@kya-os/mcp-i-core 1.7.0 → 1.8.1

package/dist/services/proof-verifier.js

@@ -1,319 +0,0 @@
-"use strict";
-/**
- * ProofVerifier
- *
- * Centralized proof verification service that validates DetachedProof
- * signatures, enforces nonce replay protection, and checks timestamp skew.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ProofVerifier = void 0;
-const crypto_service_js_1 = require("./crypto.service.js");
-const proof_1 = require("@kya-os/contracts/proof");
-const json_canonicalize_1 = require("json-canonicalize");
-const errors_js_1 = require("./errors.js");
-class ProofVerifier {
-    cryptoService;
-    clock;
-    nonceCache;
-    fetch;
-    timestampSkewSeconds;
-    nonceTtlSeconds;
-    constructor(config) {
-        this.cryptoService = new crypto_service_js_1.CryptoService(config.cryptoProvider);
-        this.clock = config.clockProvider;
-        this.nonceCache = config.nonceCacheProvider;
-        this.fetch = config.fetchProvider;
-        this.timestampSkewSeconds = config.timestampSkewSeconds ?? 300; // Default 5 minutes
-        this.nonceTtlSeconds = config.nonceTtlSeconds ?? 300; // Default 5 minutes
-    }
-    /**
-     * Verify a DetachedProof
-     * Automatically reconstructs canonical payload from proof.meta for signature verification
-     * @param proof - The proof to verify
-     * @param publicKeyJwk - Ed25519 public key in JWK format (from DID document)
-     * @returns Verification result
-     */
-    async verifyProof(proof, publicKeyJwk) {
-        try {
-            // 1. Validate proof structure
-            const structureValidation = await this.validateProofStructure(proof);
-            if (!structureValidation.valid) {
-                return structureValidation;
-            }
-            const validatedProof = structureValidation.proof;
-            // 2. Check nonce replay protection (scoped to agent DID to prevent cross-agent replay attacks)
-            const nonceValidation = await this.validateNonce(validatedProof.meta.nonce, validatedProof.meta.did);
-            if (!nonceValidation.valid) {
-                return nonceValidation;
-            }
-            // 3. Check timestamp skew
-            const timestampValidation = await this.validateTimestamp(validatedProof.meta.ts);
-            if (!timestampValidation.valid) {
-                return timestampValidation;
-            }
-            // 4. Reconstruct canonical payload from proof meta
-            const canonicalPayloadString = this.buildCanonicalPayload(validatedProof.meta);
-            const canonicalPayloadBytes = new TextEncoder().encode(canonicalPayloadString);
-            // 5. Verify JWS signature with detached canonical payload
-            const signatureValidation = await this.verifySignature(validatedProof.jws, publicKeyJwk, canonicalPayloadBytes, validatedProof.meta.kid);
-            if (!signatureValidation.valid) {
-                return signatureValidation;
-            }
-            // 6. Add nonce to cache to prevent replay (scoped to agent DID)
-            await this.addNonceToCache(validatedProof.meta.nonce, validatedProof.meta.did);
-            return {
-                valid: true,
-            };
-        }
-        catch (error) {
-            // Security-safe failure: never throw, always return error result
-            return {
-                valid: false,
-                reason: "Proof verification error",
-                errorCode: errors_js_1.PROOF_VERIFICATION_ERROR_CODES.VERIFICATION_ERROR,
-                error: error instanceof Error ? error : new Error(String(error)),
-                details: {
-                    errorMessage: error instanceof Error ? error.message : String(error),
-                },
-            };
-        }
-    }
-    /**
-     * Verify proof with detached payload (for CLI/verifier compatibility)
-     * @param proof - The proof to verify
-     * @param canonicalPayload - Canonical JSON payload (for detached JWS) as string or Uint8Array
-     * @param publicKeyJwk - Ed25519 public key in JWK format
-     * @returns Verification result
-     */
-    async verifyProofDetached(proof, canonicalPayload, publicKeyJwk) {
-        try {
-            // 1. Validate proof structure
-            const structureValidation = await this.validateProofStructure(proof);
-            if (!structureValidation.valid) {
-                return structureValidation;
-            }
-            const validatedProof = structureValidation.proof;
-            // 2. Check nonce replay protection (scoped to agent DID to prevent cross-agent replay attacks)
-            const nonceValidation = await this.validateNonce(validatedProof.meta.nonce, validatedProof.meta.did);
-            if (!nonceValidation.valid) {
-                return nonceValidation;
-            }
-            // 3. Check timestamp skew
-            const timestampValidation = await this.validateTimestamp(validatedProof.meta.ts);
-            if (!timestampValidation.valid) {
-                return timestampValidation;
-            }
-            // 4. Convert canonical payload to Uint8Array if needed
-            const canonicalPayloadBytes = canonicalPayload instanceof Uint8Array
-                ? canonicalPayload
-                : new TextEncoder().encode(canonicalPayload);
-            // 5. Verify JWS signature with detached payload
-            const signatureValidation = await this.verifySignature(validatedProof.jws, publicKeyJwk, canonicalPayloadBytes, validatedProof.meta.kid);
-            if (!signatureValidation.valid) {
-                return signatureValidation;
-            }
-            // 6. Add nonce to cache (scoped to agent DID)
-            await this.addNonceToCache(validatedProof.meta.nonce, validatedProof.meta.did);
-            return {
-                valid: true,
-            };
-        }
-        catch (error) {
-            // Security-safe failure: never throw, always return error result
-            return {
-                valid: false,
-                reason: "Proof verification error",
-                errorCode: errors_js_1.PROOF_VERIFICATION_ERROR_CODES.VERIFICATION_ERROR,
-                error: error instanceof Error ? error : new Error(String(error)),
-                details: {
-                    errorMessage: error instanceof Error ? error.message : String(error),
-                },
-            };
-        }
-    }
-    /**
-     * Validate proof structure using Zod schema
-     * @private
-     */
-    async validateProofStructure(proof) {
-        const validationResult = proof_1.DetachedProofSchema.safeParse(proof);
-        if (!validationResult.success) {
-            return {
-                valid: false,
-                reason: "Invalid proof structure",
-                errorCode: errors_js_1.PROOF_VERIFICATION_ERROR_CODES.INVALID_PROOF_STRUCTURE,
-                error: new Error(`Proof validation failed: ${validationResult.error.message}`),
-                details: {
-                    zodErrors: validationResult.error.errors,
-                },
-            };
-        }
-        return {
-            valid: true,
-            proof: validationResult.data,
-        };
-    }
-    /**
-     * Validate nonce replay protection
-     * @private
-     */
-    async validateNonce(nonce, agentDid) {
-        const nonceUsed = await this.nonceCache.has(nonce, agentDid);
-        if (nonceUsed) {
-            return {
-                valid: false,
-                reason: "Nonce already used (replay attack detected)",
-                errorCode: errors_js_1.PROOF_VERIFICATION_ERROR_CODES.NONCE_REPLAY_DETECTED,
-                details: {
-                    nonce,
-                    agentDid,
-                },
-            };
-        }
-        return { valid: true };
-    }
-    /**
-     * Validate timestamp skew
-     * @private
-     */
-    async validateTimestamp(timestamp) {
-        // Convert seconds to milliseconds for clock provider (which uses Date.now())
-        const timestampMs = timestamp * 1000;
-        if (!this.clock.isWithinSkew(timestampMs, this.timestampSkewSeconds)) {
-            return {
-                valid: false,
-                reason: `Timestamp out of skew window (skew: ${this.timestampSkewSeconds}s)`,
-                errorCode: errors_js_1.PROOF_VERIFICATION_ERROR_CODES.TIMESTAMP_SKEW_EXCEEDED,
-                details: {
-                    timestamp,
-                    timestampMs,
-                    skewSeconds: this.timestampSkewSeconds,
-                    currentTime: this.clock.now(),
-                },
-            };
-        }
-        return { valid: true };
-    }
-    /**
-     * Verify JWS signature
-     * @private
-     */
-    async verifySignature(jws, publicKeyJwk, canonicalPayloadBytes, expectedKid) {
-        const signatureValid = await this.cryptoService.verifyJWS(jws, publicKeyJwk, {
-            detachedPayload: canonicalPayloadBytes,
-            expectedKid,
-            alg: "EdDSA",
-        });
-        if (!signatureValid) {
-            return {
-                valid: false,
-                reason: "Invalid JWS signature",
-                errorCode: errors_js_1.PROOF_VERIFICATION_ERROR_CODES.INVALID_JWS_SIGNATURE,
-                details: {
-                    jwsLength: jws.length,
-                    expectedKid,
-                    actualKid: publicKeyJwk.kid,
-                },
-            };
-        }
-        return { valid: true };
-    }
-    /**
-     * Add nonce to cache to prevent replay (scoped to agent DID)
-     * @private
-     */
-    async addNonceToCache(nonce, agentDid) {
-        // Pass TTL in seconds, not absolute timestamp
-        await this.nonceCache.add(nonce, this.nonceTtlSeconds, agentDid);
-    }
-    /**
-     * Fetch public key from DID document
-     * @param did - DID to resolve
-     * @param kid - Key ID (optional, defaults to first verification method)
-     * @returns Ed25519 JWK or null if not found
-     * @throws {ProofVerificationError} If DID resolution fails with specific error code
-     */
-    async fetchPublicKeyFromDID(did, kid) {
-        try {
-            const didDoc = await this.fetch.resolveDID(did);
-            if (!didDoc) {
-                throw new errors_js_1.ProofVerificationError(errors_js_1.PROOF_VERIFICATION_ERROR_CODES.DID_DOCUMENT_NOT_FOUND, `DID document not found: ${did}`, { did });
-            }
-            if (!didDoc.verificationMethod ||
-                didDoc.verificationMethod.length === 0) {
-                throw new errors_js_1.ProofVerificationError(errors_js_1.PROOF_VERIFICATION_ERROR_CODES.VERIFICATION_METHOD_NOT_FOUND, `No verification methods found in DID document: ${did}`, { did });
-            }
-            // Find verification method by kid or use first one
-            let verificationMethod;
-            if (kid) {
-                const kidWithHash = kid.startsWith("#") ? kid : `#${kid}`;
-                verificationMethod = didDoc.verificationMethod.find((vm) => vm.id === kidWithHash || vm.id === `${did}${kidWithHash}`);
-                if (!verificationMethod) {
-                    throw new errors_js_1.ProofVerificationError(errors_js_1.PROOF_VERIFICATION_ERROR_CODES.VERIFICATION_METHOD_NOT_FOUND, `Verification method not found for kid: ${kid}`, {
-                        did,
-                        kid,
-                        availableKids: didDoc.verificationMethod.map((vm) => vm.id),
-                    });
-                }
-            }
-            else {
-                verificationMethod = didDoc.verificationMethod[0];
-            }
-            if (!verificationMethod?.publicKeyJwk) {
-                throw new errors_js_1.ProofVerificationError(errors_js_1.PROOF_VERIFICATION_ERROR_CODES.PUBLIC_KEY_NOT_FOUND, `Public key JWK not found in verification method`, { did, kid, verificationMethodId: verificationMethod?.id });
-            }
-            const jwk = verificationMethod.publicKeyJwk;
-            // Validate it's an Ed25519 key
-            if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519" || !jwk.x) {
-                throw new errors_js_1.ProofVerificationError(errors_js_1.PROOF_VERIFICATION_ERROR_CODES.INVALID_JWK_FORMAT, `Unsupported key type or curve: kty=${jwk.kty}, crv=${jwk.crv}`, { did, kid, jwk: { kty: jwk.kty, crv: jwk.crv } });
-            }
-            return jwk;
-        }
-        catch (error) {
-            if (error instanceof errors_js_1.ProofVerificationError) {
-                throw error;
-            }
-            console.error("[ProofVerifier] Failed to fetch public key from DID:", error);
-            throw new errors_js_1.ProofVerificationError(errors_js_1.PROOF_VERIFICATION_ERROR_CODES.DID_RESOLUTION_FAILED, `DID resolution failed: ${error instanceof Error ? error.message : String(error)}`, {
-                did,
-                kid,
-                originalError: error instanceof Error ? error.message : String(error),
-            });
-        }
-    }
-    /**
-     * Build canonical payload from proof meta
-     *
-     * CRITICAL: This must reconstruct the exact JWS payload structure that was originally signed.
-     * The original JWS payload uses standard JWT claims (aud, sub, iss) plus custom proof claims,
-     * NOT the proof.meta structure directly.
-     *
-     * @param meta - Proof metadata
-     * @returns Canonical JSON string matching the original JWS payload structure
-     */
-    buildCanonicalPayload(meta) {
-        // Reconstruct the original JWS payload structure that was signed
-        // This matches the structure used in proof generation (proof.ts, proof-generator.ts)
-        const payload = {
-            // Standard JWT claims (RFC 7519) - these are what was actually signed
-            aud: meta.audience, // Audience (who the token is for)
-            sub: meta.did, // Subject (agent DID)
-            iss: meta.did, // Issuer (agent DID - self-issued)
-            // Custom MCP-I proof claims
-            requestHash: meta.requestHash,
-            responseHash: meta.responseHash,
-            ts: meta.ts,
-            nonce: meta.nonce,
-            sessionId: meta.sessionId,
-            // Optional claims (only include if present)
-            ...(meta.scopeId && { scopeId: meta.scopeId }),
-            ...(meta.delegationRef && { delegationRef: meta.delegationRef }),
-            ...(meta.clientDid && { clientDid: meta.clientDid }),
-        };
-        // Canonicalize the reconstructed payload using the same function as proof generation
-        // CRITICAL: Must use json-canonicalize canonicalize() to match proof.ts exactly
-        return (0, json_canonicalize_1.canonicalize)(payload);
-    }
-}
-exports.ProofVerifier = ProofVerifier;
-//# sourceMappingURL=proof-verifier.js.map

package/dist/services/provider-resolver.d.ts

@@ -1,89 +0,0 @@
-/**
- * Provider Resolver
- *
- * Resolves OAuth provider for tools using priority-based resolution strategy.
- * Supports Phase 2+ tool-specific providers with backward compatibility for Phase 1.
- *
- * @package @kya-os/mcp-i-core
- */
-import type { ToolProtection } from "@kya-os/contracts/tool-protection";
-import type { OAuthProviderRegistry } from "./oauth-provider-registry.js";
-import type { OAuthConfigService } from "./oauth-config.service.js";
-/**
- * Error thrown when a tool is configured for consent-only mode (no OAuth needed)
- * This is NOT an error condition - it's a signal to skip OAuth flow
- */
-export declare class ConsentOnlyModeError extends Error {
-    readonly toolProtection: ToolProtection;
-    constructor(toolProtection: ToolProtection);
-}
-/**
- * Error thrown when a tool requires credential/password-based authentication
- * This is NOT an error condition - it's a signal to use credential auth flow
- * (username/password, email/password, etc.) instead of OAuth
- */
-export declare class CredentialAuthModeError extends Error {
-    readonly toolProtection: ToolProtection;
-    /** The credential provider ID configured for this tool */
-    readonly provider: string;
-    constructor(toolProtection: ToolProtection, provider: string);
-}
-/**
- * Resolves OAuth provider for tools with priority-based fallback strategy
- *
- * Priority order:
- * 0. Check for consent-only mode (authorization.type === 'none') - skip OAuth
- * 1. Tool-specific oauthProvider field (Phase 2+ preferred)
- * 2. Scope prefix inference (fallback)
- * 3. Project-configured provider from AgentShield dashboard
- * 4. Error if no provider can be resolved
- */
-export declare class ProviderResolver {
-    private registry;
-    private configService;
-    constructor(registry: OAuthProviderRegistry, configService: OAuthConfigService);
-    /**
-     * Check if a tool is configured for consent-only mode
-     * Consent-only means delegation is required but no OAuth provider is needed
-     *
-     * @param toolProtection - Tool protection configuration
-     * @returns true if consent-only mode
-     */
-    isConsentOnlyMode(toolProtection: ToolProtection): boolean;
-    /**
-     * Check if a tool is configured for credential/password-based authentication
-     * This includes username/password, email/password, etc.
-     *
-     * @param toolProtection - Tool protection configuration
-     * @returns Object with isCredential flag and optional provider ID
-     */
-    isCredentialAuthMode(toolProtection: ToolProtection): {
-        isCredential: boolean;
-        provider?: string;
-    };
-    /**
-     * Resolve OAuth provider for a tool
-     *
-     * @param toolProtection - Tool protection configuration
-     * @param projectId - Project ID for fetching provider config
-     * @returns Provider name (never null - throws if cannot resolve)
-     * @throws ConsentOnlyModeError if tool is consent-only (not a real error)
-     * @throws CredentialAuthModeError if tool requires password/credential auth
-     * @throws Error if provider cannot be resolved
-     */
-    resolveProvider(toolProtection: ToolProtection, projectId: string): Promise<string>;
-    /**
-     * Infer provider from scope prefixes
-     *
-     * Used as Priority 2 fallback when oauthProvider is not specified.
-     * Examples:
-     * - github:repo:read → github
-     * - gmail:read → google
-     * - microsoft:calendar:read → microsoft
-     *
-     * @param scopes - Required scopes for the tool
-     * @returns Provider name if uniquely inferred, null otherwise
-     */
-    private inferProviderFromScopes;
-}
-//# sourceMappingURL=provider-resolver.d.ts.map

package/dist/services/provider-resolver.js

@@ -1,196 +0,0 @@
-"use strict";
-/**
- * Provider Resolver
- *
- * Resolves OAuth provider for tools using priority-based resolution strategy.
- * Supports Phase 2+ tool-specific providers with backward compatibility for Phase 1.
- *
- * @package @kya-os/mcp-i-core
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ProviderResolver = exports.CredentialAuthModeError = exports.ConsentOnlyModeError = void 0;
-/**
- * Error thrown when a tool is configured for consent-only mode (no OAuth needed)
- * This is NOT an error condition - it's a signal to skip OAuth flow
- */
-class ConsentOnlyModeError extends Error {
-    toolProtection;
-    constructor(toolProtection) {
-        super("Tool is configured for consent-only mode (no OAuth provider required)");
-        this.toolProtection = toolProtection;
-        this.name = "ConsentOnlyModeError";
-    }
-}
-exports.ConsentOnlyModeError = ConsentOnlyModeError;
-/**
- * Error thrown when a tool requires credential/password-based authentication
- * This is NOT an error condition - it's a signal to use credential auth flow
- * (username/password, email/password, etc.) instead of OAuth
- */
-class CredentialAuthModeError extends Error {
-    toolProtection;
-    /** The credential provider ID configured for this tool */
-    provider;
-    constructor(toolProtection, provider) {
-        super(`Tool requires credential authentication with provider "${provider}"`);
-        this.toolProtection = toolProtection;
-        this.name = "CredentialAuthModeError";
-        this.provider = provider;
-    }
-}
-exports.CredentialAuthModeError = CredentialAuthModeError;
-/**
- * Resolves OAuth provider for tools with priority-based fallback strategy
- *
- * Priority order:
- * 0. Check for consent-only mode (authorization.type === 'none') - skip OAuth
- * 1. Tool-specific oauthProvider field (Phase 2+ preferred)
- * 2. Scope prefix inference (fallback)
- * 3. Project-configured provider from AgentShield dashboard
- * 4. Error if no provider can be resolved
- */
-class ProviderResolver {
-    registry;
-    configService;
-    constructor(registry, configService) {
-        this.registry = registry;
-        this.configService = configService;
-    }
-    /**
-     * Check if a tool is configured for consent-only mode
-     * Consent-only means delegation is required but no OAuth provider is needed
-     *
-     * @param toolProtection - Tool protection configuration
-     * @returns true if consent-only mode
-     */
-    isConsentOnlyMode(toolProtection) {
-        // Check explicit authorization.type === 'none'
-        if (toolProtection.authorization?.type === "none") {
-            return true;
-        }
-        return false;
-    }
-    /**
-     * Check if a tool is configured for credential/password-based authentication
-     * This includes username/password, email/password, etc.
-     *
-     * @param toolProtection - Tool protection configuration
-     * @returns Object with isCredential flag and optional provider ID
-     */
-    isCredentialAuthMode(toolProtection) {
-        // Check explicit authorization.type === 'password'
-        if (toolProtection.authorization?.type === "password") {
-            return {
-                isCredential: true,
-                provider: toolProtection.authorization.provider || "credentials",
-            };
-        }
-        return { isCredential: false };
-    }
-    /**
-     * Resolve OAuth provider for a tool
-     *
-     * @param toolProtection - Tool protection configuration
-     * @param projectId - Project ID for fetching provider config
-     * @returns Provider name (never null - throws if cannot resolve)
-     * @throws ConsentOnlyModeError if tool is consent-only (not a real error)
-     * @throws CredentialAuthModeError if tool requires password/credential auth
-     * @throws Error if provider cannot be resolved
-     */
-    async resolveProvider(toolProtection, projectId) {
-        // Priority 0a: Check for consent-only mode (no OAuth required)
-        if (this.isConsentOnlyMode(toolProtection)) {
-            console.error(`[ProviderResolver] Tool is consent-only mode (authorization.type=none), skipping OAuth resolution`);
-            throw new ConsentOnlyModeError(toolProtection);
-        }
-        // Priority 0b: Check for credential/password auth mode (not OAuth)
-        const credentialCheck = this.isCredentialAuthMode(toolProtection);
-        if (credentialCheck.isCredential) {
-            console.error(`[ProviderResolver] Tool requires credential auth (authorization.type=password), provider="${credentialCheck.provider}"`);
-            throw new CredentialAuthModeError(toolProtection, credentialCheck.provider);
-        }
-        // Priority 1: Tool-specific provider (Phase 2+ preferred)
-        if (toolProtection.oauthProvider) {
-            // Ensure registry is loaded before checking
-            if (this.registry.getProviderNames().length === 0) {
-                await this.registry.loadFromAgentShield(projectId);
-            }
-            if (!this.registry.hasProvider(toolProtection.oauthProvider)) {
-                throw new Error(`Provider "${toolProtection.oauthProvider}" not configured for project "${projectId}". ` +
-                    `Add provider in project settings.`);
-            }
-            return toolProtection.oauthProvider;
-        }
-        // Priority 2: Scope prefix inference (fallback)
-        const inferredProvider = this.inferProviderFromScopes(toolProtection.requiredScopes || []);
-        if (inferredProvider) {
-            // Ensure registry is loaded before checking
-            if (this.registry.getProviderNames().length === 0) {
-                await this.registry.loadFromAgentShield(projectId);
-            }
-            if (this.registry.hasProvider(inferredProvider)) {
-                console.error(`[ProviderResolver] Inferred provider "${inferredProvider}" from scopes`);
-                return inferredProvider;
-            }
-        }
-        // Priority 3: Use explicitly configured provider from AgentShield dashboard
-        // This is the provider the user has actually configured, not just any available provider
-        await this.registry.loadFromAgentShield(projectId);
-        const configuredProvider = this.registry.getConfiguredProvider();
-        if (configuredProvider && this.registry.hasProvider(configuredProvider)) {
-            console.warn(`[ProviderResolver] Tool does not specify oauthProvider. ` +
-                `Using project-configured provider "${configuredProvider}" as fallback. ` +
-                `Consider explicitly setting oauthProvider in tool protection config.`);
-            return configuredProvider;
-        }
-        // Priority 4: Error if no provider is configured
-        // NOTE: We intentionally do NOT fall back to "first available provider" anymore
-        // because AgentShield returns ALL providers (even unconfigured ones).
-        // Only use providers explicitly configured by the user.
-        throw new Error(`Tool requires OAuth but no provider is configured for project "${projectId}". ` +
-            `Configure an OAuth provider in AgentShield dashboard.`);
-    }
-    /**
-     * Infer provider from scope prefixes
-     *
-     * Used as Priority 2 fallback when oauthProvider is not specified.
-     * Examples:
-     * - github:repo:read → github
-     * - gmail:read → google
-     * - microsoft:calendar:read → microsoft
-     *
-     * @param scopes - Required scopes for the tool
-     * @returns Provider name if uniquely inferred, null otherwise
-     */
-    inferProviderFromScopes(scopes) {
-        if (!scopes || scopes.length === 0) {
-            return null;
-        }
-        // Extract first part of scope (before first colon)
-        const scopePrefixes = scopes.map((scope) => {
-            const parts = scope.split(":");
-            return parts[0].toLowerCase();
-        });
-        // Provider mapping
-        const providerMap = {
-            github: "github",
-            google: "google",
-            gmail: "google", // gmail:read → google
-            calendar: "google", // calendar:read → google (if ambiguous, use project default)
-            microsoft: "microsoft",
-            outlook: "microsoft",
-            slack: "slack",
-            auth0: "auth0",
-            okta: "okta",
-        };
-        // Find unique provider
-        const providers = new Set(scopePrefixes.map((prefix) => providerMap[prefix]).filter(Boolean));
-        if (providers.size === 1) {
-            return Array.from(providers)[0];
-        }
-        // Ambiguous or no prefix → return null (use project-level provider)
-        return null;
-    }
-}
-exports.ProviderResolver = ProviderResolver;
-//# sourceMappingURL=provider-resolver.js.map

package/dist/services/provider-validator.d.ts

@@ -1,55 +0,0 @@
-/**
- * Provider Validator
- *
- * Validates OAuth provider configurations for custom IDP support.
- * Ensures provider configurations are valid before registration.
- *
- * @package @kya-os/mcp-i-core
- */
-import type { OAuthProvider } from "@kya-os/contracts/config";
-/**
- * Validation error for provider configuration issues
- */
-export declare class ProviderValidationError extends Error {
-    readonly field?: string | undefined;
-    constructor(message: string, field?: string | undefined);
-}
-/**
- * Service for validating OAuth provider configurations
- */
-export declare class ProviderValidator {
-    /**
-     * Validate provider configuration
-     *
-     * @param provider - Provider configuration to validate
-     * @param name - Provider name (for error messages)
-     * @throws ProviderValidationError if validation fails
-     */
-    validate(provider: OAuthProvider, name: string): void;
-    /**
-     * Validate URL format
-     *
-     * @param url - URL to validate
-     * @param providerName - Provider name (for error messages)
-     * @param fieldName - Field name (for error messages)
-     * @throws ProviderValidationError if URL is invalid
-     */
-    private validateUrl;
-    /**
-     * Validate custom parameters don't override reserved OAuth parameters
-     *
-     * @param customParams - Custom parameters to validate
-     * @param providerName - Provider name (for error messages)
-     * @throws ProviderValidationError if reserved parameter is overridden
-     */
-    private validateCustomParams;
-    /**
-     * Test provider endpoint reachability (optional)
-     *
-     * @param provider - Provider configuration
-     * @param fetchProvider - Fetch implementation
-     * @returns True if endpoint is reachable, false otherwise
-     */
-    testProvider(provider: OAuthProvider, fetchProvider: typeof fetch): Promise<boolean>;
-}
-//# sourceMappingURL=provider-validator.d.ts.map