation.test.ts +0 -578
  209. package/src/services/__tests__/access-control.service.test.ts +0 -970
  210. package/src/services/__tests__/batch-delegation.service.test.ts +0 -351
  211. package/src/services/__tests__/crypto.service.test.ts +0 -531
  212. package/src/services/__tests__/oauth-provider-registry.test.ts +0 -142
  213. package/src/services/__tests__/proof-verifier.integration.test.ts +0 -485
  214. package/src/services/__tests__/proof-verifier.test.ts +0 -489
  215. package/src/services/__tests__/provider-resolution.integration.test.ts +0 -202
  216. package/src/services/__tests__/provider-resolver.test.ts +0 -213
  217. package/src/services/__tests__/storage.service.test.ts +0 -358
  218. package/src/services/access-control.service.ts +0 -990
  219. package/src/services/authorization/authorization-registry.ts +0 -66
  220. package/src/services/authorization/types.ts +0 -71
  221. package/src/services/batch-delegation.service.ts +0 -137
  222. package/src/services/crypto.service.ts +0 -302
  223. package/src/services/errors.ts +0 -76
  224. package/src/services/index.ts +0 -18
  225. package/src/services/oauth-config.service.d.ts +0 -53
  226. package/src/services/oauth-config.service.d.ts.map +0 -1
  227. package/src/services/oauth-config.service.js.map +0 -1
  228. package/src/services/oauth-config.service.ts +0 -192
  229. package/src/services/oauth-provider-registry.d.ts +0 -57
  230. package/src/services/oauth-provider-registry.d.ts.map +0 -1
  231. package/src/services/oauth-provider-registry.js.map +0 -1
  232. package/src/services/oauth-provider-registry.ts +0 -141
  233. package/src/services/oauth-service.ts +0 -544
  234. package/src/services/oauth-token-retrieval.service.ts +0 -245
  235. package/src/services/proof-verifier.ts +0 -478
  236. package/src/services/provider-resolver.d.ts +0 -48
  237. package/src/services/provider-resolver.d.ts.map +0 -1
  238. package/src/services/provider-resolver.js.map +0 -1
  239. package/src/services/provider-resolver.ts +0 -146
  240. package/src/services/provider-validator.ts +0 -170
  241. package/src/services/session-registration.service.ts +0 -251
  242. package/src/services/storage.service.ts +0 -566
  243. package/src/services/tool-context-builder.ts +0 -237
  244. package/src/services/tool-protection.service.ts +0 -1070
  245. package/src/types/oauth-required-error.ts +0 -63
  246. package/src/types/tool-protection.ts +0 -155
  247. package/src/utils/__tests__/did-helpers.test.ts +0 -156
  248. package/src/utils/base58.ts +0 -109
  249. package/src/utils/base64.ts +0 -148
  250. package/src/utils/cors.ts +0 -83
  251. package/src/utils/did-helpers.ts +0 -210
  252. package/src/utils/index.ts +0 -8
  253. package/src/utils/storage-keys.ts +0 -278
  254. package/tsconfig.json +0 -21
  255. package/vitest.config.ts +0 -56
@@ -1,48 +0,0 @@
1
- /**
2
- * Provider Resolver
3
- *
4
- * Resolves OAuth provider for tools using priority-based resolution strategy.
5
- * Supports Phase 2+ tool-specific providers with backward compatibility for Phase 1.
6
- *
7
- * @package @kya-os/mcp-i-core
8
- */
9
- import type { ToolProtection } from "@kya-os/contracts/tool-protection";
10
- import type { OAuthProviderRegistry } from "./oauth-provider-registry.js";
11
- import type { OAuthConfigService } from "./oauth-config.service.js";
12
- /**
13
- * Resolves OAuth provider for tools with priority-based fallback strategy
14
- *
15
- * Priority order:
16
- * 1. Tool-specific oauthProvider field (Phase 2+ preferred)
17
- * 2. Scope prefix inference (fallback)
18
- * 3. First configured provider (Phase 1 compatibility fallback)
19
- * 4. Error if no provider can be resolved
20
- */
21
- export declare class ProviderResolver {
22
- private registry;
23
- private configService;
24
- constructor(registry: OAuthProviderRegistry, configService: OAuthConfigService);
25
- /**
26
- * Resolve OAuth provider for a tool
27
- *
28
- * @param toolProtection - Tool protection configuration
29
- * @param projectId - Project ID for fetching provider config
30
- * @returns Provider name (never null - throws if cannot resolve)
31
- * @throws Error if provider cannot be resolved
32
- */
33
- resolveProvider(toolProtection: ToolProtection, projectId: string): Promise<string>;
34
- /**
35
- * Infer provider from scope prefixes
36
- *
37
- * Used as Priority 2 fallback when oauthProvider is not specified.
38
- * Examples:
39
- * - github:repo:read → github
40
- * - gmail:read → google
41
- * - microsoft:calendar:read → microsoft
42
- *
43
- * @param scopes - Required scopes for the tool
44
- * @returns Provider name if uniquely inferred, null otherwise
45
- */
46
- private inferProviderFromScopes;
47
- }
48
- //# sourceMappingURL=provider-resolver.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"provider-resolver.d.ts","sourceRoot":"","sources":["provider-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;;;;;;;;GAQG;AACH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,aAAa;gBADb,QAAQ,EAAE,qBAAqB,EAC/B,aAAa,EAAE,kBAAkB;IAG3C;;;;;;;OAOG;IACG,eAAe,CACnB,cAAc,EAAE,cAAc,EAC9B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC;IA6ClB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,uBAAuB;CAoChC"}
@@ -1 +0,0 @@
1
- {"version":3,"file":"provider-resolver.js","sourceRoot":"","sources":["provider-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH;;;;;;;;GAQG;AACH,MAAM,OAAO,gBAAgB;IAEjB;IACA;IAFV,YACU,QAA+B,EAC/B,aAAiC;QADjC,aAAQ,GAAR,QAAQ,CAAuB;QAC/B,kBAAa,GAAb,aAAa,CAAoB;IACxC,CAAC;IAEJ;;;;;;;OAOG;IACH,KAAK,CAAC,eAAe,CACnB,cAA8B,EAC9B,SAAiB;QAEjB,0DAA0D;QAC1D,IAAI,cAAc,CAAC,aAAa,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CACb,aAAa,cAAc,CAAC,aAAa,iCAAiC,SAAS,KAAK;oBACtF,mCAAmC,CACtC,CAAC;YACJ,CAAC;YACD,OAAO,cAAc,CAAC,aAAa,CAAC;QACtC,CAAC;QAED,gDAAgD;QAChD,MAAM,gBAAgB,GAAG,IAAI,CAAC,uBAAuB,CACnD,cAAc,CAAC,cAAc,IAAI,EAAE,CACpC,CAAC;QACF,IAAI,gBAAgB,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpE,OAAO,CAAC,GAAG,CACT,yCAAyC,gBAAgB,eAAe,CACzE,CAAC;YACF,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,yEAAyE;QACzE,4BAA4B;QAC5B,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;QAClD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,4CAA4C;YAC5C,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CACV,0DAA0D;gBACxD,oCAAoC,iBAAiB,iBAAiB;gBACtE,qFAAqF,CACxF,CAAC;YACF,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QAED,mDAAmD;QACnD,MAAM,IAAI,KAAK,CACb,yDAAyD;YACvD,2GAA2G,SAAS,IAAI,CAC3H,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACK,uBAAuB,CAAC,MAAgB;QAC9C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mDAAmD;QACnD,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACzC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,mBAAmB;QACnB,MAAM,WAAW,GAA2B;YAC1C,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,QAAQ,EAAE,sBAAsB;YACvC,QAAQ,EAAE,QAAQ,EAAE,6DAA6D;YACjF,SAAS,EAAE,WAAW;YACtB,OAAO,EAAE,WAAW;YACpB,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,MAAM;SACb,CAAC;QAEF,uBAAuB;QACvB,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CACnE,CAAC;QAEF,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QAED,oEAAoE;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
@@ -1,146 +0,0 @@
1
- /**
2
- * Provider Resolver
3
- *
4
- * Resolves OAuth provider for tools using priority-based resolution strategy.
5
- * Supports Phase 2+ tool-specific providers with backward compatibility for Phase 1.
6
- *
7
- * @package @kya-os/mcp-i-core
8
- */
9
-
10
- import type { ToolProtection } from "@kya-os/contracts/tool-protection";
11
- import type { OAuthProviderRegistry } from "./oauth-provider-registry.js";
12
- import type { OAuthConfigService } from "./oauth-config.service.js";
13
-
14
- /**
15
- * Resolves OAuth provider for tools with priority-based fallback strategy
16
- *
17
- * Priority order:
18
- * 1. Tool-specific oauthProvider field (Phase 2+ preferred)
19
- * 2. Scope prefix inference (fallback)
20
- * 3. Project-configured provider from AgentShield dashboard
21
- * 4. Error if no provider can be resolved
22
- */
23
- export class ProviderResolver {
24
- constructor(
25
- private registry: OAuthProviderRegistry,
26
- private configService: OAuthConfigService
27
- ) {}
28
-
29
- /**
30
- * Resolve OAuth provider for a tool
31
- *
32
- * @param toolProtection - Tool protection configuration
33
- * @param projectId - Project ID for fetching provider config
34
- * @returns Provider name (never null - throws if cannot resolve)
35
- * @throws Error if provider cannot be resolved
36
- */
37
- async resolveProvider(
38
- toolProtection: ToolProtection,
39
- projectId: string
40
- ): Promise<string> {
41
- // Priority 1: Tool-specific provider (Phase 2+ preferred)
42
- if (toolProtection.oauthProvider) {
43
- // Ensure registry is loaded before checking
44
- if (this.registry.getProviderNames().length === 0) {
45
- await this.registry.loadFromAgentShield(projectId);
46
- }
47
- if (!this.registry.hasProvider(toolProtection.oauthProvider)) {
48
- throw new Error(
49
- `Provider "${toolProtection.oauthProvider}" not configured for project "${projectId}". ` +
50
- `Add provider in project settings.`
51
- );
52
- }
53
- return toolProtection.oauthProvider;
54
- }
55
-
56
- // Priority 2: Scope prefix inference (fallback)
57
- const inferredProvider = this.inferProviderFromScopes(
58
- toolProtection.requiredScopes || []
59
- );
60
- if (inferredProvider) {
61
- // Ensure registry is loaded before checking
62
- if (this.registry.getProviderNames().length === 0) {
63
- await this.registry.loadFromAgentShield(projectId);
64
- }
65
- if (this.registry.hasProvider(inferredProvider)) {
66
- console.log(
67
- `[ProviderResolver] Inferred provider "${inferredProvider}" from scopes`
68
- );
69
- return inferredProvider;
70
- }
71
- }
72
-
73
- // Priority 3: Use explicitly configured provider from AgentShield dashboard
74
- // This is the provider the user has actually configured, not just any available provider
75
- await this.registry.loadFromAgentShield(projectId);
76
- const configuredProvider = this.registry.getConfiguredProvider();
77
-
78
- if (configuredProvider && this.registry.hasProvider(configuredProvider)) {
79
- console.warn(
80
- `[ProviderResolver] Tool does not specify oauthProvider. ` +
81
- `Using project-configured provider "${configuredProvider}" as fallback. ` +
82
- `Consider explicitly setting oauthProvider in tool protection config.`
83
- );
84
- return configuredProvider;
85
- }
86
-
87
- // Priority 4: Error if no provider is configured
88
- // NOTE: We intentionally do NOT fall back to "first available provider" anymore
89
- // because AgentShield returns ALL providers (even unconfigured ones).
90
- // Only use providers explicitly configured by the user.
91
- throw new Error(
92
- `Tool requires OAuth but no provider is configured for project "${projectId}". ` +
93
- `Configure an OAuth provider in AgentShield dashboard.`
94
- );
95
- }
96
-
97
- /**
98
- * Infer provider from scope prefixes
99
- *
100
- * Used as Priority 2 fallback when oauthProvider is not specified.
101
- * Examples:
102
- * - github:repo:read → github
103
- * - gmail:read → google
104
- * - microsoft:calendar:read → microsoft
105
- *
106
- * @param scopes - Required scopes for the tool
107
- * @returns Provider name if uniquely inferred, null otherwise
108
- */
109
- private inferProviderFromScopes(scopes: string[]): string | null {
110
- if (!scopes || scopes.length === 0) {
111
- return null;
112
- }
113
-
114
- // Extract first part of scope (before first colon)
115
- const scopePrefixes = scopes.map((scope) => {
116
- const parts = scope.split(":");
117
- return parts[0].toLowerCase();
118
- });
119
-
120
- // Provider mapping
121
- const providerMap: Record<string, string> = {
122
- github: "github",
123
- google: "google",
124
- gmail: "google", // gmail:read → google
125
- calendar: "google", // calendar:read → google (if ambiguous, use project default)
126
- microsoft: "microsoft",
127
- outlook: "microsoft",
128
- slack: "slack",
129
- auth0: "auth0",
130
- okta: "okta",
131
- };
132
-
133
- // Find unique provider
134
- const providers = new Set(
135
- scopePrefixes.map((prefix) => providerMap[prefix]).filter(Boolean)
136
- );
137
-
138
- if (providers.size === 1) {
139
- return Array.from(providers)[0];
140
- }
141
-
142
- // Ambiguous or no prefix → return null (use project-level provider)
143
- return null;
144
- }
145
- }
146
-
@@ -1,170 +0,0 @@
1
- /**
2
- * Provider Validator
3
- *
4
- * Validates OAuth provider configurations for custom IDP support.
5
- * Ensures provider configurations are valid before registration.
6
- *
7
- * @package @kya-os/mcp-i-core
8
- */
9
-
10
- import type { OAuthProvider } from "@kya-os/contracts/config";
11
-
12
- /**
13
- * Reserved OAuth parameters that cannot be overridden by custom parameters
14
- */
15
- const RESERVED_PARAMETERS = [
16
- "response_type",
17
- "client_id",
18
- "redirect_uri",
19
- "scope",
20
- "state",
21
- "code_challenge",
22
- "code_challenge_method",
23
- ] as const;
24
-
25
- /**
26
- * Validation error for provider configuration issues
27
- */
28
- export class ProviderValidationError extends Error {
29
- constructor(message: string, public readonly field?: string) {
30
- super(message);
31
- this.name = "ProviderValidationError";
32
- }
33
- }
34
-
35
- /**
36
- * Service for validating OAuth provider configurations
37
- */
38
- export class ProviderValidator {
39
- /**
40
- * Validate provider configuration
41
- *
42
- * @param provider - Provider configuration to validate
43
- * @param name - Provider name (for error messages)
44
- * @throws ProviderValidationError if validation fails
45
- */
46
- validate(provider: OAuthProvider, name: string): void {
47
- // Validate required fields
48
- if (!provider.clientId || provider.clientId.trim().length === 0) {
49
- throw new ProviderValidationError(
50
- `Provider "${name}" must have a clientId`,
51
- "clientId"
52
- );
53
- }
54
-
55
- if (!provider.authorizationUrl || provider.authorizationUrl.trim().length === 0) {
56
- throw new ProviderValidationError(
57
- `Provider "${name}" must have an authorizationUrl`,
58
- "authorizationUrl"
59
- );
60
- }
61
-
62
- if (!provider.tokenUrl || provider.tokenUrl.trim().length === 0) {
63
- throw new ProviderValidationError(
64
- `Provider "${name}" must have a tokenUrl`,
65
- "tokenUrl"
66
- );
67
- }
68
-
69
- // Validate URL formats
70
- this.validateUrl(provider.authorizationUrl, name, "authorizationUrl");
71
- this.validateUrl(provider.tokenUrl, name, "tokenUrl");
72
-
73
- if (provider.userInfoUrl) {
74
- this.validateUrl(provider.userInfoUrl, name, "userInfoUrl");
75
- }
76
-
77
- // Validate proxy mode requirements
78
- if (provider.proxyMode && !provider.requiresClientSecret) {
79
- throw new ProviderValidationError(
80
- `Provider "${name}" with proxyMode=true must have requiresClientSecret=true`,
81
- "proxyMode"
82
- );
83
- }
84
-
85
- // Validate custom parameters don't conflict with reserved parameters
86
- if (provider.customParams) {
87
- this.validateCustomParams(provider.customParams, name);
88
- }
89
- }
90
-
91
- /**
92
- * Validate URL format
93
- *
94
- * @param url - URL to validate
95
- * @param providerName - Provider name (for error messages)
96
- * @param fieldName - Field name (for error messages)
97
- * @throws ProviderValidationError if URL is invalid
98
- */
99
- private validateUrl(url: string, providerName: string, fieldName: string): void {
100
- try {
101
- const parsedUrl = new URL(url);
102
- if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
103
- throw new ProviderValidationError(
104
- `Provider "${providerName}" ${fieldName} must use HTTP or HTTPS protocol`,
105
- fieldName
106
- );
107
- }
108
- } catch (error) {
109
- if (error instanceof ProviderValidationError) {
110
- throw error;
111
- }
112
- throw new ProviderValidationError(
113
- `Provider "${providerName}" ${fieldName} is not a valid URL: ${error instanceof Error ? error.message : String(error)}`,
114
- fieldName
115
- );
116
- }
117
- }
118
-
119
- /**
120
- * Validate custom parameters don't override reserved OAuth parameters
121
- *
122
- * @param customParams - Custom parameters to validate
123
- * @param providerName - Provider name (for error messages)
124
- * @throws ProviderValidationError if reserved parameter is overridden
125
- */
126
- private validateCustomParams(
127
- customParams: Record<string, string>,
128
- providerName: string
129
- ): void {
130
- for (const [key, value] of Object.entries(customParams)) {
131
- const normalizedKey = key.toLowerCase();
132
- if (RESERVED_PARAMETERS.includes(normalizedKey as any)) {
133
- throw new ProviderValidationError(
134
- `Provider "${providerName}" custom parameter "${key}" conflicts with reserved OAuth parameter. Reserved parameters: ${RESERVED_PARAMETERS.join(", ")}`,
135
- `customParams.${key}`
136
- );
137
- }
138
- if (!value || value.trim().length === 0) {
139
- throw new ProviderValidationError(
140
- `Provider "${providerName}" custom parameter "${key}" has empty value`,
141
- `customParams.${key}`
142
- );
143
- }
144
- }
145
- }
146
-
147
- /**
148
- * Test provider endpoint reachability (optional)
149
- *
150
- * @param provider - Provider configuration
151
- * @param fetchProvider - Fetch implementation
152
- * @returns True if endpoint is reachable, false otherwise
153
- */
154
- async testProvider(
155
- provider: OAuthProvider,
156
- fetchProvider: typeof fetch
157
- ): Promise<boolean> {
158
- try {
159
- // Test authorization URL (HEAD request to avoid triggering OAuth flow)
160
- const authResponse = await fetchProvider(provider.authorizationUrl, {
161
- method: "HEAD",
162
- signal: AbortSignal.timeout(5000), // 5 second timeout
163
- });
164
- return authResponse.ok || authResponse.status === 405; // 405 Method Not Allowed is OK
165
- } catch (error) {
166
- return false;
167
- }
168
- }
169
- }
170
-
@@ -1,251 +0,0 @@
1
- /**
2
- * Session Registration Service
3
- *
4
- * Registers MCP sessions with the AgentShield dashboard, enabling
5
- * visibility into which MCP clients are connecting to agents.
6
- *
7
- * This is a fire-and-forget service - session registration should not
8
- * block tool execution or affect the user experience.
9
- *
10
- * @package @kya-os/mcp-i-core
11
- */
12
-
13
- import type {
14
- RegisterSessionRequest,
15
- RegisterSessionResponse,
16
- } from "@kya-os/contracts/agentshield-api";
17
- import {
18
- registerSessionRequestSchema,
19
- registerSessionResponseSchema,
20
- AGENTSHIELD_ENDPOINTS,
21
- } from "@kya-os/contracts/agentshield-api";
22
- import type { FetchProvider } from "../providers/base.js";
23
-
24
- /**
25
- * Configuration for the session registration service
26
- */
27
- export interface SessionRegistrationServiceConfig {
28
- /** Base URL for the AgentShield API (e.g., "https://kya.vouched.id") */
29
- baseUrl: string;
30
-
31
- /** API key for authentication */
32
- apiKey: string;
33
-
34
- /** Fetch provider for making HTTP requests (platform-agnostic) */
35
- fetchProvider: FetchProvider;
36
-
37
- /** Optional logger callback for diagnostics */
38
- logger?: (message: string, data?: unknown) => void;
39
-
40
- /** Timeout in milliseconds for the registration request (default: 5000) */
41
- timeoutMs?: number;
42
- }
43
-
44
- /**
45
- * Result of a session registration attempt
46
- */
47
- export interface SessionRegistrationResult {
48
- /** Whether registration was successful */
49
- success: boolean;
50
- /** Session ID that was registered */
51
- sessionId: string;
52
- /** Error message if registration failed */
53
- error?: string;
54
- }
55
-
56
- /**
57
- * Session Registration Service
58
- *
59
- * Registers MCP sessions with AgentShield for dashboard visibility.
60
- * Designed to be non-blocking - failures are logged but don't throw.
61
- */
62
- export class SessionRegistrationService {
63
- private config: Required<
64
- Omit<SessionRegistrationServiceConfig, "logger" | "timeoutMs">
65
- > & {
66
- logger: NonNullable<SessionRegistrationServiceConfig["logger"]>;
67
- timeoutMs: number;
68
- };
69
-
70
- constructor(config: SessionRegistrationServiceConfig) {
71
- this.config = {
72
- baseUrl: config.baseUrl,
73
- apiKey: config.apiKey,
74
- fetchProvider: config.fetchProvider,
75
- logger: config.logger || (() => {}),
76
- timeoutMs: config.timeoutMs ?? 5000,
77
- };
78
- }
79
-
80
- /**
81
- * Register a session with AgentShield
82
- *
83
- * This is a fire-and-forget operation. Failures are logged but don't throw.
84
- * The method returns quickly and doesn't block the caller.
85
- *
86
- * @param request - Session registration request data
87
- * @returns Result indicating success or failure
88
- */
89
- async registerSession(
90
- request: RegisterSessionRequest
91
- ): Promise<SessionRegistrationResult> {
92
- const sessionId = request.session_id;
93
-
94
- try {
95
- // Validate request
96
- const validationResult = registerSessionRequestSchema.safeParse(request);
97
- if (!validationResult.success) {
98
- const errorMsg = `Invalid session registration request: ${validationResult.error.message}`;
99
- this.config.logger("[SessionRegistration] Validation failed", {
100
- sessionId,
101
- error: errorMsg,
102
- });
103
- return { success: false, sessionId, error: errorMsg };
104
- }
105
-
106
- const url = `${this.config.baseUrl}${AGENTSHIELD_ENDPOINTS.SESSIONS}`;
107
-
108
- this.config.logger("[SessionRegistration] Registering session", {
109
- sessionId,
110
- agentDid: request.agent_did,
111
- clientName: request.client_info.name,
112
- url,
113
- });
114
-
115
- // Make the request with timeout
116
- const controller = new AbortController();
117
- const timeoutId = setTimeout(
118
- () => controller.abort(),
119
- this.config.timeoutMs
120
- );
121
-
122
- try {
123
- const response = await this.config.fetchProvider.fetch(url, {
124
- method: "POST",
125
- headers: {
126
- "Content-Type": "application/json",
127
- Authorization: `Bearer ${this.config.apiKey}`,
128
- },
129
- body: JSON.stringify(request),
130
- signal: controller.signal,
131
- });
132
-
133
- clearTimeout(timeoutId);
134
-
135
- if (!response.ok) {
136
- // Log error but don't throw - this is fire-and-forget
137
- const errorText = await response.text().catch(() => "Unknown error");
138
- this.config.logger("[SessionRegistration] Registration failed", {
139
- sessionId,
140
- status: response.status,
141
- error: errorText,
142
- });
143
- return {
144
- success: false,
145
- sessionId,
146
- error: `HTTP ${response.status}: ${errorText}`,
147
- };
148
- }
149
-
150
- // Parse response
151
- const responseData = (await response.json()) as {
152
- data?: RegisterSessionResponse;
153
- } & RegisterSessionResponse;
154
- const parseResult = registerSessionResponseSchema.safeParse(
155
- responseData.data || responseData
156
- );
157
-
158
- if (!parseResult.success) {
159
- this.config.logger(
160
- "[SessionRegistration] Invalid response format",
161
- {
162
- sessionId,
163
- response: responseData,
164
- }
165
- );
166
- // Still consider it a success if we got a 200 OK
167
- return { success: true, sessionId };
168
- }
169
-
170
- this.config.logger("[SessionRegistration] Session registered", {
171
- sessionId,
172
- registered: parseResult.data.registered,
173
- });
174
-
175
- return { success: true, sessionId };
176
- } finally {
177
- clearTimeout(timeoutId);
178
- }
179
- } catch (error) {
180
- // Handle abort/timeout
181
- if (error instanceof Error && error.name === "AbortError") {
182
- this.config.logger("[SessionRegistration] Request timed out", {
183
- sessionId,
184
- timeoutMs: this.config.timeoutMs,
185
- });
186
- return { success: false, sessionId, error: "Request timed out" };
187
- }
188
-
189
- // Log any other error
190
- const errorMsg =
191
- error instanceof Error ? error.message : "Unknown error";
192
- this.config.logger("[SessionRegistration] Unexpected error", {
193
- sessionId,
194
- error: errorMsg,
195
- });
196
- return { success: false, sessionId, error: errorMsg };
197
- }
198
- }
199
-
200
- /**
201
- * Fire-and-forget session registration
202
- *
203
- * Starts registration in the background without waiting for completion.
204
- * Useful when you want to register a session but not delay the response.
205
- *
206
- * @param request - Session registration request data
207
- */
208
- registerSessionAsync(request: RegisterSessionRequest): void {
209
- // Start registration in background - don't await
210
- this.registerSession(request).catch((error) => {
211
- // This should never happen since registerSession catches all errors,
212
- // but just in case
213
- this.config.logger("[SessionRegistration] Background registration failed", {
214
- sessionId: request.session_id,
215
- error: error instanceof Error ? error.message : "Unknown error",
216
- });
217
- });
218
- }
219
- }
220
-
221
- /**
222
- * Create a session registration service from common runtime config
223
- *
224
- * Helper function to create the service from typical environment config.
225
- */
226
- export function createSessionRegistrationService(options: {
227
- apiUrl: string;
228
- apiKey: string;
229
- fetchProvider: FetchProvider;
230
- logger?: (message: string, data?: unknown) => void;
231
- }): SessionRegistrationService | null {
232
- // Validate required config
233
- if (!options.apiUrl || !options.apiKey) {
234
- options.logger?.(
235
- "[SessionRegistration] Missing required config - session registration disabled",
236
- {
237
- hasApiUrl: !!options.apiUrl,
238
- hasApiKey: !!options.apiKey,
239
- }
240
- );
241
- return null;
242
- }
243
-
244
- return new SessionRegistrationService({
245
- baseUrl: options.apiUrl,
246
- apiKey: options.apiKey,
247
- fetchProvider: options.fetchProvider,
248
- logger: options.logger,
249
- });
250
- }
251
-