@kya-os/mcp-i-core 1.3.7-canary.0 → 1.3.7-canary.clientinfo.20251126041014

package/dist/services/session-registration.service.js

@@ -0,0 +1,228 @@
+"use strict";
+/**
+ * Session Registration Service
+ *
+ * Registers MCP sessions with the AgentShield dashboard, enabling
+ * visibility into which MCP clients are connecting to agents.
+ *
+ * This is a fire-and-forget service - session registration should not
+ * block tool execution or affect the user experience.
+ *
+ * @package @kya-os/mcp-i-core
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionRegistrationService = void 0;
+exports.createSessionRegistrationService = createSessionRegistrationService;
+const agentshield_api_1 = require("@kya-os/contracts/agentshield-api");
+/**
+ * Session Registration Service
+ *
+ * Registers MCP sessions with AgentShield for dashboard visibility.
+ * Designed to be non-blocking - failures are logged but don't throw.
+ */
+class SessionRegistrationService {
+    config;
+    constructor(config) {
+        this.config = {
+            baseUrl: config.baseUrl,
+            apiKey: config.apiKey,
+            fetchProvider: config.fetchProvider,
+            logger: config.logger || (() => { }),
+            timeoutMs: config.timeoutMs ?? 5000,
+        };
+    }
+    /**
+     * Register a session with AgentShield
+     *
+     * This is a fire-and-forget operation. Failures are logged but don't throw.
+     * The method returns quickly and doesn't block the caller.
+     *
+     * @param request - Session registration request data
+     * @returns Result indicating success or failure
+     */
+    async registerSession(request) {
+        const sessionId = request.session_id;
+        try {
+            // Validate request
+            const validationResult = agentshield_api_1.registerSessionRequestSchema.safeParse(request);
+            if (!validationResult.success) {
+                const errorMsg = `Invalid session registration request: ${validationResult.error.message}`;
+                this.config.logger("[SessionRegistration] Validation failed", {
+                    sessionId,
+                    error: errorMsg,
+                });
+                return { success: false, sessionId, error: errorMsg };
+            }
+            const url = `${this.config.baseUrl}${agentshield_api_1.AGENTSHIELD_ENDPOINTS.SESSIONS}`;
+            this.config.logger("[SessionRegistration] Registering session", {
+                sessionId,
+                agentDid: request.agent_did,
+                clientName: request.client_info.name,
+                url,
+            });
+            // ✅ EMPIRICAL PROOF: Prepare request headers with correct auth format
+            const requestHeaders = {
+                "Content-Type": "application/json",
+                "X-AgentShield-Key": this.config.apiKey, // Fixed: Use X-AgentShield-Key instead of Authorization: Bearer
+            };
+            // ✅ EMPIRICAL PROOF: Log exact request details (sanitized for security)
+            const sanitizedHeaders = {
+                ...requestHeaders,
+                "X-AgentShield-Key": `${this.config.apiKey.slice(0, 8)}...${this.config.apiKey.slice(-4)}`, // Show first 8 and last 4 chars
+            };
+            const sanitizedBody = {
+                session_id: request.session_id,
+                agent_did: request.agent_did,
+                project_id: request.project_id,
+                created_at: request.created_at,
+                client_info: request.client_info,
+                client_identity: request.client_identity,
+                server_did: request.server_did,
+                ttl_minutes: request.ttl_minutes,
+            };
+            this.config.logger("[SessionRegistration] 🔍 EMPIRICAL DEBUG - Request details", {
+                url,
+                method: "POST",
+                headers: sanitizedHeaders,
+                headerKeys: Object.keys(requestHeaders),
+                authHeaderPresent: !!requestHeaders["X-AgentShield-Key"],
+                authHeaderName: "X-AgentShield-Key",
+                body: sanitizedBody,
+                bodySize: JSON.stringify(request).length,
+            });
+            // Make the request with timeout
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), this.config.timeoutMs);
+            try {
+                const response = await this.config.fetchProvider.fetch(url, {
+                    method: "POST",
+                    headers: requestHeaders,
+                    body: JSON.stringify(request),
+                    signal: controller.signal,
+                });
+                clearTimeout(timeoutId);
+                // ✅ EMPIRICAL PROOF: Capture exact response details
+                const responseHeaders = {};
+                response.headers.forEach((value, key) => {
+                    responseHeaders[key] = value;
+                });
+                const responseText = await response
+                    .text()
+                    .catch(() => "Failed to read response");
+                let responseBody;
+                try {
+                    responseBody = JSON.parse(responseText);
+                }
+                catch {
+                    responseBody = responseText;
+                }
+                // ✅ EMPIRICAL PROOF: Log exact response details
+                this.config.logger("[SessionRegistration] 🔍 EMPIRICAL DEBUG - Response details", {
+                    status: response.status,
+                    statusText: response.statusText,
+                    ok: response.ok,
+                    headers: responseHeaders,
+                    body: responseBody,
+                    bodyLength: responseText.length,
+                    clientName: request.client_info.name,
+                });
+                if (!response.ok) {
+                    // Log error but don't throw - this is fire-and-forget
+                    this.config.logger("[SessionRegistration] Registration failed", {
+                        sessionId,
+                        status: response.status,
+                        error: responseText,
+                        // ✅ EMPIRICAL PROOF: Include full response details
+                        responseHeaders,
+                        responseBody,
+                        clientName: request.client_info.name,
+                    });
+                    return {
+                        success: false,
+                        sessionId,
+                        error: `HTTP ${response.status}: ${responseText}`,
+                    };
+                }
+                // Parse response (using already-captured responseBody)
+                const responseData = responseBody;
+                const parseResult = agentshield_api_1.registerSessionResponseSchema.safeParse(responseData.data ||
+                    responseData);
+                if (!parseResult.success) {
+                    this.config.logger("[SessionRegistration] Invalid response format", {
+                        sessionId,
+                        response: responseData,
+                    });
+                    // Still consider it a success if we got a 200 OK
+                    return { success: true, sessionId };
+                }
+                this.config.logger("[SessionRegistration] Session registered", {
+                    sessionId,
+                    registered: parseResult.data.registered,
+                });
+                return { success: true, sessionId };
+            }
+            finally {
+                clearTimeout(timeoutId);
+            }
+        }
+        catch (error) {
+            // Handle abort/timeout
+            if (error instanceof Error && error.name === "AbortError") {
+                this.config.logger("[SessionRegistration] Request timed out", {
+                    sessionId,
+                    timeoutMs: this.config.timeoutMs,
+                });
+                return { success: false, sessionId, error: "Request timed out" };
+            }
+            // Log any other error
+            const errorMsg = error instanceof Error ? error.message : "Unknown error";
+            this.config.logger("[SessionRegistration] Unexpected error", {
+                sessionId,
+                error: errorMsg,
+            });
+            return { success: false, sessionId, error: errorMsg };
+        }
+    }
+    /**
+     * Fire-and-forget session registration
+     *
+     * Starts registration in the background without waiting for completion.
+     * Useful when you want to register a session but not delay the response.
+     *
+     * @param request - Session registration request data
+     */
+    registerSessionAsync(request) {
+        // Start registration in background - don't await
+        this.registerSession(request).catch((error) => {
+            // This should never happen since registerSession catches all errors,
+            // but just in case
+            this.config.logger("[SessionRegistration] Background registration failed", {
+                sessionId: request.session_id,
+                error: error instanceof Error ? error.message : "Unknown error",
+            });
+        });
+    }
+}
+exports.SessionRegistrationService = SessionRegistrationService;
+/**
+ * Create a session registration service from common runtime config
+ *
+ * Helper function to create the service from typical environment config.
+ */
+function createSessionRegistrationService(options) {
+    // Validate required config
+    if (!options.apiUrl || !options.apiKey) {
+        options.logger?.("[SessionRegistration] Missing required config - session registration disabled", {
+            hasApiUrl: !!options.apiUrl,
+            hasApiKey: !!options.apiKey,
+        });
+        return null;
+    }
+    return new SessionRegistrationService({
+        baseUrl: options.apiUrl,
+        apiKey: options.apiKey,
+        fetchProvider: options.fetchProvider,
+        logger: options.logger,
+    });
+}
+//# sourceMappingURL=session-registration.service.js.map

package/dist/services/session-registration.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-registration.service.js","sourceRoot":"","sources":["../../src/services/session-registration.service.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AA0RH,4EAwBC;AA5SD,uEAI2C;AAmC3C;;;;;GAKG;AACH,MAAa,0BAA0B;IAC7B,MAAM,CAKZ;IAEF,YAAY,MAAwC;QAClD,IAAI,CAAC,MAAM,GAAG;YACZ,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;YACnC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;SACpC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CACnB,OAA+B;QAE/B,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;QAErC,IAAI,CAAC;YACH,mBAAmB;YACnB,MAAM,gBAAgB,GAAG,8CAA4B,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACzE,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,yCAAyC,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC3F,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,yCAAyC,EAAE;oBAC5D,SAAS;oBACT,KAAK,EAAE,QAAQ;iBAChB,CAAC,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;YACxD,CAAC;YAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,uCAAqB,CAAC,QAAQ,EAAE,CAAC;YAEtE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,2CAA2C,EAAE;gBAC9D,SAAS;gBACT,QAAQ,EAAE,OAAO,CAAC,SAAS;gBAC3B,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI;gBACpC,GAAG;aACJ,CAAC,CAAC;YAEH,sEAAsE;YACtE,MAAM,cAAc,GAAG;gBACrB,cAAc,EAAE,kBAAkB;gBAClC,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,gEAAgE;aAC1G,CAAC;YAEF,wEAAwE;YACxE,MAAM,gBAAgB,GAAG;gBACvB,GAAG,cAAc;gBACjB,mBAAmB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,gCAAgC;aAC7H,CAAC;YAEF,MAAM,aAAa,GAAG;gBACpB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,MAAM,CAChB,4DAA4D,EAC5D;gBACE,GAAG;gBACH,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,gBAAgB;gBACzB,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;gBACvC,iBAAiB,EAAE,CAAC,CAAC,cAAc,CAAC,mBAAmB,CAAC;gBACxD,cAAc,EAAE,mBAAmB;gBACnC,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM;aACzC,CACF,CAAC;YAEF,gCAAgC;YAChC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAC1B,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,IAAI,CAAC,MAAM,CAAC,SAAS,CACtB,CAAC;YAEF,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE;oBAC1D,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,cAAc;oBACvB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;oBAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,YAAY,CAAC,SAAS,CAAC,CAAC;gBAExB,oDAAoD;gBACpD,MAAM,eAAe,GAA2B,EAAE,CAAC;gBACnD,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;oBACtC,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAC/B,CAAC,CAAC,CAAC;gBAEH,MAAM,YAAY,GAAG,MAAM,QAAQ;qBAChC,IAAI,EAAE;qBACN,KAAK,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,CAAC;gBAC1C,IAAI,YAAqB,CAAC;gBAC1B,IAAI,CAAC;oBACH,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAC1C,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY,GAAG,YAAY,CAAC;gBAC9B,CAAC;gBAED,gDAAgD;gBAChD,IAAI,CAAC,MAAM,CAAC,MAAM,CAChB,6DAA6D,EAC7D;oBACE,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,EAAE,EAAE,QAAQ,CAAC,EAAE;oBACf,OAAO,EAAE,eAAe;oBACxB,IAAI,EAAE,YAAY;oBAClB,UAAU,EAAE,YAAY,CAAC,MAAM;oBAC/B,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI;iBACrC,CACF,CAAC;gBAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,sDAAsD;oBACtD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,2CAA2C,EAAE;wBAC9D,SAAS;wBACT,MAAM,EAAE,QAAQ,CAAC,MAAM;wBACvB,KAAK,EAAE,YAAY;wBACnB,mDAAmD;wBACnD,eAAe;wBACf,YAAY;wBACZ,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI;qBACrC,CAAC,CAAC;oBACH,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,SAAS;wBACT,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,KAAK,YAAY,EAAE;qBAClD,CAAC;gBACJ,CAAC;gBAED,uDAAuD;gBACvD,MAAM,YAAY,GAAG,YAEM,CAAC;gBAC5B,MAAM,WAAW,GAAG,+CAA6B,CAAC,SAAS,CACxD,YAAmD,CAAC,IAAI;oBACvD,YAAY,CACf,CAAC;gBAEF,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;oBACzB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,+CAA+C,EAAE;wBAClE,SAAS;wBACT,QAAQ,EAAE,YAAY;qBACvB,CAAC,CAAC;oBACH,iDAAiD;oBACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;gBACtC,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,0CAA0C,EAAE;oBAC7D,SAAS;oBACT,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,UAAU;iBACxC,CAAC,CAAC;gBAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YACtC,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uBAAuB;YACvB,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,yCAAyC,EAAE;oBAC5D,SAAS;oBACT,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;iBACjC,CAAC,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;YACnE,CAAC;YAED,sBAAsB;YACtB,MAAM,QAAQ,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YAC1E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,wCAAwC,EAAE;gBAC3D,SAAS;gBACT,KAAK,EAAE,QAAQ;aAChB,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,oBAAoB,CAAC,OAA+B;QAClD,iDAAiD;QACjD,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAC5C,qEAAqE;YACrE,mBAAmB;YACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAChB,sDAAsD,EACtD;gBACE,SAAS,EAAE,OAAO,CAAC,UAAU;gBAC7B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;aAChE,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAhOD,gEAgOC;AAED;;;;GAIG;AACH,SAAgB,gCAAgC,CAAC,OAKhD;IACC,2BAA2B;IAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACvC,OAAO,CAAC,MAAM,EAAE,CACd,+EAA+E,EAC/E;YACE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM;YAC3B,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM;SAC5B,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,0BAA0B,CAAC;QACpC,OAAO,EAAE,OAAO,CAAC,MAAM;QACvB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;AACL,CAAC"}

package/dist/services/tool-context-builder.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Tool Context Builder
+ *
+ * Builds ToolExecutionContext for tool handlers by resolving IDP tokens
+ * based on tool protection configuration and user identity.
+ *
+ * @package @kya-os/mcp-i-core
+ */
+import type { ToolExecutionContext } from "@kya-os/contracts/config";
+import type { IdpTokenResolver } from "../identity/idp-token-resolver.js";
+import type { ToolProtection } from "../types/tool-protection.js";
+import type { OAuthConfigService } from "./oauth-config.service.js";
+import type { ProviderResolver } from "./provider-resolver.js";
+export interface ToolContextBuilderConfig {
+    /** IDP token resolver for resolving tokens from User DID */
+    tokenResolver: IdpTokenResolver;
+    /** OAuth config service for fetching provider configurations */
+    configService: OAuthConfigService;
+    /** Provider resolver for resolving OAuth providers for tools */
+    providerResolver: ProviderResolver;
+    /** Project ID for fetching OAuth config */
+    projectId: string;
+    /** Optional logger callback for diagnostics */
+    logger?: (message: string, data?: unknown) => void;
+}
+/**
+ * Builder for tool execution context
+ *
+ * Resolves IDP tokens and builds context for tool handlers.
+ * Phase 1: Uses configured provider as temporary fallback.
+ * Phase 2+: Requires explicit oauthProvider on tool protection.
+ */
+export declare class ToolContextBuilder {
+    private config;
+    constructor(config: ToolContextBuilderConfig);
+    /**
+     * Build tool execution context
+     *
+     * @param toolName - Name of the tool being executed
+     * @param userDid - User DID (optional, required for OAuth)
+     * @param sessionId - Session ID (optional)
+     * @param delegationToken - Delegation token (optional)
+     * @param toolProtection - Tool protection configuration (optional)
+     * @returns Tool execution context or undefined if not needed
+     */
+    buildContext(toolName: string, userDid: string | undefined, sessionId: string | undefined, delegationToken: string | undefined, toolProtection: ToolProtection | null): Promise<ToolExecutionContext | undefined>;
+    /**
+     * Resolve OAuth provider for a tool
+     *
+     * Phase 2: Uses ProviderResolver with priority-based resolution
+     *
+     * @param toolProtection - Tool protection configuration
+     * @returns Provider name or throws error if not found
+     */
+    private resolveProvider;
+}
+//# sourceMappingURL=tool-context-builder.d.ts.map

package/dist/services/tool-context-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-context-builder.d.ts","sourceRoot":"","sources":["../../src/services/tool-context-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG/D,MAAM,WAAW,wBAAwB;IACvC,4DAA4D;IAC5D,aAAa,EAAE,gBAAgB,CAAC;IAEhC,gEAAgE;IAChE,aAAa,EAAE,kBAAkB,CAAC;IAElC,gEAAgE;IAChE,gBAAgB,EAAE,gBAAgB,CAAC;IAEnC,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAElB,+CAA+C;IAC/C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACpD;AAED;;;;;;GAMG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAEZ;gBAEU,MAAM,EAAE,wBAAwB;IAU5C;;;;;;;;;OASG;IACG,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,cAAc,EAAE,cAAc,GAAG,IAAI,GACpC,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAqE5C;;;;;;;OAOG;YACW,eAAe;CAsB9B"}

package/dist/services/tool-context-builder.js

@@ -0,0 +1,125 @@
+"use strict";
+/**
+ * Tool Context Builder
+ *
+ * Builds ToolExecutionContext for tool handlers by resolving IDP tokens
+ * based on tool protection configuration and user identity.
+ *
+ * @package @kya-os/mcp-i-core
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ToolContextBuilder = void 0;
+const oauth_required_error_js_1 = require("../types/oauth-required-error.js");
+/**
+ * Builder for tool execution context
+ *
+ * Resolves IDP tokens and builds context for tool handlers.
+ * Phase 1: Uses configured provider as temporary fallback.
+ * Phase 2+: Requires explicit oauthProvider on tool protection.
+ */
+class ToolContextBuilder {
+    config;
+    constructor(config) {
+        this.config = {
+            tokenResolver: config.tokenResolver,
+            configService: config.configService,
+            providerResolver: config.providerResolver,
+            projectId: config.projectId,
+            logger: config.logger || (() => { }),
+        };
+    }
+    /**
+     * Build tool execution context
+     *
+     * @param toolName - Name of the tool being executed
+     * @param userDid - User DID (optional, required for OAuth)
+     * @param sessionId - Session ID (optional)
+     * @param delegationToken - Delegation token (optional)
+     * @param toolProtection - Tool protection configuration (optional)
+     * @returns Tool execution context or undefined if not needed
+     */
+    async buildContext(toolName, userDid, sessionId, delegationToken, toolProtection) {
+        // Only build context if tool requires OAuth
+        if (!toolProtection?.requiredScopes?.length || !userDid) {
+            return undefined;
+        }
+        // Phase 2: Resolve provider using ProviderResolver
+        // ProviderResolver handles priority-based resolution with fallbacks
+        let provider;
+        try {
+            provider = await this.resolveProvider(toolProtection);
+        }
+        catch (error) {
+            // Provider resolution failed - cannot build context
+            this.config.logger("[ToolContextBuilder] Provider not resolved", {
+                toolName,
+                userDid: userDid.substring(0, 20) + "...",
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return undefined;
+        }
+        // Resolve IDP token
+        const idpToken = await this.config.tokenResolver.resolveTokenFromDid(userDid, provider, toolProtection.requiredScopes);
+        if (!idpToken) {
+            // Token not available - throw OAuthRequiredError to trigger OAuth flow
+            this.config.logger("[ToolContextBuilder] Token not available, throwing OAuthRequiredError", {
+                toolName,
+                userDid: userDid.substring(0, 20) + "...",
+                provider,
+                scopes: toolProtection.requiredScopes,
+            });
+            // Throw error with provider and scopes info
+            // OAuth URL will be built by the Cloudflare layer (agent.ts)
+            throw new oauth_required_error_js_1.OAuthRequiredError({
+                toolName,
+                requiredScopes: toolProtection.requiredScopes,
+                provider,
+                oauthUrl: "", // Will be populated by Cloudflare layer
+                userDid,
+                sessionId,
+            });
+        }
+        // Build context with token
+        const context = {
+            idpToken,
+            provider,
+            scopes: toolProtection.requiredScopes,
+            userDid,
+            sessionId,
+            delegationToken,
+        };
+        this.config.logger("[ToolContextBuilder] Context built successfully", {
+            toolName,
+            userDid: userDid.substring(0, 20) + "...",
+            provider,
+            hasToken: !!idpToken,
+        });
+        return context;
+    }
+    /**
+     * Resolve OAuth provider for a tool
+     *
+     * Phase 2: Uses ProviderResolver with priority-based resolution
+     *
+     * @param toolProtection - Tool protection configuration
+     * @returns Provider name or throws error if not found
+     */
+    async resolveProvider(toolProtection) {
+        try {
+            const provider = await this.config.providerResolver.resolveProvider(toolProtection, this.config.projectId);
+            this.config.logger("[ToolContextBuilder] Provider resolved", {
+                provider,
+            });
+            return provider;
+        }
+        catch (error) {
+            this.config.logger("[ToolContextBuilder] Provider resolution failed", {
+                error: error instanceof Error ? error.message : String(error),
+                projectId: this.config.projectId,
+            });
+            throw error; // Re-throw to let caller handle
+        }
+    }
+}
+exports.ToolContextBuilder = ToolContextBuilder;
+//# sourceMappingURL=tool-context-builder.js.map

package/dist/services/tool-context-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-context-builder.js","sourceRoot":"","sources":["../../src/services/tool-context-builder.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAOH,8EAAsE;AAmBtE;;;;;;GAMG;AACH,MAAa,kBAAkB;IACrB,MAAM,CAEZ;IAEF,YAAY,MAAgC;QAC1C,IAAI,CAAC,MAAM,GAAG;YACZ,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;SACpC,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,OAA2B,EAC3B,SAA6B,EAC7B,eAAmC,EACnC,cAAqC;QAErC,4CAA4C;QAC5C,IAAI,CAAC,cAAc,EAAE,cAAc,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACxD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,mDAAmD;QACnD,oEAAoE;QACpE,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oDAAoD;YACpD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,4CAA4C,EAAE;gBAC/D,QAAQ;gBACR,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACzC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,oBAAoB;QACpB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAClE,OAAO,EACP,QAAQ,EACR,cAAc,CAAC,cAAc,CAC9B,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,uEAAuE;YACvE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,uEAAuE,EAAE;gBAC1F,QAAQ;gBACR,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACzC,QAAQ;gBACR,MAAM,EAAE,cAAc,CAAC,cAAc;aACtC,CAAC,CAAC;YAEH,4CAA4C;YAC5C,6DAA6D;YAC7D,MAAM,IAAI,4CAAkB,CAAC;gBAC3B,QAAQ;gBACR,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,QAAQ;gBACR,QAAQ,EAAE,EAAE,EAAE,wCAAwC;gBACtD,OAAO;gBACP,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAED,2BAA2B;QAC3B,MAAM,OAAO,GAAyB;YACpC,QAAQ;YACR,QAAQ;YACR,MAAM,EAAE,cAAc,CAAC,cAAc;YACrC,OAAO;YACP,SAAS;YACT,eAAe;SAChB,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,iDAAiD,EAAE;YACpE,QAAQ;YACR,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;YACzC,QAAQ;YACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;SACrB,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,eAAe,CAC3B,cAA8B;QAE9B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,eAAe,CACjE,cAAc,EACd,IAAI,CAAC,MAAM,CAAC,SAAS,CACtB,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,wCAAwC,EAAE;gBAC3D,QAAQ;aACT,CAAC,CAAC;YAEH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,iDAAiD,EAAE;gBACpE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;aACjC,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,CAAC,gCAAgC;QAC/C,CAAC;IACH,CAAC;CACF;AAlID,gDAkIC"}

package/dist/services/tool-protection.service.d.ts

@@ -126,6 +126,8 @@ export declare class ToolProtectionService {
      * Uses projectId endpoint if available (preferred, project-scoped), otherwise falls back to agent_did query param
      *
      * @param agentDid DID of the agent to fetch config for
+     * @param options Optional fetch options
+     * @param options.bypassCDNCache When true, adds cache-busting to bypass CDN caches (used by clearAndRefresh)
      */
     private fetchFromApi;
     /**
@@ -137,5 +139,30 @@ export declare class ToolProtectionService {
      * @param agentDid DID of the agent (used for fallback if projectId not available)
      */
     clearCache(agentDid: string): Promise<void>;
+    /**
+     * Clear cache and immediately fetch fresh config from API
+     *
+     * This method is designed for Cloudflare Workers where KV has edge caching.
+     * After clearing the KV entry, it fetches fresh data from the API and writes
+     * it back to KV. This ensures:
+     * 1. The global KV entry is deleted
+     * 2. Fresh data is fetched from API (with CDN cache bypass!)
+     * 3. New data is written to KV (updating edge cache)
+     *
+     * The next request from the same edge location will get the fresh data.
+     *
+     * IMPORTANT: This method uses bypassCDNCache to ensure we get fresh data
+     * from AgentShield's origin server, not stale CDN-cached data. This is
+     * critical for instant cache invalidation when tool protection settings
+     * are changed in the AgentShield dashboard.
+     *
+     * @param agentDid DID of the agent (used for cache key)
+     * @returns The fresh tool protection config from API
+     */
+    clearAndRefresh(agentDid: string): Promise<{
+        config: ToolProtectionConfig;
+        cacheKey: string;
+        source: 'api' | 'fallback';
+    }>;
 }
 //# sourceMappingURL=tool-protection.service.d.ts.map

package/dist/services/tool-protection.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-protection.service.d.ts","sourceRoot":"","sources":["../../src/services/tool-protection.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,2BAA2B,EAE5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAwD7E;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAA8B;IAC5C,OAAO,CAAC,KAAK,CAAsB;gBAEvB,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,mBAAmB;IAK3E;;;OAGG;IACH,YAAY,IAAI,MAAM,GAAG,SAAS;IAIlC;;;;;;;;OAQG;YACW,aAAa;IA4C3B;;;;;;;;;;OAUG;IACG,uBAAuB,CAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,CAAC;IA8UhC;;;;;;OAMG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IA8BjC;;;;;OAKG;YACW,YAAY;IAsG1B;;;;;;;OAOG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAgBlD"}
+{"version":3,"file":"tool-protection.service.d.ts","sourceRoot":"","sources":["../../src/services/tool-protection.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,2BAA2B,EAE5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AA8D7E;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAA8B;IAC5C,OAAO,CAAC,KAAK,CAAsB;gBAEvB,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,mBAAmB;IAK3E;;;OAGG;IACH,YAAY,IAAI,MAAM,GAAG,SAAS;IAIlC;;;;;;;;OAQG;YACW,aAAa;IA4C3B;;;;;;;;;;OAUG;IACG,uBAAuB,CAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,CAAC;IAuYhC;;;;;;OAMG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IA8BjC;;;;;;;OAOG;YACW,YAAY;IAsH1B;;;;;;;OAOG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBjD;;;;;;;;;;;;;;;;;;;OAmBG;IACG,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAC/C,MAAM,EAAE,oBAAoB,CAAC;QAC7B,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,KAAK,GAAG,UAAU,CAAC;KAC5B,CAAC;CA6IH"}