@kya-os/mcp-i-core 1.7.0 → 1.8.1

package/dist/config/remote-config.js

@@ -1,253 +0,0 @@
-"use strict";
-/**
- * Remote Configuration Fetching
- *
- * Service for fetching configuration from remote APIs (AgentShield dashboard)
- * with caching support for performance optimization.
- *
- * @module @kya-os/mcp-i-core/config/remote-config
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.fetchRemoteConfig = fetchRemoteConfig;
-exports.getToolProtection = getToolProtection;
-exports.extractToolProtections = extractToolProtections;
-exports.hasMergedToolProtections = hasMergedToolProtections;
-exports.getPolicy = getPolicy;
-exports.extractPolicy = extractPolicy;
-exports.hasMergedPolicy = hasMergedPolicy;
-exports.isPolicyEnabled = isPolicyEnabled;
-const agentshield_api_1 = require("@kya-os/contracts/agentshield-api");
-const contracts_1 = require("@kya-os/contracts");
-/**
- * Fetch configuration from remote API (AgentShield dashboard)
- *
- * Attempts to fetch configuration from the AgentShield API with caching support.
- * Falls back gracefully if remote fetch fails.
- *
- * @param options - Remote config options
- * @param cache - Optional cache implementation
- * @returns Configuration object or null if fetch fails
- */
-async function fetchRemoteConfig(options, cache) {
-    const { apiUrl, apiKey, projectId, agentDid, cacheTtl = 300000, fetchProvider } = options;
-    // Generate cache key
-    const cacheKey = projectId
-        ? `config:project:${projectId}`
-        : agentDid
-            ? `config:agent:${agentDid}`
-            : null;
-    // Try cache first
-    if (cache && cacheKey) {
-        try {
-            const cached = await cache.get(cacheKey);
-            if (cached) {
-                try {
-                    const parsed = JSON.parse(cached);
-                    if (parsed.expiresAt > Date.now()) {
-                        return parsed.config;
-                    }
-                }
-                catch {
-                    // Invalid cache entry, continue to fetch
-                }
-            }
-        }
-        catch (error) {
-            // Cache read failed, continue to fetch
-            console.warn('[RemoteConfig] Cache read failed:', error);
-        }
-    }
-    // Fetch from API
-    try {
-        // ❌ REMOVED: Legacy agent-scoped endpoint fallback
-        // Agent-only scoping causes cross-user delegation leakage (Priority 3 fallback issue)
-        // projectId is now REQUIRED for proper user isolation
-        if (!projectId) {
-            console.error('[RemoteConfig] projectId is required for user-scoped delegation. ' +
-                'Agent-only scoping has been deprecated due to security concerns (cross-user delegation leakage). ' +
-                'Please configure AGENTSHIELD_PROJECT_ID environment variable.');
-            return null;
-        }
-        // ✅ PROJECT-SCOPED ENDPOINT: Ensures delegations are properly scoped to user+agent
-        const url = `${apiUrl}${agentshield_api_1.AGENTSHIELD_ENDPOINTS.CONFIG(projectId)}`;
-        const response = await fetchProvider(url, {
-            headers: {
-                'Authorization': `Bearer ${apiKey}`,
-                'Content-Type': 'application/json'
-            }
-        });
-        if (!response.ok) {
-            console.warn(`[RemoteConfig] API returned ${response.status}: ${response.statusText}`);
-            return null;
-        }
-        const data = await response.json();
-        // Extract config from API response
-        // API response format: { success: boolean, data: { config: MCPIConfig } }
-        const responseData = data;
-        const config = responseData.config || responseData.data?.config || (responseData.success ? responseData.data : null);
-        if (!config) {
-            console.warn('[RemoteConfig] No config found in API response');
-            return null;
-        }
-        // Cache the result
-        if (cache && cacheKey) {
-            try {
-                await cache.set(cacheKey, JSON.stringify({
-                    config,
-                    expiresAt: Date.now() + cacheTtl
-                }), cacheTtl);
-            }
-            catch (error) {
-                // Cache write failed, but we got the config so continue
-                console.warn('[RemoteConfig] Cache write failed:', error);
-            }
-        }
-        return config;
-    }
-    catch (error) {
-        console.warn('[RemoteConfig] Failed to fetch config:', error);
-        return null;
-    }
-}
-/**
- * Get tool protection for a specific tool from a merged config
- *
- * This helper function extracts tool protection from a merged config response.
- * It handles both the new format (toolProtection.tools) and returns null
- * for unprotected or unknown tools.
- *
- * @param config - Merged config object (must have toolProtection.tools)
- * @param toolName - Name of the tool to look up
- * @returns Tool protection or null if tool not protected or not found
- *
- * @since 1.6.0
- */
-function getToolProtection(config, toolName) {
-    const tools = config?.toolProtection?.tools;
-    if (!tools) {
-        return null;
-    }
-    // Check for specific tool protection first
-    let protection = tools[toolName];
-    // Fall back to wildcard protection if specific tool not found
-    if (!protection && tools['*']) {
-        protection = tools['*'];
-    }
-    // Return null for unprotected tools (requiresDelegation: false) or unknown tools
-    if (!protection || !protection.requiresDelegation) {
-        return null;
-    }
-    return protection;
-}
-/**
- * Extract tool protections map from merged config
- *
- * This helper function extracts the tool protections map from a merged config.
- * Returns an empty object if no tools are found.
- *
- * @param config - Config object that may contain toolProtection.tools
- * @returns Tool protection map or empty object
- *
- * @since 1.6.0
- */
-function extractToolProtections(config) {
-    if (!config?.toolProtection?.tools) {
-        return {};
-    }
-    return config.toolProtection.tools;
-}
-/**
- * Check if config has embedded tool protections
- *
- * Utility to check if a config response is in the new merged format
- * with embedded tool protections.
- *
- * @param config - Config object to check
- * @returns True if config has embedded tools, false otherwise
- *
- * @since 1.6.0
- */
-function hasMergedToolProtections(config) {
-    if (!config || typeof config !== 'object') {
-        return false;
-    }
-    const c = config;
-    return (c.toolProtection !== undefined &&
-        typeof c.toolProtection === 'object' &&
-        c.toolProtection !== null &&
-        'tools' in c.toolProtection &&
-        typeof c.toolProtection.tools === 'object' &&
-        c.toolProtection.tools !== null // typeof null === 'object' in JS
-    );
-}
-// ============================================================================
-// Policy Configuration Helpers
-// ============================================================================
-/**
- * Get policy configuration from a merged config
- *
- * This helper function extracts policy configuration from a merged config response.
- * Returns null if no policy is present in the config.
- *
- * @param config - Config object that may contain policy
- * @returns Policy configuration or null if not present
- *
- * @since 1.7.0
- */
-function getPolicy(config) {
-    if (!config?.policy) {
-        return null;
-    }
-    return config.policy;
-}
-/**
- * Extract policy configuration from merged config with defaults
- *
- * This helper function extracts the policy from a merged config.
- * Returns the default policy config if no policy is found.
- *
- * @param config - Config object that may contain policy
- * @returns Policy configuration (never null, returns defaults if missing)
- *
- * @since 1.7.0
- */
-function extractPolicy(config) {
-    if (!config?.policy) {
-        // Return a deep clone to prevent mutation of the shared default
-        return structuredClone(contracts_1.DEFAULT_POLICY_CONFIG);
-    }
-    return config.policy;
-}
-/**
- * Check if config has embedded policy configuration
- *
- * Utility to check if a config response includes policy configuration.
- *
- * @param config - Config object to check
- * @returns True if config has policy, false otherwise
- *
- * @since 1.7.0
- */
-function hasMergedPolicy(config) {
-    if (!config || typeof config !== 'object') {
-        return false;
-    }
-    const c = config;
-    return (c.policy !== undefined &&
-        typeof c.policy === 'object' &&
-        c.policy !== null);
-}
-/**
- * Check if policy enforcement is enabled for a config
- *
- * @param config - Config object that may contain policy
- * @returns True if policy is present and enabled
- *
- * @since 1.7.0
- */
-function isPolicyEnabled(config) {
-    const policy = getPolicy(config);
-    // Default to true to match DEFAULT_POLICY_CONFIG.enabled and PolicyService.isEnabled()
-    return policy?.enabled ?? true;
-}
-//# sourceMappingURL=remote-config.js.map

package/dist/config.d.ts

@@ -1,182 +0,0 @@
-/**
- * Provider-based Runtime Configuration
- *
- * Core configuration for MCP-I runtime using the provider pattern.
- * This is the foundation for all platform-specific implementations.
- *
- * @module @kya-os/mcp-i-core/config
- */
-import type { MCPIBaseConfig, RuntimeIdentityConfig, ProofingConfig, DelegationConfig, ToolProtectionSourceConfig } from '@kya-os/contracts/config';
-import type { CryptoProvider, ClockProvider, FetchProvider, StorageProvider, NonceCacheProvider, IdentityProvider } from './providers/base';
-import type { ToolProtectionService } from './services/tool-protection.service';
-/**
- * Provider-based runtime configuration
- *
- * This configuration is used internally by MCPIRuntimeBase and provides
- * the foundation for all platform-specific implementations. It uses the
- * provider pattern for platform abstraction, allowing different implementations
- * for Node.js, Cloudflare Workers, and other environments.
- */
-export interface ProviderRuntimeConfig extends MCPIBaseConfig {
-    /**
-     * Cryptographic operations provider
-     * Handles signing, verification, and key generation
-     */
-    cryptoProvider: CryptoProvider;
-    /**
-     * Time operations provider
-     * Provides current time and timestamp generation
-     */
-    clockProvider: ClockProvider;
-    /**
-     * HTTP fetch operations provider
-     * Handles external API calls
-     */
-    fetchProvider: FetchProvider;
-    /**
-     * Storage operations provider
-     * Handles persistent data storage
-     */
-    storageProvider: StorageProvider;
-    /**
-     * Nonce cache provider
-     * Handles replay prevention
-     */
-    nonceCacheProvider: NonceCacheProvider;
-    /**
-     * Identity management provider
-     * Handles agent identity and DID operations
-     */
-    identityProvider: IdentityProvider;
-    /**
-     * Session configuration
-     * Controls session handling and timeouts
-     */
-    session?: {
-        /**
-         * Allowed timestamp skew in seconds
-         * @default 120
-         */
-        timestampSkewSeconds?: number;
-        /**
-         * Session TTL in minutes
-         * @default 30
-         */
-        ttlMinutes?: number;
-    };
-    /**
-     * Identity configuration (optional)
-     * When provided, enables identity features
-     */
-    identity?: RuntimeIdentityConfig;
-    /**
-     * Proofing configuration (optional)
-     * When provided, enables proof generation
-     */
-    proofing?: ProofingConfig;
-    /**
-     * Delegation configuration (optional)
-     * When provided, enables delegation verification
-     */
-    delegation?: DelegationConfig;
-    /**
-     * Tool protection service (optional)
-     * When provided, enables runtime tool protection
-     * Note: This is different from tool registry which is compile-time
-     */
-    toolProtectionService?: ToolProtectionService;
-    /**
-     * Tool protection source configuration (optional)
-     * Alternative to toolProtectionService for configuration-based setup
-     */
-    toolProtection?: ToolProtectionSourceConfig;
-}
-/**
- * Builder for provider runtime configuration
- * Helps create valid configurations with proper defaults
- */
-export declare class ProviderRuntimeConfigBuilder {
-    private config;
-    /**
-     * Set the providers (required)
-     */
-    withProviders(providers: {
-        cryptoProvider: CryptoProvider;
-        clockProvider: ClockProvider;
-        fetchProvider: FetchProvider;
-        storageProvider: StorageProvider;
-        nonceCacheProvider: NonceCacheProvider;
-        identityProvider: IdentityProvider;
-    }): this;
-    /**
-     * Set the environment
-     */
-    withEnvironment(env: 'development' | 'production'): this;
-    /**
-     * Configure session handling
-     */
-    withSession(session: {
-        timestampSkewSeconds?: number;
-        ttlMinutes?: number;
-    }): this;
-    /**
-     * Enable identity features
-     */
-    withIdentity(identity: RuntimeIdentityConfig): this;
-    /**
-     * Enable proofing features
-     */
-    withProofing(proofing: ProofingConfig): this;
-    /**
-     * Enable delegation features
-     */
-    withDelegation(delegation: DelegationConfig): this;
-    /**
-     * Set tool protection service
-     */
-    withToolProtectionService(service: ToolProtectionService): this;
-    /**
-     * Set tool protection configuration
-     */
-    withToolProtection(config: ToolProtectionSourceConfig): this;
-    /**
-     * Enable audit features
-     */
-    withAudit(audit: {
-        enabled: boolean;
-        includeProofHashes?: boolean;
-    }): this;
-    /**
-     * Enable well-known endpoints
-     */
-    withWellKnown(wellKnown: {
-        enabled: boolean;
-        serviceName?: string;
-    }): this;
-    /**
-     * Build the configuration
-     * Validates that all required providers are set
-     */
-    build(): ProviderRuntimeConfig;
-}
-/**
- * Re-export base types for convenience
- */
-export type { MCPIBaseConfig, RuntimeIdentityConfig as BaseIdentityConfig, ProofingConfig, DelegationConfig, ToolProtectionSourceConfig } from '@kya-os/contracts/config';
-/**
- * Re-export remote config utilities
- */
-export { fetchRemoteConfig, getToolProtection, extractToolProtections, hasMergedToolProtections, type RemoteConfigOptions, type RemoteConfigCache } from './config/remote-config';
-/**
- * Create a provider runtime configuration
- * Convenience function for creating configurations
- */
-export declare function createProviderRuntimeConfig(providers: {
-    cryptoProvider: CryptoProvider;
-    clockProvider: ClockProvider;
-    fetchProvider: FetchProvider;
-    storageProvider: StorageProvider;
-    nonceCacheProvider: NonceCacheProvider;
-    identityProvider: IdentityProvider;
-}, options?: Partial<Omit<ProviderRuntimeConfig, keyof typeof providers>>): ProviderRuntimeConfig;
-//# sourceMappingURL=config.d.ts.map

package/dist/config.js

@@ -1,148 +0,0 @@
-"use strict";
-/**
- * Provider-based Runtime Configuration
- *
- * Core configuration for MCP-I runtime using the provider pattern.
- * This is the foundation for all platform-specific implementations.
- *
- * @module @kya-os/mcp-i-core/config
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.hasMergedToolProtections = exports.extractToolProtections = exports.getToolProtection = exports.fetchRemoteConfig = exports.ProviderRuntimeConfigBuilder = void 0;
-exports.createProviderRuntimeConfig = createProviderRuntimeConfig;
-/**
- * Builder for provider runtime configuration
- * Helps create valid configurations with proper defaults
- */
-class ProviderRuntimeConfigBuilder {
-    config = {
-        environment: 'development'
-    };
-    /**
-     * Set the providers (required)
-     */
-    withProviders(providers) {
-        Object.assign(this.config, providers);
-        return this;
-    }
-    /**
-     * Set the environment
-     */
-    withEnvironment(env) {
-        this.config.environment = env;
-        return this;
-    }
-    /**
-     * Configure session handling
-     */
-    withSession(session) {
-        this.config.session = session;
-        return this;
-    }
-    /**
-     * Enable identity features
-     */
-    withIdentity(identity) {
-        this.config.identity = identity;
-        return this;
-    }
-    /**
-     * Enable proofing features
-     */
-    withProofing(proofing) {
-        this.config.proofing = proofing;
-        return this;
-    }
-    /**
-     * Enable delegation features
-     */
-    withDelegation(delegation) {
-        this.config.delegation = delegation;
-        return this;
-    }
-    /**
-     * Set tool protection service
-     */
-    withToolProtectionService(service) {
-        this.config.toolProtectionService = service;
-        return this;
-    }
-    /**
-     * Set tool protection configuration
-     */
-    withToolProtection(config) {
-        this.config.toolProtection = config;
-        return this;
-    }
-    /**
-     * Enable audit features
-     */
-    withAudit(audit) {
-        this.config.audit = audit;
-        return this;
-    }
-    /**
-     * Enable well-known endpoints
-     */
-    withWellKnown(wellKnown) {
-        this.config.wellKnown = wellKnown;
-        return this;
-    }
-    /**
-     * Build the configuration
-     * Validates that all required providers are set
-     */
-    build() {
-        const required = [
-            'cryptoProvider',
-            'clockProvider',
-            'fetchProvider',
-            'storageProvider',
-            'nonceCacheProvider',
-            'identityProvider'
-        ];
-        for (const field of required) {
-            if (!(field in this.config)) {
-                throw new Error(`Missing required provider: ${field}`);
-            }
-        }
-        // Apply defaults
-        return {
-            environment: 'development',
-            session: {
-                timestampSkewSeconds: 120,
-                ttlMinutes: 30
-            },
-            ...this.config
-        };
-    }
-}
-exports.ProviderRuntimeConfigBuilder = ProviderRuntimeConfigBuilder;
-/**
- * Re-export remote config utilities
- */
-var remote_config_1 = require("./config/remote-config");
-Object.defineProperty(exports, "fetchRemoteConfig", { enumerable: true, get: function () { return remote_config_1.fetchRemoteConfig; } });
-Object.defineProperty(exports, "getToolProtection", { enumerable: true, get: function () { return remote_config_1.getToolProtection; } });
-Object.defineProperty(exports, "extractToolProtections", { enumerable: true, get: function () { return remote_config_1.extractToolProtections; } });
-Object.defineProperty(exports, "hasMergedToolProtections", { enumerable: true, get: function () { return remote_config_1.hasMergedToolProtections; } });
-/**
- * Create a provider runtime configuration
- * Convenience function for creating configurations
- */
-function createProviderRuntimeConfig(providers, options) {
-    return new ProviderRuntimeConfigBuilder()
-        .withProviders(providers)
-        .withEnvironment(options?.environment || 'development')
-        .withSession(options?.session || {})
-        .withIdentity(options?.identity || { enabled: false, environment: 'development' })
-        .withProofing(options?.proofing || { enabled: false })
-        .withDelegation(options?.delegation || {
-        enabled: false,
-        verifier: { type: 'memory' }
-    })
-        .withAudit(options?.audit || { enabled: false })
-        .withWellKnown(options?.wellKnown || { enabled: true })
-        .build();
-}
-//# sourceMappingURL=config.js.map

package/dist/identity/idp-token-resolver.d.ts

@@ -1,69 +0,0 @@
-/**
- * IDP Token Resolver
- *
- * Resolves User DID to IDP access token (MH-7 requirement).
- * Handles token lookup, expiration checking, and automatic refresh.
- *
- * Updated for CRED-003: Returns full token data including usage metadata
- * to support credential providers with custom token usage patterns.
- *
- * @package @kya-os/mcp-i-core
- */
-import type { IdpTokens } from "@kya-os/contracts/config";
-import type { IIdpTokenStorage, IdpTokensWithMetadata } from "./idp-token-storage.interface.js";
-export interface IdpTokenResolverConfig {
-    /** Token storage implementation */
-    tokenStorage: IIdpTokenStorage;
-    /** OAuth service for token refresh */
-    oauthService: {
-        refreshToken(provider: string, refreshToken: string): Promise<IdpTokens | null>;
-    };
-    /** Optional logger callback for diagnostics */
-    logger?: (message: string, data?: unknown) => void;
-}
-/**
- * Service for resolving User DID to IDP access token
- *
- * MH-7 Requirement: resolveTokenFromDid(userDid: string): Promise<string>
- *
- * This service implements the core MH-7 functionality:
- * - Resolves User DID to IDP access token
- * - Handles token expiration and automatic refresh
- * - Supports multiple IDP providers
- */
-export declare class IdpTokenResolver {
-    private config;
-    constructor(config: IdpTokenResolverConfig);
-    /**
-     * Resolve User DID to IDP access token
-     *
-     * MH-7 Requirement: resolveTokenFromDid(userDid: string): Promise<string>
-     *
-     * Flow:
-     * 1. Look up token from storage
-     * 2. Check expiration
-     * 3. Auto-refresh if expired and refresh_token available
-     * 4. Update storage after refresh
-     * 5. Return access_token or null
-     *
-     * @param userDid - User DID to resolve
-     * @param provider - OAuth provider name (e.g., "github", "google")
-     * @param scopes - Required scopes for token
-     * @returns Access token or null if not found/expired
-     */
-    resolveTokenFromDid(userDid: string, provider: string, scopes: string[]): Promise<string | null>;
-    /**
-     * Resolve User DID to full IDP token data (CRED-003)
-     *
-     * Returns the full token data including usage metadata for credential providers.
-     * This allows ToolContextBuilder to construct appropriate headers based on
-     * tokenUsage (cookie/bearer/header) and cookieFormat.
-     *
-     * @param userDid - User DID to resolve
-     * @param provider - OAuth provider name or credential provider
-     * @param scopes - Required scopes for token
-     * @returns Full token data with metadata or null if not found/expired
-     */
-    resolveTokenDataFromDid(userDid: string, provider: string, scopes: string[]): Promise<IdpTokensWithMetadata | null>;
-}
-//# sourceMappingURL=idp-token-resolver.d.ts.map