@kya-os/mcp-i-core 1.3.19-canary.0 → 1.3.20

package/dist/index.d.ts

@@ -15,7 +15,7 @@ export { CryptoService } from "./services/crypto.service";
 export type { Ed25519JWK, ParsedJWS } from "./services/crypto.service";
 export { ProofVerifier } from "./services/proof-verifier";
 export type { ProofVerificationResult, ProofVerifierConfig, } from "./services/proof-verifier";
-export { AccessControlApiService } from "./services/access-control.service";
+export { AccessControlApiService, authorizationMatches, } from "./services/access-control.service";
 export type { AccessControlApiServiceConfig, AccessControlApiServiceMetrics, } from "./services/access-control.service";
 export { SessionRegistrationService, createSessionRegistrationService, } from "./services/session-registration.service";
 export type { SessionRegistrationServiceConfig, SessionRegistrationResult, } from "./services/session-registration.service";

package/dist/index.js

@@ -20,8 +20,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MemoryStatusListStorage = exports.createCascadingRevocationManager = exports.CascadingRevocationManager = exports.createDelegationGraph = exports.DelegationGraphManager = exports.isIndexSet = exports.BitstringManager = exports.createStatusListManager = exports.StatusList2021Manager = exports.createDelegationVerifier = exports.DelegationCredentialVerifier = exports.createDelegationIssuer = exports.DelegationCredentialIssuer = exports.OAuthRequiredError = exports.DelegationRequiredError = exports.NoOpToolProtectionCache = exports.InMemoryToolProtectionCache = exports.createProofVerificationError = exports.PROOF_VERIFICATION_ERROR_CODES = exports.ProofVerificationError = exports.migrateLegacyKeys = exports.StorageKeyHelpers = exports.createStorageProviders = exports.NoOpOAuthConfigCache = exports.InMemoryOAuthConfigCache = exports.BatchDelegationService = exports.OAuthTokenRetrievalService = exports.ProviderValidationError = exports.ProviderValidator = exports.ProviderResolver = exports.OAuthProviderRegistry = exports.ToolContextBuilder = exports.OAuthService = exports.OAuthConfigService = exports.createSessionRegistrationService = exports.SessionRegistrationService = exports.AccessControlApiService = exports.ProofVerifier = exports.CryptoService = exports.ToolProtectionService = exports.MCPIRuntimeBase = exports.MemoryIdentityProvider = exports.MemoryNonceCacheProvider = exports.MemoryStorageProvider = exports.IdentityProvider = exports.NonceCacheProvider = exports.StorageProvider = exports.FetchProvider = exports.ClockProvider = exports.CryptoProvider = void 0;
-exports.IdpTokenResolver = exports.UserDidManager = exports.fetchRemoteConfig = exports.bytesToBase64 = exports.base64urlDecodeToString = exports.base64urlDecodeToBytes = exports.base64urlEncodeFromString = exports.base64urlEncodeFromBytes = exports.parseVCJWT = exports.completeVCJWT = exports.createUnsignedVCJWT = exports.canonicalizeJSON = exports.getSchemaStats = exports.getCriticalSchemas = exports.getSchemaById = exports.getSchemasByCategory = exports.getAllSchemas = exports.SCHEMA_REGISTRY = exports.createSchemaVerifier = exports.SchemaVerifier = exports.isValidBase58 = exports.base58Decode = exports.base58Encode = exports.resolveDidKeySync = exports.publicKeyToJwk = exports.extractPublicKeyFromDidKey = exports.isEd25519DidKey = exports.createDidKeyResolver = exports.MemoryDelegationGraphStorage = void 0;
+exports.createCascadingRevocationManager = exports.CascadingRevocationManager = exports.createDelegationGraph = exports.DelegationGraphManager = exports.isIndexSet = exports.BitstringManager = exports.createStatusListManager = exports.StatusList2021Manager = exports.createDelegationVerifier = exports.DelegationCredentialVerifier = exports.createDelegationIssuer = exports.DelegationCredentialIssuer = exports.OAuthRequiredError = exports.DelegationRequiredError = exports.NoOpToolProtectionCache = exports.InMemoryToolProtectionCache = exports.createProofVerificationError = exports.PROOF_VERIFICATION_ERROR_CODES = exports.ProofVerificationError = exports.migrateLegacyKeys = exports.StorageKeyHelpers = exports.createStorageProviders = exports.NoOpOAuthConfigCache = exports.InMemoryOAuthConfigCache = exports.BatchDelegationService = exports.OAuthTokenRetrievalService = exports.ProviderValidationError = exports.ProviderValidator = exports.ProviderResolver = exports.OAuthProviderRegistry = exports.ToolContextBuilder = exports.OAuthService = exports.OAuthConfigService = exports.createSessionRegistrationService = exports.SessionRegistrationService = exports.authorizationMatches = exports.AccessControlApiService = exports.ProofVerifier = exports.CryptoService = exports.ToolProtectionService = exports.MCPIRuntimeBase = exports.MemoryIdentityProvider = exports.MemoryNonceCacheProvider = exports.MemoryStorageProvider = exports.IdentityProvider = exports.NonceCacheProvider = exports.StorageProvider = exports.FetchProvider = exports.ClockProvider = exports.CryptoProvider = void 0;
+exports.IdpTokenResolver = exports.UserDidManager = exports.fetchRemoteConfig = exports.bytesToBase64 = exports.base64urlDecodeToString = exports.base64urlDecodeToBytes = exports.base64urlEncodeFromString = exports.base64urlEncodeFromBytes = exports.parseVCJWT = exports.completeVCJWT = exports.createUnsignedVCJWT = exports.canonicalizeJSON = exports.getSchemaStats = exports.getCriticalSchemas = exports.getSchemaById = exports.getSchemasByCategory = exports.getAllSchemas = exports.SCHEMA_REGISTRY = exports.createSchemaVerifier = exports.SchemaVerifier = exports.isValidBase58 = exports.base58Decode = exports.base58Encode = exports.resolveDidKeySync = exports.publicKeyToJwk = exports.extractPublicKeyFromDidKey = exports.isEd25519DidKey = exports.createDidKeyResolver = exports.MemoryDelegationGraphStorage = exports.MemoryStatusListStorage = void 0;
 // Base providers
 var base_1 = require("./providers/base");
 Object.defineProperty(exports, "CryptoProvider", { enumerable: true, get: function () { return base_1.CryptoProvider; } });
@@ -52,6 +52,7 @@ Object.defineProperty(exports, "ProofVerifier", { enumerable: true, get: functio
 // Access Control API Service (stub for Phase 3)
 var access_control_service_1 = require("./services/access-control.service");
 Object.defineProperty(exports, "AccessControlApiService", { enumerable: true, get: function () { return access_control_service_1.AccessControlApiService; } });
+Object.defineProperty(exports, "authorizationMatches", { enumerable: true, get: function () { return access_control_service_1.authorizationMatches; } });
 // Session Registration Service
 var session_registration_service_1 = require("./services/session-registration.service");
 Object.defineProperty(exports, "SessionRegistrationService", { enumerable: true, get: function () { return session_registration_service_1.SessionRegistrationService; } });

package/dist/services/access-control.service.d.ts

@@ -118,4 +118,21 @@ export declare class AccessControlApiService {
      */
     private handleErrorResponse;
 }
+/**
+ * Compare delegation authorization with current tool protection authorization
+ * Returns true if they match, false otherwise
+ *
+ * @param delegationAuth - Authorization from the delegation credential
+ * @param toolAuth - Authorization required by the tool protection config
+ * @returns true if authorization methods match
+ */
+export declare function authorizationMatches(delegationAuth: {
+    type: string;
+    provider?: string;
+    credentialType?: string;
+}, toolAuth: {
+    type: string;
+    provider?: string;
+    credentialType?: string;
+} | undefined): boolean;
 //# sourceMappingURL=access-control.service.d.ts.map

package/dist/services/access-control.service.js

@@ -14,6 +14,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AccessControlApiService = void 0;
+exports.authorizationMatches = authorizationMatches;
 const agentshield_api_1 = require("@kya-os/contracts/agentshield-api");
 const agentshield_api_2 = require("@kya-os/contracts/agentshield-api");
 /**
@@ -672,4 +673,30 @@ class AccessControlApiService {
     }
 }
 exports.AccessControlApiService = AccessControlApiService;
+/**
+ * Compare delegation authorization with current tool protection authorization
+ * Returns true if they match, false otherwise
+ *
+ * @param delegationAuth - Authorization from the delegation credential
+ * @param toolAuth - Authorization required by the tool protection config
+ * @returns true if authorization methods match
+ */
+function authorizationMatches(delegationAuth, toolAuth) {
+    // No tool auth requirement - allow any delegation
+    if (!toolAuth)
+        return true;
+    // Compare type
+    if (delegationAuth.type !== toolAuth.type)
+        return false;
+    // For OAuth, compare provider
+    if (delegationAuth.type === 'oauth') {
+        return delegationAuth.provider === toolAuth.provider;
+    }
+    // For credential, compare credentialType
+    if (delegationAuth.type === 'credential') {
+        return delegationAuth.credentialType === toolAuth.credentialType;
+    }
+    // For 'none' type, they match if both are 'none'
+    return true;
+}
 //# sourceMappingURL=access-control.service.js.map

package/dist/services/index.d.ts

@@ -1,6 +1,6 @@
 export { CryptoService } from './crypto.service.js';
 export type { Ed25519JWK, ParsedJWS } from './crypto.service.js';
-export { AccessControlApiService } from './access-control.service.js';
+export { AccessControlApiService, authorizationMatches, } from './access-control.service.js';
 export type { AccessControlApiServiceConfig, AccessControlApiServiceMetrics, } from './access-control.service.js';
 export { SessionRegistrationService, createSessionRegistrationService, } from './session-registration.service.js';
 export type { SessionRegistrationServiceConfig, SessionRegistrationResult, } from './session-registration.service.js';

package/dist/services/index.js

@@ -1,10 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createSessionRegistrationService = exports.SessionRegistrationService = exports.AccessControlApiService = exports.CryptoService = void 0;
+exports.createSessionRegistrationService = exports.SessionRegistrationService = exports.authorizationMatches = exports.AccessControlApiService = exports.CryptoService = void 0;
 var crypto_service_js_1 = require("./crypto.service.js");
 Object.defineProperty(exports, "CryptoService", { enumerable: true, get: function () { return crypto_service_js_1.CryptoService; } });
 var access_control_service_js_1 = require("./access-control.service.js");
 Object.defineProperty(exports, "AccessControlApiService", { enumerable: true, get: function () { return access_control_service_js_1.AccessControlApiService; } });
+Object.defineProperty(exports, "authorizationMatches", { enumerable: true, get: function () { return access_control_service_js_1.authorizationMatches; } });
 var session_registration_service_js_1 = require("./session-registration.service.js");
 Object.defineProperty(exports, "SessionRegistrationService", { enumerable: true, get: function () { return session_registration_service_js_1.SessionRegistrationService; } });
 Object.defineProperty(exports, "createSessionRegistrationService", { enumerable: true, get: function () { return session_registration_service_js_1.createSessionRegistrationService; } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/mcp-i-core",
-  "version": "1.3.19-canary.0",
+  "version": "1.3.20",
   "description": "Core runtime and types for MCP-I framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",