@kya-os/mcp-i-core 1.3.14 → 1.3.16

package/dist/identity/idp-token-storage.interface.d.ts

@@ -33,6 +33,13 @@ export interface TokenUsageMetadata {
     cookieFormat?: string;
     /** Additional headers to include in API calls */
     apiHeaders?: Record<string, string>;
+    /**
+     * User ID extracted from credential provider response
+     *
+     * For credential providers, this is the userId extracted via responseFields.userId.
+     * This is passed to tool handlers via ToolExecutionContext.userId.
+     */
+    userId?: string;
 }
 /**
  * Extended IdpTokens with usage metadata (CRED-003)

package/dist/runtime/base.d.ts

@@ -122,9 +122,10 @@ export declare class MCPIRuntimeBase {
      * @param session - Current session context
      * @param resumeToken - Token to resume after delegation
      * @param projectId - Project ID for AgentShield API
+     * @param provider - Provider name (e.g., "github", "credentials") to select specific auth method
      * @returns Full consent URL with snake_case parameters
      */
-    protected buildConsentUrl(toolName: string, scopes: string[], session?: any, resumeToken?: string, projectId?: string): string;
+    protected buildConsentUrl(toolName: string, scopes: string[], session?: any, resumeToken?: string, projectId?: string, provider?: string): string;
     /**
      * Issue a new nonce and register it in the cache
      * Use this to get a nonce for the session context before calling processToolCall

package/dist/runtime/base.js

@@ -271,7 +271,10 @@ class MCPIRuntimeBase {
                     const resumeToken = this.generateResumeToken(interceptedCall);
                     // Build consent URL with resume token
                     // Note: projectId is not available in base class - subclasses should override buildConsentUrl
-                    const consentUrl = this.buildConsentUrl(toolName, protection.requiredScopes, session, resumeToken);
+                    // Pass oauthProvider to ensure correct auth method is selected (e.g., "credentials" vs "github")
+                    const consentUrl = this.buildConsentUrl(toolName, protection.requiredScopes, session, resumeToken, undefined, // projectId - handled by subclass override
+                    protection.oauthProvider // Provider from tool config
+                    );
                     // Create error with intercepted call context and pre-generated resume token
                     const error = new tool_protection_js_1.DelegationRequiredError(toolName, protection.requiredScopes, consentUrl, interceptedCall, resumeToken);
                     // Store intercepted call for resumption
@@ -379,7 +382,9 @@ class MCPIRuntimeBase {
                                 expiresAt: this.clock.calculateExpiry(1800), // 30 minutes
                             };
                             const resumeToken = this.generateResumeToken(interceptedCall);
-                            const consentUrl = this.buildConsentUrl(toolName, protection.requiredScopes, session, resumeToken);
+                            const consentUrl = this.buildConsentUrl(toolName, protection.requiredScopes, session, resumeToken, undefined, // projectId - handled by subclass override
+                            protection.oauthProvider // Provider from tool config
+                            );
                             this.interceptedCalls.set(resumeToken, interceptedCall);
                             this.cleanupExpiredInterceptedCalls();
                             throw new tool_protection_js_1.DelegationRequiredError(toolName, protection.requiredScopes, consentUrl, interceptedCall, resumeToken);
@@ -413,7 +418,9 @@ class MCPIRuntimeBase {
                                     expiresAt: this.clock.calculateExpiry(1800), // 30 minutes
                                 };
                                 const resumeToken = this.generateResumeToken(interceptedCall);
-                                const consentUrl = this.buildConsentUrl(toolName, protection.requiredScopes, session, resumeToken);
+                                const consentUrl = this.buildConsentUrl(toolName, protection.requiredScopes, session, resumeToken, undefined, // projectId - handled by subclass override
+                                protection.oauthProvider // Provider from tool config
+                                );
                                 this.interceptedCalls.set(resumeToken, interceptedCall);
                                 this.cleanupExpiredInterceptedCalls();
                                 throw new tool_protection_js_1.DelegationRequiredError(toolName, protection.requiredScopes, consentUrl, interceptedCall, resumeToken);
@@ -477,7 +484,9 @@ class MCPIRuntimeBase {
                                 expiresAt: this.clock.calculateExpiry(1800),
                             };
                             const resumeToken = this.generateResumeToken(interceptedCall);
-                            const consentUrl = this.buildConsentUrl(toolName, protection.requiredScopes, session, resumeToken);
+                            const consentUrl = this.buildConsentUrl(toolName, protection.requiredScopes, session, resumeToken, undefined, // projectId - handled by subclass override
+                            protection.oauthProvider // Provider from tool config
+                            );
                             this.interceptedCalls.set(resumeToken, interceptedCall);
                             this.cleanupExpiredInterceptedCalls();
                             throw new tool_protection_js_1.DelegationRequiredError(toolName, protection.requiredScopes, consentUrl, interceptedCall, resumeToken);
@@ -500,7 +509,9 @@ class MCPIRuntimeBase {
                             expiresAt: this.clock.calculateExpiry(1800),
                         };
                         const resumeToken = this.generateResumeToken(interceptedCall);
-                        const consentUrl = this.buildConsentUrl(toolName, protection.requiredScopes, session, resumeToken);
+                        const consentUrl = this.buildConsentUrl(toolName, protection.requiredScopes, session, resumeToken, undefined, // projectId - handled by subclass override
+                        protection.oauthProvider // Provider from tool config
+                        );
                         this.interceptedCalls.set(resumeToken, interceptedCall);
                         this.cleanupExpiredInterceptedCalls();
                         throw new tool_protection_js_1.DelegationRequiredError(toolName, protection.requiredScopes, consentUrl, interceptedCall, resumeToken);
@@ -616,9 +627,10 @@ class MCPIRuntimeBase {
      * @param session - Current session context
      * @param resumeToken - Token to resume after delegation
      * @param projectId - Project ID for AgentShield API
+     * @param provider - Provider name (e.g., "github", "credentials") to select specific auth method
      * @returns Full consent URL with snake_case parameters
      */
-    buildConsentUrl(toolName, scopes, session, resumeToken, projectId) {
+    buildConsentUrl(toolName, scopes, session, resumeToken, projectId, provider) {
         // Default implementation - override in subclasses
         // This URL should point to AgentShield's consent page
         // Parameter names use snake_case for AgentShield API compatibility
@@ -636,6 +648,11 @@ class MCPIRuntimeBase {
         if (resumeToken) {
             params.set("resume_token", resumeToken);
         }
+        // Add provider if specified (allows selecting specific auth method like "credentials" or "github")
+        // This is critical when multiple providers are configured for a project
+        if (provider) {
+            params.set("provider", provider);
+        }
         // Use AgentShield consent endpoint
         return `https://kya.vouched.id/bouncer/consent?${params.toString()}`;
     }

package/dist/services/tool-context-builder.js

@@ -86,6 +86,7 @@ class ToolContextBuilder {
         // CRED-003: Build headers based on tokenUsage
         const idpHeaders = this.buildAuthHeaders(tokenData);
         // Build context with token and headers
+        // Include userId from token metadata (extracted from credential provider response)
         const context = {
             idpToken: tokenData.access_token,
             idpHeaders,
@@ -94,12 +95,15 @@ class ToolContextBuilder {
             userDid,
             sessionId,
             delegationToken,
+            // CRED-003: Include userId from credential provider's extracted user ID
+            userId: tokenData.userId,
         };
         this.config.logger("[ToolContextBuilder] Context built successfully", {
             toolName,
             userDid: userDid.substring(0, 20) + "...",
             provider,
             hasToken: !!tokenData.access_token,
+            hasUserId: !!tokenData.userId,
             tokenUsage: tokenData.tokenUsage,
             headerKeys: Object.keys(idpHeaders),
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/mcp-i-core",
-  "version": "1.3.14",
+  "version": "1.3.16",
   "description": "Core runtime and types for MCP-I framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -28,7 +28,7 @@
     "prepublishOnly": "npm run build && node ../create-mcpi-app/scripts/validate-no-workspace.js"
   },
   "dependencies": {
-    "@kya-os/contracts": "^1.6.7",
+    "@kya-os/contracts": "^1.6.9",
     "jose": "^5.6.3",
     "json-canonicalize": "^2.0.0",
     "zod": "^3.25.76"