@kya-os/mcp-i-core 1.4.3 → 1.4.5

package/dist/index.d.ts

@@ -21,8 +21,8 @@ export { SessionRegistrationService, createSessionRegistrationService, } from ".
 export type { SessionRegistrationServiceConfig, SessionRegistrationResult, } from "./services/session-registration.service";
 export { OAuthConfigService } from "./services/oauth-config.service";
 export type { OAuthConfigServiceConfig } from "./services/oauth-config.service";
-export { OAuthService } from "./services/oauth-service";
-export type { OAuthServiceConfig } from "./services/oauth-service";
+export { OAuthService, defaultSecretResolver } from "./services/oauth-service";
+export type { OAuthServiceConfig, SecretResolver } from "./services/oauth-service";
 export { ToolContextBuilder } from "./services/tool-context-builder";
 export type { ToolContextBuilderConfig } from "./services/tool-context-builder";
 export { OAuthProviderRegistry } from "./services/oauth-provider-registry";
@@ -68,4 +68,5 @@ export type { UserDidStorage, UserDidManagerConfig, UserKeyPair, OAuthIdentity,
 export { IdpTokenResolver } from "./identity/idp-token-resolver";
 export type { IdpTokenResolverConfig } from "./identity/idp-token-resolver";
 export type { IIdpTokenStorage, TokenUsageMetadata, IdpTokensWithMetadata, } from "./identity/idp-token-storage.interface";
+export { logger, createDefaultConsoleLogger, type Logger, type Level, } from "./logging";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -20,8 +20,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isIndexSet = exports.BitstringManager = exports.createStatusListManager = exports.StatusList2021Manager = exports.createDelegationVerifier = exports.DelegationCredentialVerifier = exports.createDelegationIssuer = exports.DelegationCredentialIssuer = exports.createDelegationErrorFormatter = exports.DelegationErrorFormatter = exports.OAuthRequiredError = exports.DelegationRequiredError = exports.NoOpToolProtectionCache = exports.InMemoryToolProtectionCache = exports.createProofVerificationError = exports.PROOF_VERIFICATION_ERROR_CODES = exports.ProofVerificationError = exports.migrateLegacyKeys = exports.StorageKeyHelpers = exports.createStorageProviders = exports.NoOpOAuthConfigCache = exports.InMemoryOAuthConfigCache = exports.BatchDelegationService = exports.OAuthTokenRetrievalService = exports.ProviderValidationError = exports.ProviderValidator = exports.CredentialAuthModeError = exports.ConsentOnlyModeError = exports.ProviderResolver = exports.OAuthProviderRegistry = exports.ToolContextBuilder = exports.OAuthService = exports.OAuthConfigService = exports.createSessionRegistrationService = exports.SessionRegistrationService = exports.authorizationMatches = exports.AccessControlApiService = exports.ProofVerifier = exports.CryptoService = exports.ToolProtectionService = exports.MCPIRuntimeBase = exports.MemoryIdentityProvider = exports.MemoryNonceCacheProvider = exports.MemoryStorageProvider = exports.IdentityProvider = exports.NonceCacheProvider = exports.StorageProvider = exports.FetchProvider = exports.ClockProvider = exports.CryptoProvider = void 0;
-exports.IdpTokenResolver = exports.UserDidManager = exports.fetchRemoteConfig = exports.bytesToBase64 = exports.base64urlDecodeToString = exports.base64urlDecodeToBytes = exports.base64urlEncodeFromString = exports.base64urlEncodeFromBytes = exports.parseVCJWT = exports.completeVCJWT = exports.createUnsignedVCJWT = exports.canonicalizeJSON = exports.getSchemaStats = exports.getCriticalSchemas = exports.getSchemaById = exports.getSchemasByCategory = exports.getAllSchemas = exports.SCHEMA_REGISTRY = exports.createSchemaVerifier = exports.SchemaVerifier = exports.isValidBase58 = exports.base58Decode = exports.base58Encode = exports.resolveDidKeySync = exports.publicKeyToJwk = exports.extractPublicKeyFromDidKey = exports.isEd25519DidKey = exports.createDidKeyResolver = exports.MemoryDelegationGraphStorage = exports.MemoryStatusListStorage = exports.createCascadingRevocationManager = exports.CascadingRevocationManager = exports.createDelegationGraph = exports.DelegationGraphManager = void 0;
+exports.BitstringManager = exports.createStatusListManager = exports.StatusList2021Manager = exports.createDelegationVerifier = exports.DelegationCredentialVerifier = exports.createDelegationIssuer = exports.DelegationCredentialIssuer = exports.createDelegationErrorFormatter = exports.DelegationErrorFormatter = exports.OAuthRequiredError = exports.DelegationRequiredError = exports.NoOpToolProtectionCache = exports.InMemoryToolProtectionCache = exports.createProofVerificationError = exports.PROOF_VERIFICATION_ERROR_CODES = exports.ProofVerificationError = exports.migrateLegacyKeys = exports.StorageKeyHelpers = exports.createStorageProviders = exports.NoOpOAuthConfigCache = exports.InMemoryOAuthConfigCache = exports.BatchDelegationService = exports.OAuthTokenRetrievalService = exports.ProviderValidationError = exports.ProviderValidator = exports.CredentialAuthModeError = exports.ConsentOnlyModeError = exports.ProviderResolver = exports.OAuthProviderRegistry = exports.ToolContextBuilder = exports.defaultSecretResolver = exports.OAuthService = exports.OAuthConfigService = exports.createSessionRegistrationService = exports.SessionRegistrationService = exports.authorizationMatches = exports.AccessControlApiService = exports.ProofVerifier = exports.CryptoService = exports.ToolProtectionService = exports.MCPIRuntimeBase = exports.MemoryIdentityProvider = exports.MemoryNonceCacheProvider = exports.MemoryStorageProvider = exports.IdentityProvider = exports.NonceCacheProvider = exports.StorageProvider = exports.FetchProvider = exports.ClockProvider = exports.CryptoProvider = void 0;
+exports.createDefaultConsoleLogger = exports.logger = exports.IdpTokenResolver = exports.UserDidManager = exports.fetchRemoteConfig = exports.bytesToBase64 = exports.base64urlDecodeToString = exports.base64urlDecodeToBytes = exports.base64urlEncodeFromString = exports.base64urlEncodeFromBytes = exports.parseVCJWT = exports.completeVCJWT = exports.createUnsignedVCJWT = exports.canonicalizeJSON = exports.getSchemaStats = exports.getCriticalSchemas = exports.getSchemaById = exports.getSchemasByCategory = exports.getAllSchemas = exports.SCHEMA_REGISTRY = exports.createSchemaVerifier = exports.SchemaVerifier = exports.isValidBase58 = exports.base58Decode = exports.base58Encode = exports.resolveDidKeySync = exports.publicKeyToJwk = exports.extractPublicKeyFromDidKey = exports.isEd25519DidKey = exports.createDidKeyResolver = exports.MemoryDelegationGraphStorage = exports.MemoryStatusListStorage = exports.createCascadingRevocationManager = exports.CascadingRevocationManager = exports.createDelegationGraph = exports.DelegationGraphManager = exports.isIndexSet = void 0;
 // Base providers
 var base_1 = require("./providers/base");
 Object.defineProperty(exports, "CryptoProvider", { enumerable: true, get: function () { return base_1.CryptoProvider; } });
@@ -63,6 +63,7 @@ Object.defineProperty(exports, "OAuthConfigService", { enumerable: true, get: fu
 // OAuth Service (Phase 1)
 var oauth_service_1 = require("./services/oauth-service");
 Object.defineProperty(exports, "OAuthService", { enumerable: true, get: function () { return oauth_service_1.OAuthService; } });
+Object.defineProperty(exports, "defaultSecretResolver", { enumerable: true, get: function () { return oauth_service_1.defaultSecretResolver; } });
 // Tool Context Builder (Phase 1)
 var tool_context_builder_1 = require("./services/tool-context-builder");
 Object.defineProperty(exports, "ToolContextBuilder", { enumerable: true, get: function () { return tool_context_builder_1.ToolContextBuilder; } });
@@ -181,4 +182,8 @@ Object.defineProperty(exports, "UserDidManager", { enumerable: true, get: functi
 // IDP Token Resolver (Phase 1 - MH-7, updated for CRED-003)
 var idp_token_resolver_1 = require("./identity/idp-token-resolver");
 Object.defineProperty(exports, "IdpTokenResolver", { enumerable: true, get: function () { return idp_token_resolver_1.IdpTokenResolver; } });
+// Logger (transport-aware logging)
+var logging_1 = require("./logging");
+Object.defineProperty(exports, "logger", { enumerable: true, get: function () { return logging_1.logger; } });
+Object.defineProperty(exports, "createDefaultConsoleLogger", { enumerable: true, get: function () { return logging_1.createDefaultConsoleLogger; } });
 //# sourceMappingURL=index.js.map

package/dist/services/oauth-service.d.ts

@@ -4,11 +4,39 @@
  * Handles OAuth token exchange and refresh using PKCE (Proof Key for Code Exchange).
  * Supports both direct PKCE exchange with OAuth providers and proxy mode via AgentShield.
  *
+ * MCP-I Provider Registry Model:
+ * - Client secrets are NOT sent via the API response
+ * - Agents receive metadata.clientSecretName from AgentShield
+ * - Secrets are resolved at runtime from secure storage (Cloudflare Worker env)
+ * - The SecretResolver interface enables platform-specific secret resolution
+ *
  * @package @kya-os/mcp-i-core
  */
 import type { FetchProvider } from "../providers/base.js";
 import type { OAuthConfigService } from "./oauth-config.service.js";
-import type { IdpTokens } from "@kya-os/contracts/config";
+import type { IdpTokens, OAuthProvider } from "@kya-os/contracts/config";
+/**
+ * Secret Resolver Interface
+ *
+ * Platform-specific interface for resolving secrets from secure storage.
+ * Implementations:
+ * - Cloudflare Workers: Resolves from env bindings
+ * - Node.js: Resolves from process.env
+ * - Other platforms: Custom implementations
+ */
+export interface SecretResolver {
+    /**
+     * Resolve a secret by its name from secure storage
+     * @param secretName - The name/key of the secret (e.g., 'KYA_PROD_MYPROJ_GITHUB_CLIENT_SECRET')
+     * @returns The secret value, or undefined if not found
+     */
+    resolveSecret(secretName: string): Promise<string | undefined>;
+}
+/**
+ * Default secret resolver that uses environment variables
+ * Used when no custom resolver is provided
+ */
+export declare const defaultSecretResolver: SecretResolver;
 export interface OAuthServiceConfig {
     /** OAuth config service for fetching provider configurations */
     configService: OAuthConfigService;
@@ -22,6 +50,12 @@ export interface OAuthServiceConfig {
     projectId: string;
     /** Optional logger callback for diagnostics */
     logger?: (message: string, data?: unknown) => void;
+    /**
+     * Optional secret resolver for MCP-I provider-registry model
+     * Used to resolve client secrets from secure storage
+     * Default: Uses environment variables (process.env)
+     */
+    secretResolver?: SecretResolver;
 }
 /**
  * Service for OAuth token exchange and refresh
@@ -29,6 +63,17 @@ export interface OAuthServiceConfig {
 export declare class OAuthService {
     private config;
     constructor(config: OAuthServiceConfig);
+    /**
+     * Resolve client secret for a provider using the MCP-I provider-registry model
+     *
+     * Resolution order:
+     * 1. If metadata.clientSecretName exists, resolve from secure storage
+     * 2. Fall back to clientSecret field (legacy/backward compatibility)
+     *
+     * @param providerConfig - The OAuth provider configuration
+     * @returns The resolved client secret, or undefined if not available
+     */
+    resolveClientSecret(providerConfig: OAuthProvider): Promise<string | undefined>;
     /**
      * Exchange authorization code for IDP tokens using PKCE
      *

package/dist/services/oauth-service.js

@@ -5,10 +5,29 @@
  * Handles OAuth token exchange and refresh using PKCE (Proof Key for Code Exchange).
  * Supports both direct PKCE exchange with OAuth providers and proxy mode via AgentShield.
  *
+ * MCP-I Provider Registry Model:
+ * - Client secrets are NOT sent via the API response
+ * - Agents receive metadata.clientSecretName from AgentShield
+ * - Secrets are resolved at runtime from secure storage (Cloudflare Worker env)
+ * - The SecretResolver interface enables platform-specific secret resolution
+ *
  * @package @kya-os/mcp-i-core
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAuthService = void 0;
+exports.OAuthService = exports.defaultSecretResolver = void 0;
+/**
+ * Default secret resolver that uses environment variables
+ * Used when no custom resolver is provided
+ */
+exports.defaultSecretResolver = {
+    async resolveSecret(secretName) {
+        // For Node.js environments, check process.env
+        if (typeof process !== "undefined" && process.env) {
+            return process.env[secretName];
+        }
+        return undefined;
+    },
+};
 /**
  * Service for OAuth token exchange and refresh
  */
@@ -22,8 +41,55 @@ class OAuthService {
             agentShieldApiKey: config.agentShieldApiKey,
             projectId: config.projectId,
             logger: config.logger || (() => { }),
+            secretResolver: config.secretResolver || exports.defaultSecretResolver,
         };
     }
+    /**
+     * Resolve client secret for a provider using the MCP-I provider-registry model
+     *
+     * Resolution order:
+     * 1. If metadata.clientSecretName exists, resolve from secure storage
+     * 2. Fall back to clientSecret field (legacy/backward compatibility)
+     *
+     * @param providerConfig - The OAuth provider configuration
+     * @returns The resolved client secret, or undefined if not available
+     */
+    async resolveClientSecret(providerConfig) {
+        // MCP-I Provider Registry model: resolve secret by name
+        if (providerConfig.metadata?.clientSecretName) {
+            const secretName = providerConfig.metadata.clientSecretName;
+            this.config.logger("[OAuthService] Resolving client secret by name", {
+                secretName,
+                version: providerConfig.metadata.clientSecretVersion,
+            });
+            const secret = await this.config.secretResolver.resolveSecret(secretName);
+            if (secret) {
+                this.config.logger("[OAuthService] Client secret resolved successfully", {
+                    secretName,
+                });
+                return secret;
+            }
+            this.config.logger("[OAuthService] Client secret not found in secure storage", {
+                secretName,
+            });
+            // Fall through to try clientSecret field
+        }
+        // Legacy model: use clientSecret directly (if provided)
+        // DEPRECATED: This path is for backward compatibility only
+        // New deployments should use metadata.clientSecretName with secure storage
+        if (providerConfig.clientSecret) {
+            this.config.logger("[OAuthService] DEPRECATED: Using legacy clientSecret field - " +
+                "migrate to metadata.clientSecretName for better security", {
+                telemetry: {
+                    event: "oauth.deprecated_client_secret_used",
+                    hasMetadata: !!providerConfig.metadata,
+                    hasSecretName: !!providerConfig.metadata?.clientSecretName,
+                },
+            });
+            return providerConfig.clientSecret;
+        }
+        return undefined;
+    }
     /**
      * Exchange authorization code for IDP tokens using PKCE
      *
@@ -60,10 +126,13 @@ class OAuthService {
      * Exchange token directly with OAuth provider using PKCE
      */
     async exchangeTokenPKCE(providerConfig, code, codeVerifier, redirectUri) {
+        // Resolve client secret using MCP-I provider-registry model
+        const clientSecret = await this.resolveClientSecret(providerConfig);
         this.config.logger("[OAuthService] Exchanging token with PKCE", {
             provider: providerConfig.authorizationUrl,
             tokenUrl: providerConfig.tokenUrl,
-            hasClientSecret: !!providerConfig.clientSecret,
+            hasClientSecret: !!clientSecret,
+            resolvedViaSecretName: !!providerConfig.metadata?.clientSecretName,
         });
         // Build token exchange parameters
         // Note: GitHub OAuth Apps require client_secret even with PKCE
@@ -75,10 +144,10 @@ class OAuthService {
             client_id: providerConfig.clientId,
             code_verifier: codeVerifier,
         };
-        // Include client_secret if provider has one configured
+        // Include client_secret if resolved (either from secure storage or legacy field)
         // This is required for GitHub OAuth Apps and other providers that need it
-        if (providerConfig.clientSecret) {
-            params.client_secret = providerConfig.clientSecret;
+        if (clientSecret) {
+            params.client_secret = clientSecret;
         }
         const response = await this.config.fetchProvider.fetch(providerConfig.tokenUrl, {
             method: "POST",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/mcp-i-core",
-  "version": "1.4.3",
+  "version": "1.4.5",
   "description": "Core runtime and types for MCP-I framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -28,7 +28,7 @@
     "prepublishOnly": "npm run build && node ../create-mcpi-app/scripts/validate-no-workspace.js"
   },
   "dependencies": {
-    "@kya-os/contracts": "^1.7.6",
+    "@kya-os/contracts": "^1.7.8",
     "jose": "^5.6.3",
     "json-canonicalize": "^2.0.0",
     "zod": "^3.25.76"