@kya-os/mcp-i-core 1.8.0 → 1.8.1

package/dist/services/authorization/authorization-registry.d.ts

@@ -1,29 +0,0 @@
-/**
- * Authorization Registry
- *
- * Registry for managing available authorization services.
- * Allows looking up the appropriate service for a given authorization type.
- *
- * @package @kya-os/mcp-i-core
- */
-import type { AuthorizationService } from "./types.js";
-import type { ToolProtection, AuthorizationRequirement } from "@kya-os/contracts/tool-protection";
-export declare class AuthorizationRegistry {
-    private services;
-    /**
-     * Register an authorization service
-     */
-    register(service: AuthorizationService): void;
-    /**
-     * Get an authorization service by type
-     */
-    getService(type: string): AuthorizationService | null;
-    /**
-     * Resolve authorization requirement for a tool
-     *
-     * Determines the authorization requirement based on the tool protection config.
-     * Handles backward compatibility with legacy `oauthProvider` field.
-     */
-    resolveRequirement(toolProtection: ToolProtection): AuthorizationRequirement | null;
-}
-//# sourceMappingURL=authorization-registry.d.ts.map

package/dist/services/authorization/authorization-registry.js

@@ -1,58 +0,0 @@
-"use strict";
-/**
- * Authorization Registry
- *
- * Registry for managing available authorization services.
- * Allows looking up the appropriate service for a given authorization type.
- *
- * @package @kya-os/mcp-i-core
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthorizationRegistry = void 0;
-class AuthorizationRegistry {
-    services = new Map();
-    /**
-     * Register an authorization service
-     */
-    register(service) {
-        this.services.set(service.type, service);
-    }
-    /**
-     * Get an authorization service by type
-     */
-    getService(type) {
-        return this.services.get(type) || null;
-    }
-    /**
-     * Resolve authorization requirement for a tool
-     *
-     * Determines the authorization requirement based on the tool protection config.
-     * Handles backward compatibility with legacy `oauthProvider` field.
-     */
-    resolveRequirement(toolProtection) {
-        if (!toolProtection.requiresDelegation) {
-            return null;
-        }
-        // Use the explicit authorization field if present
-        if (toolProtection.authorization) {
-            return toolProtection.authorization;
-        }
-        // Legacy fallback: oauthProvider field
-        // Note: Returns 'oauth' for backward compat; consumers should normalize to 'oauth2'
-        if (toolProtection.oauthProvider) {
-            return {
-                type: 'oauth',
-                provider: toolProtection.oauthProvider,
-            };
-        }
-        // If requiresDelegation is true but no auth specified, default to 'none' (consent only)
-        // UNLESS we are in a transition period where ProviderResolver might infer scopes.
-        // This logic will be refined as we move logic from ProviderResolver to here.
-        // For now, return null to let downstream logic handle fallbacks if needed,
-        // or return 'none' if we want to enforce explicit config.
-        // Returning null allows the legacy ProviderResolver to attempt scope inference
-        return null;
-    }
-}
-exports.AuthorizationRegistry = AuthorizationRegistry;
-//# sourceMappingURL=authorization-registry.js.map

package/dist/services/authorization/types.d.ts

@@ -1,53 +0,0 @@
-/**
- * Authorization Service Types
- *
- * Shared types for authorization services and flows.
- *
- * @package @kya-os/mcp-i-core
- */
-import type { ToolProtection } from "@kya-os/contracts/tool-protection";
-/**
- * Authorization Flow Result
- */
-export interface AuthorizationResult {
-    success: boolean;
-    credential?: unknown;
-    userDid?: string;
-    metadata?: Record<string, unknown>;
-    error?: Error;
-}
-/**
- * Authorization Flow
- * Represents an initiated authorization flow
- */
-export interface AuthorizationFlow {
-    /** URL to redirect the user to */
-    url: string;
-    /** Unique identifier for this flow */
-    flowId?: string;
-    /** Metadata about the flow */
-    metadata?: Record<string, unknown>;
-}
-/**
- * Authorization Service Interface
- * Each authorization type implements this
- */
-export interface AuthorizationService {
-    /** Unique type identifier (e.g., 'oauth', 'mdl', 'idv') */
-    type: string;
-    /**
-     * Check if authorization is required for the given tool protection
-     */
-    isRequired(toolProtection: ToolProtection): boolean;
-    /**
-     * Initiate authorization flow
-     * Returns URL or flow identifier
-     */
-    initiateFlow(toolProtection: ToolProtection, sessionId: string, projectId: string, agentDid: string, serverUrl: string): Promise<AuthorizationFlow>;
-    /**
-     * Verify authorization result
-     * Called after user completes flow
-     */
-    verifyAuthorization(flowId: string, result: unknown): Promise<AuthorizationResult>;
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/services/authorization/types.js

@@ -1,10 +0,0 @@
-"use strict";
-/**
- * Authorization Service Types
- *
- * Shared types for authorization services and flows.
- *
- * @package @kya-os/mcp-i-core
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=types.js.map

package/dist/services/batch-delegation.service.d.ts

@@ -1,53 +0,0 @@
-/**
- * Batch Delegation Service
- *
- * Groups tools by OAuth provider for batch delegation flows.
- * Enables single OAuth flow for multiple tools requiring the same provider.
- *
- * @package @kya-os/mcp-i-core
- */
-import type { ProviderResolver } from "./provider-resolver.js";
-import type { ToolProtectionService } from "./tool-protection.service.js";
-/**
- * Tool group by provider
- */
-export interface ToolGroup {
-    /** OAuth provider name */
-    provider: string;
-    /** Tool names in this group */
-    tools: string[];
-    /** Merged scopes from all tools in group */
-    scopes: string[];
-    /** Highest risk level in group */
-    riskLevel: "low" | "medium" | "high";
-}
-/**
- * Service for grouping tools by OAuth provider
- */
-export declare class BatchDelegationService {
-    private providerResolver;
-    private toolProtectionService;
-    constructor(providerResolver: ProviderResolver, toolProtectionService: ToolProtectionService);
-    /**
-     * Group tools by OAuth provider
-     *
-     * Returns a map of provider → tools that require that provider.
-     * Tools that don't require delegation are skipped.
-     *
-     * @param toolNames - Array of tool names to group
-     * @param projectId - Project ID for provider resolution
-     * @param agentDid - Agent DID for fetching tool protections
-     * @returns Map of provider name to ToolGroup
-     */
-    groupToolsByProvider(toolNames: string[], projectId: string, agentDid: string): Promise<Map<string, ToolGroup>>;
-    /**
-     * Get all tools that require a specific provider
-     *
-     * @param provider - Provider name to filter by
-     * @param projectId - Project ID for provider resolution
-     * @param agentDid - Agent DID for fetching tool protections
-     * @returns Array of tool names requiring the specified provider
-     */
-    getToolsForProvider(_provider: string, _projectId: string, _agentDid: string): Promise<string[]>;
-}
-//# sourceMappingURL=batch-delegation.service.d.ts.map

package/dist/services/batch-delegation.service.js

@@ -1,95 +0,0 @@
-"use strict";
-/**
- * Batch Delegation Service
- *
- * Groups tools by OAuth provider for batch delegation flows.
- * Enables single OAuth flow for multiple tools requiring the same provider.
- *
- * @package @kya-os/mcp-i-core
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BatchDelegationService = void 0;
-/**
- * Service for grouping tools by OAuth provider
- */
-class BatchDelegationService {
-    providerResolver;
-    toolProtectionService;
-    constructor(providerResolver, toolProtectionService) {
-        this.providerResolver = providerResolver;
-        this.toolProtectionService = toolProtectionService;
-    }
-    /**
-     * Group tools by OAuth provider
-     *
-     * Returns a map of provider → tools that require that provider.
-     * Tools that don't require delegation are skipped.
-     *
-     * @param toolNames - Array of tool names to group
-     * @param projectId - Project ID for provider resolution
-     * @param agentDid - Agent DID for fetching tool protections
-     * @returns Map of provider name to ToolGroup
-     */
-    async groupToolsByProvider(toolNames, projectId, agentDid) {
-        const groups = new Map();
-        for (const toolName of toolNames) {
-            const protection = await this.toolProtectionService.checkToolProtection(toolName, agentDid);
-            if (!protection?.requiresDelegation) {
-                continue; // Skip tools that don't require delegation
-            }
-            // Resolve provider for this tool
-            let provider;
-            try {
-                provider = await this.providerResolver.resolveProvider(protection, projectId);
-            }
-            catch (error) {
-                console.warn(`[BatchDelegation] Could not resolve provider for tool "${toolName}", skipping`, error instanceof Error ? error.message : String(error));
-                continue;
-            }
-            // Get or create group for this provider
-            if (!groups.has(provider)) {
-                groups.set(provider, {
-                    provider,
-                    tools: [],
-                    scopes: [],
-                    riskLevel: "medium", // Default
-                });
-            }
-            const group = groups.get(provider);
-            group.tools.push(toolName);
-            // Merge scopes (deduplicate)
-            const allScopes = new Set([
-                ...group.scopes,
-                ...(protection.requiredScopes || []),
-            ]);
-            group.scopes = Array.from(allScopes);
-            // Use highest risk level
-            if (protection.riskLevel) {
-                const riskOrder = { low: 1, medium: 2, high: 3, critical: 4 };
-                const currentRisk = riskOrder[group.riskLevel] || 1;
-                const toolRisk = riskOrder[protection.riskLevel] || 1;
-                if (toolRisk > currentRisk) {
-                    // Map critical to high for ToolGroup interface
-                    group.riskLevel = protection.riskLevel === "critical" ? "high" : protection.riskLevel;
-                }
-            }
-        }
-        return groups;
-    }
-    /**
-     * Get all tools that require a specific provider
-     *
-     * @param provider - Provider name to filter by
-     * @param projectId - Project ID for provider resolution
-     * @param agentDid - Agent DID for fetching tool protections
-     * @returns Array of tool names requiring the specified provider
-     */
-    async getToolsForProvider(_provider, _projectId, _agentDid) {
-        // Stub implementation: Returns empty array.
-        // Full implementation would fetch all tool protections and filter by provider.
-        // TODO(feature): Implement when batch delegation UI requires provider-based tool grouping.
-        return [];
-    }
-}
-exports.BatchDelegationService = BatchDelegationService;
-//# sourceMappingURL=batch-delegation.service.js.map

package/dist/services/crypto.service.d.ts

@@ -1,69 +0,0 @@
-/**
- * CryptoService
- *
- * Centralized cryptographic operations service that provides consistent
- * signature verification across all platforms (Cloudflare, Node.js, etc.).
- *
- * This service eliminates code duplication and ensures cryptographic operations
- * behave identically everywhere.
- */
-import { CryptoProvider } from "../providers/base.js";
-/**
- * Minimal JWK interface to avoid external dependencies
- */
-export interface Ed25519JWK {
-    kty: "OKP";
-    crv: "Ed25519";
-    x: string;
-    kid?: string;
-    use?: string;
-}
-/**
- * JWS parsing result
- */
-export interface ParsedJWS {
-    header: Record<string, unknown>;
-    payload?: Record<string, unknown>;
-    signatureBytes: Uint8Array;
-    signingInput: string;
-}
-export declare class CryptoService {
-    private cryptoProvider;
-    constructor(cryptoProvider: CryptoProvider);
-    /**
-     * Verify raw Ed25519 signature
-     * @param data - Data that was signed
-     * @param signature - Signature bytes
-     * @param publicKey - Base64 encoded Ed25519 public key (32 bytes)
-     */
-    verifyEd25519(data: Uint8Array, signature: Uint8Array, publicKey: string): Promise<boolean>;
-    /**
-     * Parse JWS into components
-     * @param jws - Full compact JWS string (header.payload.signature)
-     * @returns Parsed JWS components
-     */
-    parseJWS(jws: string): ParsedJWS;
-    /**
-     * Verify JWS signature (full compact format: header.payload.signature)
-     * @param jws - Full compact JWS string (or detached format: header..signature)
-     * @param publicKeyJwk - Ed25519 public key in JWK format
-     * @param options - Verification options
-     * @param options.detachedPayload - Optional detached payload (Uint8Array or string) for detached JWS format
-     * @param options.expectedKid - Optional expected key ID to validate
-     * @param options.alg - Optional expected algorithm (defaults to 'EdDSA')
-     */
-    verifyJWS(jws: string, publicKeyJwk: Ed25519JWK, options?: {
-        detachedPayload?: Uint8Array | string;
-        expectedKid?: string;
-        alg?: "EdDSA";
-    }): Promise<boolean>;
-    /**
-     * Validate Ed25519 JWK format
-     */
-    private isValidEd25519JWK;
-    /**
-     * Convert Ed25519 JWK to base64 encoded public key
-     */
-    private jwkToBase64PublicKey;
-}
-//# sourceMappingURL=crypto.service.d.ts.map

package/dist/services/crypto.service.js

@@ -1,225 +0,0 @@
-"use strict";
-/**
- * CryptoService
- *
- * Centralized cryptographic operations service that provides consistent
- * signature verification across all platforms (Cloudflare, Node.js, etc.).
- *
- * This service eliminates code duplication and ensures cryptographic operations
- * behave identically everywhere.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CryptoService = void 0;
-const base64_js_1 = require("../utils/base64.js");
-class CryptoService {
-    cryptoProvider;
-    constructor(cryptoProvider) {
-        this.cryptoProvider = cryptoProvider;
-    }
-    /**
-     * Verify raw Ed25519 signature
-     * @param data - Data that was signed
-     * @param signature - Signature bytes
-     * @param publicKey - Base64 encoded Ed25519 public key (32 bytes)
-     */
-    async verifyEd25519(data, signature, publicKey) {
-        try {
-            const result = await this.cryptoProvider.verify(data, signature, publicKey);
-            // Ensure we always return a boolean (handle undefined from unmocked providers)
-            return result === true;
-        }
-        catch (error) {
-            // Log error for debugging but return false for invalid signatures
-            console.error("[CryptoService] Ed25519 verification error:", error);
-            return false;
-        }
-    }
-    /**
-     * Parse JWS into components
-     * @param jws - Full compact JWS string (header.payload.signature)
-     * @returns Parsed JWS components
-     */
-    parseJWS(jws) {
-        const parts = jws.split(".");
-        if (parts.length !== 3) {
-            throw new Error("Invalid JWS format: expected header.payload.signature");
-        }
-        const [headerB64, payloadB64, signatureB64] = parts;
-        // Decode header
-        let header;
-        try {
-            header = JSON.parse((0, base64_js_1.base64urlDecodeToString)(headerB64));
-        }
-        catch (error) {
-            throw new Error(`Invalid header base64: ${error instanceof Error ? error.message : String(error)}`);
-        }
-        // Decode payload (optional, may be detached)
-        let payload;
-        if (payloadB64) {
-            try {
-                payload = JSON.parse((0, base64_js_1.base64urlDecodeToString)(payloadB64));
-            }
-            catch (error) {
-                // Payload decoding failed - this is an error for non-detached JWS
-                // Re-throw to let caller handle it (they can check if it's detached format)
-                throw new Error(`Invalid payload base64: ${error instanceof Error ? error.message : String(error)}`);
-            }
-        }
-        // Decode signature bytes
-        let signatureBytes;
-        try {
-            signatureBytes = (0, base64_js_1.base64urlDecodeToBytes)(signatureB64);
-        }
-        catch (error) {
-            // Invalid signature base64 - this is a fatal error
-            throw new Error(`Invalid signature base64: ${error instanceof Error ? error.message : String(error)}`);
-        }
-        // Create signing input (header.payload)
-        const signingInput = `${headerB64}.${payloadB64}`;
-        return {
-            header,
-            payload,
-            signatureBytes,
-            signingInput,
-        };
-    }
-    /**
-     * Verify JWS signature (full compact format: header.payload.signature)
-     * @param jws - Full compact JWS string (or detached format: header..signature)
-     * @param publicKeyJwk - Ed25519 public key in JWK format
-     * @param options - Verification options
-     * @param options.detachedPayload - Optional detached payload (Uint8Array or string) for detached JWS format
-     * @param options.expectedKid - Optional expected key ID to validate
-     * @param options.alg - Optional expected algorithm (defaults to 'EdDSA')
-     */
-    async verifyJWS(jws, publicKeyJwk, options) {
-        try {
-            // Validate JWK format
-            if (!this.isValidEd25519JWK(publicKeyJwk)) {
-                console.error("[CryptoService] Invalid Ed25519 JWK format");
-                return false;
-            }
-            // Validate expected kid if provided
-            if (options?.expectedKid && publicKeyJwk.kid !== options.expectedKid) {
-                console.error("[CryptoService] Key ID mismatch");
-                return false;
-            }
-            // Parse JWS components - handle malformed JWS gracefully
-            let parsed;
-            try {
-                parsed = this.parseJWS(jws);
-            }
-            catch (error) {
-                // Malformed JWS - check if it's detached format with provided payload
-                if (options?.detachedPayload !== undefined) {
-                    const parts = jws.split(".");
-                    if (parts.length === 3 && parts[1] === "") {
-                        // Detached format: header..signature
-                        try {
-                            const headerB64 = parts[0];
-                            const signatureB64 = parts[2];
-                            const header = JSON.parse((0, base64_js_1.base64urlDecodeToString)(headerB64));
-                            const signatureBytes = (0, base64_js_1.base64urlDecodeToBytes)(signatureB64);
-                            parsed = {
-                                header,
-                                payload: undefined,
-                                signatureBytes,
-                                signingInput: "", // Will be reconstructed below
-                            };
-                        }
-                        catch {
-                            console.error("[CryptoService] Invalid detached JWS format");
-                            return false;
-                        }
-                    }
-                    else {
-                        console.error("[CryptoService] Invalid JWS format:", error);
-                        return false;
-                    }
-                }
-                else {
-                    console.error("[CryptoService] Invalid JWS format:", error);
-                    return false;
-                }
-            }
-            // Validate algorithm
-            const expectedAlg = options?.alg || "EdDSA";
-            if (parsed.header.alg !== expectedAlg) {
-                console.error(`[CryptoService] Unsupported algorithm: ${parsed.header.alg}, expected ${expectedAlg}`);
-                return false;
-            }
-            // Handle detached payload if provided
-            let signingInput;
-            let signingInputBytes;
-            if (options?.detachedPayload !== undefined) {
-                // Detached format: reconstruct signing input from header + detached payload
-                const headerB64 = jws.split(".")[0];
-                let payloadB64;
-                if (options.detachedPayload instanceof Uint8Array) {
-                    // Uint8Array payload
-                    payloadB64 = (0, base64_js_1.base64urlEncodeFromBytes)(options.detachedPayload);
-                }
-                else {
-                    // String payload (backward compatibility)
-                    payloadB64 = (0, base64_js_1.base64urlEncodeFromBytes)(new TextEncoder().encode(options.detachedPayload));
-                }
-                signingInput = `${headerB64}.${payloadB64}`;
-                signingInputBytes = new TextEncoder().encode(signingInput);
-            }
-            else {
-                // Full compact format: use parsed signing input
-                if (!parsed.signingInput) {
-                    console.error("[CryptoService] Missing signing input for compact JWS");
-                    return false;
-                }
-                signingInput = parsed.signingInput;
-                signingInputBytes = new TextEncoder().encode(signingInput);
-            }
-            // Extract raw public key from JWK
-            let publicKeyBase64;
-            try {
-                publicKeyBase64 = this.jwkToBase64PublicKey(publicKeyJwk);
-            }
-            catch (error) {
-                console.error("[CryptoService] Failed to extract public key:", error);
-                return false;
-            }
-            // Verify signature
-            return await this.verifyEd25519(signingInputBytes, parsed.signatureBytes, publicKeyBase64);
-        }
-        catch (error) {
-            // Security-safe failure: never throw, always return false
-            console.error("[CryptoService] JWS verification error:", error);
-            return false;
-        }
-    }
-    /**
-     * Validate Ed25519 JWK format
-     */
-    isValidEd25519JWK(jwk) {
-        return (typeof jwk === "object" &&
-            jwk !== null &&
-            "kty" in jwk &&
-            jwk.kty === "OKP" &&
-            "crv" in jwk &&
-            jwk.crv === "Ed25519" &&
-            "x" in jwk &&
-            typeof jwk.x === "string" &&
-            jwk.x.length > 0);
-    }
-    /**
-     * Convert Ed25519 JWK to base64 encoded public key
-     */
-    jwkToBase64PublicKey(jwk) {
-        // The 'x' field contains the base64url encoded public key
-        // Convert from base64url to standard base64
-        const publicKeyBytes = (0, base64_js_1.base64urlDecodeToBytes)(jwk.x);
-        // Verify key length (Ed25519 public keys are 32 bytes)
-        if (publicKeyBytes.length !== 32) {
-            throw new Error(`Invalid Ed25519 public key length: ${publicKeyBytes.length}`);
-        }
-        return (0, base64_js_1.bytesToBase64)(publicKeyBytes);
-    }
-}
-exports.CryptoService = CryptoService;
-//# sourceMappingURL=crypto.service.js.map