@kya-os/mcp-i-core 1.7.0 → 1.8.1

package/dist/services/oauth-provider-registry.d.ts

@@ -1,88 +0,0 @@
-/**
- * OAuth Provider Registry
- *
- * Manages OAuth provider configurations loaded from AgentShield API.
- * Provides efficient lookup and caching of provider configurations.
- *
- * @package @kya-os/mcp-i-core
- */
-import type { OAuthProvider } from "@kya-os/contracts/config";
-import type { OAuthConfigService } from "./oauth-config.service.js";
-import type { ProviderValidator } from "./provider-validator.js";
-/**
- * Registry for OAuth providers
- *
- * Wraps OAuthConfigService to provide a simple lookup interface
- * for provider configurations.
- */
-export declare class OAuthProviderRegistry {
-    private configService;
-    private validator?;
-    private providers;
-    private _configuredProvider;
-    constructor(configService: OAuthConfigService, validator?: ProviderValidator | undefined);
-    /**
-     * Load providers from AgentShield API
-     *
-     * Fetches OAuth configuration and caches providers in memory.
-     * Clears existing providers before loading new ones.
-     * Also stores the configured provider from the API response.
-     *
-     * @param projectId - Project ID to load providers for
-     */
-    loadFromAgentShield(projectId: string): Promise<void>;
-    /**
-     * Get the explicitly configured provider for this project
-     *
-     * Returns the provider that the user has configured in AgentShield dashboard.
-     * Used by ProviderResolver as fallback when tool doesn't specify oauthProvider.
-     *
-     * @returns Configured provider name, or null if no provider is configured
-     */
-    getConfiguredProvider(): string | null;
-    /**
-     * Get provider by name
-     *
-     * @param name - Provider name (e.g., "github", "google")
-     * @returns Provider configuration or null if not found
-     */
-    getProvider(name: string): OAuthProvider | null;
-    /**
-     * Get all providers
-     *
-     * @returns Array of all registered provider configurations
-     */
-    getAllProviders(): OAuthProvider[];
-    /**
-     * Check if provider exists
-     *
-     * @param name - Provider name to check
-     * @returns True if provider is registered, false otherwise
-     */
-    hasProvider(name: string): boolean;
-    /**
-     * Get all provider names
-     *
-     * @returns Array of provider names
-     */
-    getProviderNames(): string[];
-    /**
-     * Register a custom provider with validation
-     *
-     * @param name - Provider name (e.g., "custom-idp")
-     * @param provider - Provider configuration
-     * @throws ProviderValidationError if validation fails
-     */
-    registerCustomProvider(name: string, provider: OAuthProvider): void;
-    /**
-     * Get provider with custom parameters merged
-     *
-     * Convenience method that returns provider config with custom parameters
-     * already applied to authorization URL building context.
-     *
-     * @param name - Provider name
-     * @returns Provider configuration with custom params, or null if not found
-     */
-    getProviderWithParams(name: string): OAuthProvider | null;
-}
-//# sourceMappingURL=oauth-provider-registry.d.ts.map

package/dist/services/oauth-provider-registry.js

@@ -1,128 +0,0 @@
-"use strict";
-/**
- * OAuth Provider Registry
- *
- * Manages OAuth provider configurations loaded from AgentShield API.
- * Provides efficient lookup and caching of provider configurations.
- *
- * @package @kya-os/mcp-i-core
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAuthProviderRegistry = void 0;
-/**
- * Registry for OAuth providers
- *
- * Wraps OAuthConfigService to provide a simple lookup interface
- * for provider configurations.
- */
-class OAuthProviderRegistry {
-    configService;
-    validator;
-    providers = new Map();
-    _configuredProvider = null;
-    constructor(configService, validator) {
-        this.configService = configService;
-        this.validator = validator;
-    }
-    /**
-     * Load providers from AgentShield API
-     *
-     * Fetches OAuth configuration and caches providers in memory.
-     * Clears existing providers before loading new ones.
-     * Also stores the configured provider from the API response.
-     *
-     * @param projectId - Project ID to load providers for
-     */
-    async loadFromAgentShield(projectId) {
-        const config = await this.configService.getOAuthConfig(projectId);
-        // Clear existing providers
-        this.providers.clear();
-        // Store the configured provider from API response
-        // This is the provider the user has explicitly configured in AgentShield dashboard
-        this._configuredProvider = config.configuredProvider || null;
-        // Register all providers from config
-        for (const [name, providerConfig] of Object.entries(config.providers)) {
-            this.providers.set(name, providerConfig);
-        }
-    }
-    /**
-     * Get the explicitly configured provider for this project
-     *
-     * Returns the provider that the user has configured in AgentShield dashboard.
-     * Used by ProviderResolver as fallback when tool doesn't specify oauthProvider.
-     *
-     * @returns Configured provider name, or null if no provider is configured
-     */
-    getConfiguredProvider() {
-        return this._configuredProvider;
-    }
-    /**
-     * Get provider by name
-     *
-     * @param name - Provider name (e.g., "github", "google")
-     * @returns Provider configuration or null if not found
-     */
-    getProvider(name) {
-        return this.providers.get(name) || null;
-    }
-    /**
-     * Get all providers
-     *
-     * @returns Array of all registered provider configurations
-     */
-    getAllProviders() {
-        return Array.from(this.providers.values());
-    }
-    /**
-     * Check if provider exists
-     *
-     * @param name - Provider name to check
-     * @returns True if provider is registered, false otherwise
-     */
-    hasProvider(name) {
-        return this.providers.has(name);
-    }
-    /**
-     * Get all provider names
-     *
-     * @returns Array of provider names
-     */
-    getProviderNames() {
-        return Array.from(this.providers.keys());
-    }
-    /**
-     * Register a custom provider with validation
-     *
-     * @param name - Provider name (e.g., "custom-idp")
-     * @param provider - Provider configuration
-     * @throws ProviderValidationError if validation fails
-     */
-    registerCustomProvider(name, provider) {
-        // Validate provider configuration if validator is available
-        if (this.validator) {
-            this.validator.validate(provider, name);
-        }
-        // Register provider
-        this.providers.set(name, provider);
-    }
-    /**
-     * Get provider with custom parameters merged
-     *
-     * Convenience method that returns provider config with custom parameters
-     * already applied to authorization URL building context.
-     *
-     * @param name - Provider name
-     * @returns Provider configuration with custom params, or null if not found
-     */
-    getProviderWithParams(name) {
-        const provider = this.getProvider(name);
-        if (!provider) {
-            return null;
-        }
-        // Return provider as-is (customParams are already in the config)
-        // This method exists for future extensibility if we need to merge params
-        return provider;
-    }
-}
-exports.OAuthProviderRegistry = OAuthProviderRegistry;
-//# sourceMappingURL=oauth-provider-registry.js.map

package/dist/services/oauth-service.d.ts

@@ -1,122 +0,0 @@
-/**
- * OAuth Service
- *
- * Handles OAuth token exchange and refresh using PKCE (Proof Key for Code Exchange).
- * Supports both direct PKCE exchange with OAuth providers and proxy mode via AgentShield.
- *
- * MCP-I Provider Registry Model:
- * - Client secrets are NOT sent via the API response
- * - Agents receive metadata.clientSecretName from AgentShield
- * - Secrets are resolved at runtime from secure storage (Cloudflare Worker env)
- * - The SecretResolver interface enables platform-specific secret resolution
- *
- * @package @kya-os/mcp-i-core
- */
-import type { FetchProvider } from "../providers/base.js";
-import type { OAuthConfigService } from "./oauth-config.service.js";
-import type { IdpTokens, OAuthProvider } from "@kya-os/contracts/config";
-/**
- * Secret Resolver Interface
- *
- * Platform-specific interface for resolving secrets from secure storage.
- * Implementations:
- * - Cloudflare Workers: Resolves from env bindings
- * - Node.js: Resolves from process.env
- * - Other platforms: Custom implementations
- */
-export interface SecretResolver {
-    /**
-     * Resolve a secret by its name from secure storage
-     * @param secretName - The name/key of the secret (e.g., 'KYA_PROD_MYPROJ_GITHUB_CLIENT_SECRET')
-     * @returns The secret value, or undefined if not found
-     */
-    resolveSecret(secretName: string): Promise<string | undefined>;
-}
-/**
- * Default secret resolver that uses environment variables
- * Used when no custom resolver is provided
- */
-export declare const defaultSecretResolver: SecretResolver;
-export interface OAuthServiceConfig {
-    /** OAuth config service for fetching provider configurations */
-    configService: OAuthConfigService;
-    /** Fetch provider for making HTTP requests */
-    fetchProvider: FetchProvider;
-    /** AgentShield API URL (for proxy mode) */
-    agentShieldApiUrl: string;
-    /** AgentShield API key (for proxy mode) */
-    agentShieldApiKey: string;
-    /** Project ID for fetching OAuth config */
-    projectId: string;
-    /** Optional logger callback for diagnostics */
-    logger?: (message: string, data?: unknown) => void;
-    /**
-     * Optional secret resolver for MCP-I provider-registry model
-     * Used to resolve client secrets from secure storage
-     * Default: Uses environment variables (process.env)
-     */
-    secretResolver?: SecretResolver;
-}
-/**
- * Service for OAuth token exchange and refresh
- */
-export declare class OAuthService {
-    private config;
-    constructor(config: OAuthServiceConfig);
-    /**
-     * Resolve client secret for a provider using the MCP-I provider-registry model
-     *
-     * Resolution order:
-     * 1. If metadata.clientSecretName exists, resolve from secure storage
-     * 2. Fall back to clientSecret field (legacy/backward compatibility)
-     *
-     * @param providerConfig - The OAuth provider configuration
-     * @returns The resolved client secret, or undefined if not available
-     */
-    resolveClientSecret(providerConfig: OAuthProvider): Promise<string | undefined>;
-    /**
-     * Exchange authorization code for IDP tokens using PKCE
-     *
-     * For PKCE providers: Exchanges code directly with OAuth provider (no client secret)
-     * For proxy mode: Exchanges code via AgentShield API
-     *
-     * @param provider - OAuth provider name (e.g., "github", "google")
-     * @param code - Authorization code from OAuth callback
-     * @param codeVerifier - PKCE code verifier (optional for non-PKCE providers in proxy mode)
-     * @param redirectUri - Redirect URI used in authorization request
-     * @returns IDP tokens (access_token, refresh_token, expires_at, etc.)
-     */
-    exchangeToken(provider: string, code: string, codeVerifier?: string, redirectUri?: string): Promise<IdpTokens>;
-    /**
-     * Exchange token directly with OAuth provider using PKCE
-     */
-    private exchangeTokenPKCE;
-    /**
-     * Exchange token via AgentShield proxy (for providers that require proxy mode)
-     *
-     * Note: For Phase 3 two-step flow, OAuth tokens are retrieved separately via
-     * OAuthTokenRetrievalService in the callback handler. This method maintains
-     * backward compatibility for direct proxy mode usage.
-     */
-    private exchangeTokenProxy;
-    /**
-     * Refresh IDP access token using refresh token
-     *
-     * For PKCE providers: Refreshes directly with OAuth provider
-     * For proxy mode: Refreshes via AgentShield API
-     *
-     * @param provider - OAuth provider name
-     * @param refreshToken - Refresh token from previous token exchange
-     * @returns New IDP tokens or null if refresh failed
-     */
-    refreshToken(provider: string, refreshToken: string): Promise<IdpTokens | null>;
-    /**
-     * Refresh token directly with OAuth provider using PKCE
-     */
-    private refreshTokenPKCE;
-    /**
-     * Refresh token via AgentShield proxy
-     */
-    private refreshTokenProxy;
-}
-//# sourceMappingURL=oauth-service.d.ts.map