@kya-os/mcp-i 1.10.0 → 1.11.1

package/dist/95.js

@@ -1 +1 @@
-"use strict";exports.id=95,exports.ids=[95],exports.modules={32410:(e,t,n)=>{n.d(t,{Y:()=>o});var r=n(13770);const o=async e=>{const t=await(0,r.p)(e);return((...e)=>{const t={};for(const n of e)for(const[e,r]of Object.entries(n))void 0!==t[e]?Object.assign(t[e],r):t[e]=r;return t})(t.configFile,t.credentialsFile)}},51095:(e,t,n)=>{n.d(t,{fromIni:()=>k});var r=n(32410),o=n(98229),i=n(43281),s=n(53347),a=n(53433);const c=e=>(0,s.g)(e,"CREDENTIALS_PROFILE_NAMED_PROVIDER","p"),l=e=>!e.role_arn&&!!e.credential_source;var g=n(81781),d=n(35789),f=n(77598),u=n(73024),p=n(48161),h=n(76760);class _{profileData;init;callerClientConfig;static REFRESH_THRESHOLD=3e5;constructor(e,t,n){this.profileData=e,this.init=t,this.callerClientConfig=n}async loadCredentials(){const e=await this.loadToken();if(!e)throw new i.C(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`,{tryNextLink:!1,logger:this.logger});const t=e.accessToken,n=Date.now();return new Date(t.expiresAt).getTime()-n<=_.REFRESH_THRESHOLD?this.refresh(e):{accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken,accountId:t.accountId,expiration:new Date(t.expiresAt)}}get logger(){return this.init?.logger}get loginSession(){return this.profileData.login_session}async refresh(e){const{SigninClient:t,CreateOAuth2TokenCommand:r}=await Promise.all([n.e(452),n.e(283)]).then(n.bind(n,93283)),{logger:o,userAgentAppId:s}=this.callerClientConfig??{},a=(e=>"h2"===e?.metadata?.handlerProtocol)(this.callerClientConfig?.requestHandler)?void 0:this.callerClientConfig?.requestHandler,c=new t({credentials:{accessKeyId:"",secretAccessKey:""},region:this.profileData.region??await(this.callerClientConfig?.region?.())??process.env.AWS_REGION,requestHandler:a,logger:o,userAgentAppId:s,...this.init?.clientConfig});this.createDPoPInterceptor(c.middlewareStack);const l={tokenInput:{clientId:e.clientId,refreshToken:e.refreshToken,grantType:"refresh_token"}};try{const t=await c.send(new r(l)),{accessKeyId:n,secretAccessKey:o,sessionToken:s}=t.tokenOutput?.accessToken??{},{refreshToken:a,expiresIn:g}=t.tokenOutput??{};if(!(n&&o&&s&&a))throw new i.C("Token refresh response missing required fields",{logger:this.logger,tryNextLink:!1});const d=1e3*(g??900),f=new Date(Date.now()+d),u={...e,accessToken:{...e.accessToken,accessKeyId:n,secretAccessKey:o,sessionToken:s,expiresAt:f.toISOString()},refreshToken:a};await this.saveToken(u);const p=u.accessToken;return{accessKeyId:p.accessKeyId,secretAccessKey:p.secretAccessKey,sessionToken:p.sessionToken,accountId:p.accountId,expiration:f}}catch(e){if("AccessDeniedException"===e.name){let t;switch(e.error){case"TOKEN_EXPIRED":t="Your session has expired. Please reauthenticate.";break;case"USER_CREDENTIALS_CHANGED":t="Unable to refresh credentials because of a change in your password. Please reauthenticate with your new password.";break;case"INSUFFICIENT_PERMISSIONS":t="Unable to refresh credentials due to insufficient permissions. You may be missing permission for the 'CreateOAuth2Token' action.";break;default:t=`Failed to refresh token: ${String(e)}. Please re-authenticate using \`aws login\``}throw new i.C(t,{logger:this.logger,tryNextLink:!1})}throw new i.C(`Failed to refresh token: ${String(e)}. Please re-authenticate using aws login`,{logger:this.logger})}}async loadToken(){const e=this.getTokenFilePath();try{let t;try{t=await(0,d.TA)(e,{ignoreCache:this.init?.ignoreCache})}catch{t=await u.promises.readFile(e,"utf8")}const n=JSON.parse(t),r=["accessToken","clientId","refreshToken","dpopKey"].filter(e=>!n[e]);if(n.accessToken?.accountId||r.push("accountId"),r.length>0)throw new i.C(`Token validation failed, missing fields: ${r.join(", ")}`,{logger:this.logger,tryNextLink:!1});return n}catch(t){throw new i.C(`Failed to load token from ${e}: ${String(t)}`,{logger:this.logger,tryNextLink:!1})}}async saveToken(e){const t=this.getTokenFilePath(),n=(0,h.dirname)(t);try{await u.promises.mkdir(n,{recursive:!0})}catch(e){}await u.promises.writeFile(t,JSON.stringify(e,null,2),"utf8")}getTokenFilePath(){const e=process.env.AWS_LOGIN_CACHE_DIRECTORY??(0,h.join)((0,p.homedir)(),".aws","login","cache"),t=Buffer.from(this.loginSession,"utf8"),n=(0,f.createHash)("sha256").update(t).digest("hex");return(0,h.join)(e,`${n}.json`)}derToRawSignature(e){let t=2;if(2!==e[t])throw new Error("Invalid DER signature");t++;const n=e[t++];let r=e.subarray(t,t+n);if(t+=n,2!==e[t])throw new Error("Invalid DER signature");t++;const o=e[t++];let i=e.subarray(t,t+o);r=0===r[0]?r.subarray(1):r,i=0===i[0]?i.subarray(1):i;const s=Buffer.concat([Buffer.alloc(32-r.length),r]),a=Buffer.concat([Buffer.alloc(32-i.length),i]);return Buffer.concat([s,a])}createDPoPInterceptor(e){e.add(e=>async t=>{if(g.K.isInstance(t.request)){const e=t.request,n=`${e.protocol}//${e.hostname}${e.port?`:${e.port}`:""}${e.path}`,r=await this.generateDpop(e.method,n);e.headers={...e.headers,DPoP:r}}return e(t)},{step:"finalizeRequest",name:"dpopInterceptor",override:!0})}async generateDpop(e="POST",t){const n=await this.loadToken();try{const r=(0,f.createPrivateKey)({key:n.dpopKey,format:"pem",type:"sec1"}),o=(0,f.createPublicKey)(r).export({format:"der",type:"spki"});let i=-1;for(let e=0;e<o.length;e++)if(4===o[e]){i=e;break}const s=o.slice(i+1,i+33),a=o.slice(i+33,i+65),c={alg:"ES256",typ:"dpop+jwt",jwk:{kty:"EC",crv:"P-256",x:s.toString("base64url"),y:a.toString("base64url")}},l={jti:crypto.randomUUID(),htm:e,htu:t,iat:Math.floor(Date.now()/1e3)},g=`${Buffer.from(JSON.stringify(c)).toString("base64url")}.${Buffer.from(JSON.stringify(l)).toString("base64url")}`,d=(0,f.sign)("sha256",Buffer.from(g),r);return`${g}.${this.derToRawSignature(d).toString("base64url")}`}catch(e){throw new i.C(`Failed to generate Dpop proof: ${e instanceof Error?e.message:String(e)}`,{logger:this.logger,tryNextLink:!1})}}}const y=e=>Boolean(e)&&"object"==typeof e&&"string"==typeof e.aws_access_key_id&&"string"==typeof e.aws_secret_access_key&&["undefined","string"].indexOf(typeof e.aws_session_token)>-1&&["undefined","string"].indexOf(typeof e.aws_account_id)>-1,w=async(e,t)=>{t?.logger?.debug("@aws-sdk/credential-provider-ini - resolveStaticCredentials");const n={accessKeyId:e.aws_access_key_id,secretAccessKey:e.aws_secret_access_key,sessionToken:e.aws_session_token,...e.aws_credential_scope&&{credentialScope:e.aws_credential_scope},...e.aws_account_id&&{accountId:e.aws_account_id}};return(0,s.g)(n,"CREDENTIALS_PROFILE","n")},C=async(e,t,g,d,f={},u=!1)=>{const p=t[e];if(Object.keys(f).length>0&&y(p))return w(p,g);if(u||((e,{profile:t="default",logger:n}={})=>Boolean(e)&&"object"==typeof e&&"string"==typeof e.role_arn&&["undefined","string"].indexOf(typeof e.role_session_name)>-1&&["undefined","string"].indexOf(typeof e.external_id)>-1&&["undefined","string"].indexOf(typeof e.mfa_serial)>-1&&(((e,{profile:t,logger:n})=>{const r="string"==typeof e.source_profile&&void 0===e.credential_source;return r&&n?.debug?.(`    ${t} isAssumeRoleWithSourceProfile source_profile=${e.source_profile}`),r})(e,{profile:t,logger:n})||((e,{profile:t,logger:n})=>{const r="string"==typeof e.credential_source&&void 0===e.source_profile;return r&&n?.debug?.(`    ${t} isCredentialSourceProfile credential_source=${e.credential_source}`),r})(e,{profile:t,logger:n})))(p,{profile:e,logger:g.logger}))return(async(e,t,r,g,d={},f)=>{r.logger?.debug("@aws-sdk/credential-provider-ini - resolveAssumeRoleCredentials (STS)");const u=t[e],{source_profile:p,region:h}=u;if(!r.roleAssumer){const{getDefaultRoleAssumer:e}=await n.e(225).then(n.bind(n,3606));r.roleAssumer=e({...r.clientConfig,credentialProviderLogger:r.logger,parentClientConfig:{...g,...r?.parentClientConfig,region:h??r?.parentClientConfig?.region??g?.region}},r.clientPlugins)}if(p&&p in d)throw new i.C(`Detected a cycle attempting to resolve credentials for profile ${(0,o.Bz)(r)}. Profiles visited: `+Object.keys(d).join(", "),{logger:r.logger});r.logger?.debug("@aws-sdk/credential-provider-ini - finding credential resolver using "+(p?`source_profile=[${p}]`:`profile=[${e}]`));const _=p?f(p,t,r,g,{...d,[p]:!0},l(t[p]??{})):(await((e,t,r)=>{const o={EcsContainer:async e=>{const{fromHttp:t}=await n.e(361).then(n.bind(n,2361)),{fromContainerMetadata:o}=await n.e(866).then(n.bind(n,8866));return r?.debug("@aws-sdk/credential-provider-ini - credential_source is EcsContainer"),async()=>(0,a.c)(t(e??{}),o(e))().then(c)},Ec2InstanceMetadata:async e=>{r?.debug("@aws-sdk/credential-provider-ini - credential_source is Ec2InstanceMetadata");const{fromInstanceMetadata:t}=await n.e(866).then(n.bind(n,8866));return async()=>t(e)().then(c)},Environment:async e=>{r?.debug("@aws-sdk/credential-provider-ini - credential_source is Environment");const{fromEnv:t}=await n.e(622).then(n.bind(n,55622));return async()=>t(e)().then(c)}};if(e in o)return o[e];throw new i.C(`Unsupported credential source in profile ${t}. Got ${e}, expected EcsContainer or Ec2InstanceMetadata or Environment.`,{logger:r})})(u.credential_source,e,r.logger)(r))();if(l(u))return _.then(e=>(0,s.g)(e,"CREDENTIALS_PROFILE_SOURCE_PROFILE","o"));{const t={RoleArn:u.role_arn,RoleSessionName:u.role_session_name||`aws-sdk-js-${Date.now()}`,ExternalId:u.external_id,DurationSeconds:parseInt(u.duration_seconds||"3600",10)},{mfa_serial:n}=u;if(n){if(!r.mfaCodeProvider)throw new i.C(`Profile ${e} requires multi-factor authentication, but no MFA code callback was provided.`,{logger:r.logger,tryNextLink:!1});t.SerialNumber=n,t.TokenCode=await r.mfaCodeProvider(n)}const o=await _;return r.roleAssumer(o,t).then(e=>(0,s.g)(e,"CREDENTIALS_PROFILE_SOURCE_PROFILE","o"))}})(e,t,g,d,f,C);if(y(p))return w(p,g);if(h=p,Boolean(h)&&"object"==typeof h&&"string"==typeof h.web_identity_token_file&&"string"==typeof h.role_arn&&["undefined","string"].indexOf(typeof h.role_session_name)>-1)return(async(e,t,r)=>n.e(354).then(n.bind(n,83354)).then(({fromTokenFile:n})=>n({webIdentityTokenFile:e.web_identity_token_file,roleArn:e.role_arn,roleSessionName:e.role_session_name,roleAssumerWithWebIdentity:t.roleAssumerWithWebIdentity,logger:t.logger,parentClientConfig:t.parentClientConfig})({callerClientConfig:r}).then(e=>(0,s.g)(e,"CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN","q"))))(p,g,d);var h;if((e=>Boolean(e)&&"object"==typeof e&&"string"==typeof e.credential_process)(p))return(async(e,t)=>n.e(861).then(n.bind(n,46242)).then(({fromProcess:n})=>n({...e,profile:t})().then(e=>(0,s.g)(e,"CREDENTIALS_PROFILE_PROCESS","v"))))(g,e);if((e=>e&&("string"==typeof e.sso_start_url||"string"==typeof e.sso_account_id||"string"==typeof e.sso_session||"string"==typeof e.sso_region||"string"==typeof e.sso_role_name))(p))return await(async(e,t,r={},o)=>{const{fromSSO:i}=await n.e(533).then(n.bind(n,32914));return i({profile:e,logger:r.logger,parentClientConfig:r.parentClientConfig,clientConfig:r.clientConfig})({callerClientConfig:o}).then(e=>t.sso_session?(0,s.g)(e,"CREDENTIALS_PROFILE_SSO","r"):(0,s.g)(e,"CREDENTIALS_PROFILE_SSO_LEGACY","t"))})(e,p,g,d);if((e=>Boolean(e&&e.login_session))(p))return(async(e,t,n)=>{const a=await(c={...t,profile:e},async({callerClientConfig:e}={})=>{c?.logger?.debug?.("@aws-sdk/credential-providers - fromLoginCredentials");const t=await(0,r.Y)(c||{}),n=(0,o.Bz)({profile:c?.profile??e?.profile}),a=t[n];if(!a?.login_session)throw new i.C(`Profile ${n} does not contain login_session.`,{tryNextLink:!0,logger:c?.logger});const l=new _(a,c,e),g=await l.loadCredentials();return(0,s.g)(g,"CREDENTIALS_LOGIN","AD")})({callerClientConfig:n});var c;return(0,s.g)(a,"CREDENTIALS_PROFILE_LOGIN","AC")})(e,g,d);throw new i.C(`Could not resolve credentials using profile: [${e}] in configuration/credentials file(s).`,{logger:g.logger})},k=(e={})=>async({callerClientConfig:t}={})=>{e.logger?.debug("@aws-sdk/credential-provider-ini - fromIni");const n=await(0,r.Y)(e);return C((0,o.Bz)({profile:e.profile??t?.profile}),n,e,t)}}};
+"use strict";exports.id=95,exports.ids=[95],exports.modules={32410:(e,t,n)=>{n.d(t,{Y:()=>o});var r=n(13770);const o=async e=>{const t=await(0,r.p)(e);return((...e)=>{const t={};for(const n of e)for(const[e,r]of Object.entries(n))void 0!==t[e]?Object.assign(t[e],r):t[e]=r;return t})(t.configFile,t.credentialsFile)}},51095:(e,t,n)=>{n.d(t,{fromIni:()=>k});var r=n(32410),o=n(98229),i=n(43281),s=n(53347),a=n(53433);const c=e=>(0,s.g)(e,"CREDENTIALS_PROFILE_NAMED_PROVIDER","p"),l=e=>!e.role_arn&&!!e.credential_source;var g=n(81781),d=n(35789),f=n(77598),u=n(73024),p=n(48161),h=n(76760);class _{profileData;init;callerClientConfig;static REFRESH_THRESHOLD=3e5;constructor(e,t,n){this.profileData=e,this.init=t,this.callerClientConfig=n}async loadCredentials(){const e=await this.loadToken();if(!e)throw new i.C(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`,{tryNextLink:!1,logger:this.logger});const t=e.accessToken,n=Date.now();return new Date(t.expiresAt).getTime()-n<=_.REFRESH_THRESHOLD?this.refresh(e):{accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken,accountId:t.accountId,expiration:new Date(t.expiresAt)}}get logger(){return this.init?.logger}get loginSession(){return this.profileData.login_session}async refresh(e){const{SigninClient:t,CreateOAuth2TokenCommand:r}=await Promise.all([n.e(452),n.e(283)]).then(n.bind(n,93283)),{logger:o,userAgentAppId:s}=this.callerClientConfig??{},a=(e=>"h2"===e?.metadata?.handlerProtocol)(this.callerClientConfig?.requestHandler)?void 0:this.callerClientConfig?.requestHandler,c=new t({credentials:{accessKeyId:"",secretAccessKey:""},region:this.profileData.region??await(this.callerClientConfig?.region?.())??process.env.AWS_REGION,requestHandler:a,logger:o,userAgentAppId:s,...this.init?.clientConfig});this.createDPoPInterceptor(c.middlewareStack);const l={tokenInput:{clientId:e.clientId,refreshToken:e.refreshToken,grantType:"refresh_token"}};try{const t=await c.send(new r(l)),{accessKeyId:n,secretAccessKey:o,sessionToken:s}=t.tokenOutput?.accessToken??{},{refreshToken:a,expiresIn:g}=t.tokenOutput??{};if(!(n&&o&&s&&a))throw new i.C("Token refresh response missing required fields",{logger:this.logger,tryNextLink:!1});const d=1e3*(g??900),f=new Date(Date.now()+d),u={...e,accessToken:{...e.accessToken,accessKeyId:n,secretAccessKey:o,sessionToken:s,expiresAt:f.toISOString()},refreshToken:a};await this.saveToken(u);const p=u.accessToken;return{accessKeyId:p.accessKeyId,secretAccessKey:p.secretAccessKey,sessionToken:p.sessionToken,accountId:p.accountId,expiration:f}}catch(e){if("AccessDeniedException"===e.name){let t;switch(e.error){case"TOKEN_EXPIRED":t="Your session has expired. Please reauthenticate.";break;case"USER_CREDENTIALS_CHANGED":t="Unable to refresh credentials because of a change in your password. Please reauthenticate with your new password.";break;case"INSUFFICIENT_PERMISSIONS":t="Unable to refresh credentials due to insufficient permissions. You may be missing permission for the 'CreateOAuth2Token' action.";break;default:t=`Failed to refresh token: ${String(e)}. Please re-authenticate using \`aws login\``}throw new i.C(t,{logger:this.logger,tryNextLink:!1})}throw new i.C(`Failed to refresh token: ${String(e)}. Please re-authenticate using aws login`,{logger:this.logger})}}async loadToken(){const e=this.getTokenFilePath();try{let t;try{t=await(0,d.TA)(e,{ignoreCache:this.init?.ignoreCache})}catch{t=await u.promises.readFile(e,"utf8")}const n=JSON.parse(t),r=["accessToken","clientId","refreshToken","dpopKey"].filter(e=>!n[e]);if(n.accessToken?.accountId||r.push("accountId"),r.length>0)throw new i.C(`Token validation failed, missing fields: ${r.join(", ")}`,{logger:this.logger,tryNextLink:!1});return n}catch(t){throw new i.C(`Failed to load token from ${e}: ${String(t)}`,{logger:this.logger,tryNextLink:!1})}}async saveToken(e){const t=this.getTokenFilePath(),n=(0,h.dirname)(t);try{await u.promises.mkdir(n,{recursive:!0})}catch(e){}await u.promises.writeFile(t,JSON.stringify(e,null,2),"utf8")}getTokenFilePath(){const e=process.env.AWS_LOGIN_CACHE_DIRECTORY??(0,h.join)((0,p.homedir)(),".aws","login","cache"),t=Buffer.from(this.loginSession,"utf8"),n=(0,f.createHash)("sha256").update(t).digest("hex");return(0,h.join)(e,`${n}.json`)}derToRawSignature(e){let t=2;if(2!==e[t])throw new Error("Invalid DER signature");t++;const n=e[t++];let r=e.subarray(t,t+n);if(t+=n,2!==e[t])throw new Error("Invalid DER signature");t++;const o=e[t++];let i=e.subarray(t,t+o);r=0===r[0]?r.subarray(1):r,i=0===i[0]?i.subarray(1):i;const s=Buffer.concat([Buffer.alloc(32-r.length),r]),a=Buffer.concat([Buffer.alloc(32-i.length),i]);return Buffer.concat([s,a])}createDPoPInterceptor(e){e.add(e=>async t=>{if(g.K.isInstance(t.request)){const e=t.request,n=`${e.protocol}//${e.hostname}${e.port?`:${e.port}`:""}${e.path}`,r=await this.generateDpop(e.method,n);e.headers={...e.headers,DPoP:r}}return e(t)},{step:"finalizeRequest",name:"dpopInterceptor",override:!0})}async generateDpop(e="POST",t){const n=await this.loadToken();try{const r=(0,f.createPrivateKey)({key:n.dpopKey,format:"pem",type:"sec1"}),o=(0,f.createPublicKey)(r).export({format:"der",type:"spki"});let i=-1;for(let e=0;e<o.length;e++)if(4===o[e]){i=e;break}const s=o.slice(i+1,i+33),a=o.slice(i+33,i+65),c={alg:"ES256",typ:"dpop+jwt",jwk:{kty:"EC",crv:"P-256",x:s.toString("base64url"),y:a.toString("base64url")}},l={jti:crypto.randomUUID(),htm:e,htu:t,iat:Math.floor(Date.now()/1e3)},g=`${Buffer.from(JSON.stringify(c)).toString("base64url")}.${Buffer.from(JSON.stringify(l)).toString("base64url")}`,d=(0,f.sign)("sha256",Buffer.from(g),r);return`${g}.${this.derToRawSignature(d).toString("base64url")}`}catch(e){throw new i.C(`Failed to generate Dpop proof: ${e instanceof Error?e.message:String(e)}`,{logger:this.logger,tryNextLink:!1})}}}const y=e=>Boolean(e)&&"object"==typeof e&&"string"==typeof e.aws_access_key_id&&"string"==typeof e.aws_secret_access_key&&["undefined","string"].indexOf(typeof e.aws_session_token)>-1&&["undefined","string"].indexOf(typeof e.aws_account_id)>-1,w=async(e,t)=>{t?.logger?.debug("@aws-sdk/credential-provider-ini - resolveStaticCredentials");const n={accessKeyId:e.aws_access_key_id,secretAccessKey:e.aws_secret_access_key,sessionToken:e.aws_session_token,...e.aws_credential_scope&&{credentialScope:e.aws_credential_scope},...e.aws_account_id&&{accountId:e.aws_account_id}};return(0,s.g)(n,"CREDENTIALS_PROFILE","n")},C=async(e,t,g,d,f={},u=!1)=>{const p=t[e];if(Object.keys(f).length>0&&y(p))return w(p,g);if(u||((e,{profile:t="default",logger:n}={})=>Boolean(e)&&"object"==typeof e&&"string"==typeof e.role_arn&&["undefined","string"].indexOf(typeof e.role_session_name)>-1&&["undefined","string"].indexOf(typeof e.external_id)>-1&&["undefined","string"].indexOf(typeof e.mfa_serial)>-1&&(((e,{profile:t,logger:n})=>{const r="string"==typeof e.source_profile&&void 0===e.credential_source;return r&&n?.debug?.(`    ${t} isAssumeRoleWithSourceProfile source_profile=${e.source_profile}`),r})(e,{profile:t,logger:n})||((e,{profile:t,logger:n})=>{const r="string"==typeof e.credential_source&&void 0===e.source_profile;return r&&n?.debug?.(`    ${t} isCredentialSourceProfile credential_source=${e.credential_source}`),r})(e,{profile:t,logger:n})))(p,{profile:e,logger:g.logger}))return(async(e,t,r,g,d={},f)=>{r.logger?.debug("@aws-sdk/credential-provider-ini - resolveAssumeRoleCredentials (STS)");const u=t[e],{source_profile:p,region:h}=u;if(!r.roleAssumer){const{getDefaultRoleAssumer:e}=await n.e(317).then(n.bind(n,79317));r.roleAssumer=e({...r.clientConfig,credentialProviderLogger:r.logger,parentClientConfig:{...g,...r?.parentClientConfig,region:h??r?.parentClientConfig?.region??g?.region}},r.clientPlugins)}if(p&&p in d)throw new i.C(`Detected a cycle attempting to resolve credentials for profile ${(0,o.Bz)(r)}. Profiles visited: `+Object.keys(d).join(", "),{logger:r.logger});r.logger?.debug("@aws-sdk/credential-provider-ini - finding credential resolver using "+(p?`source_profile=[${p}]`:`profile=[${e}]`));const _=p?f(p,t,r,g,{...d,[p]:!0},l(t[p]??{})):(await((e,t,r)=>{const o={EcsContainer:async e=>{const{fromHttp:t}=await n.e(361).then(n.bind(n,2361)),{fromContainerMetadata:o}=await n.e(866).then(n.bind(n,8866));return r?.debug("@aws-sdk/credential-provider-ini - credential_source is EcsContainer"),async()=>(0,a.c)(t(e??{}),o(e))().then(c)},Ec2InstanceMetadata:async e=>{r?.debug("@aws-sdk/credential-provider-ini - credential_source is Ec2InstanceMetadata");const{fromInstanceMetadata:t}=await n.e(866).then(n.bind(n,8866));return async()=>t(e)().then(c)},Environment:async e=>{r?.debug("@aws-sdk/credential-provider-ini - credential_source is Environment");const{fromEnv:t}=await n.e(622).then(n.bind(n,55622));return async()=>t(e)().then(c)}};if(e in o)return o[e];throw new i.C(`Unsupported credential source in profile ${t}. Got ${e}, expected EcsContainer or Ec2InstanceMetadata or Environment.`,{logger:r})})(u.credential_source,e,r.logger)(r))();if(l(u))return _.then(e=>(0,s.g)(e,"CREDENTIALS_PROFILE_SOURCE_PROFILE","o"));{const t={RoleArn:u.role_arn,RoleSessionName:u.role_session_name||`aws-sdk-js-${Date.now()}`,ExternalId:u.external_id,DurationSeconds:parseInt(u.duration_seconds||"3600",10)},{mfa_serial:n}=u;if(n){if(!r.mfaCodeProvider)throw new i.C(`Profile ${e} requires multi-factor authentication, but no MFA code callback was provided.`,{logger:r.logger,tryNextLink:!1});t.SerialNumber=n,t.TokenCode=await r.mfaCodeProvider(n)}const o=await _;return r.roleAssumer(o,t).then(e=>(0,s.g)(e,"CREDENTIALS_PROFILE_SOURCE_PROFILE","o"))}})(e,t,g,d,f,C);if(y(p))return w(p,g);if(h=p,Boolean(h)&&"object"==typeof h&&"string"==typeof h.web_identity_token_file&&"string"==typeof h.role_arn&&["undefined","string"].indexOf(typeof h.role_session_name)>-1)return(async(e,t,r)=>n.e(354).then(n.bind(n,83354)).then(({fromTokenFile:n})=>n({webIdentityTokenFile:e.web_identity_token_file,roleArn:e.role_arn,roleSessionName:e.role_session_name,roleAssumerWithWebIdentity:t.roleAssumerWithWebIdentity,logger:t.logger,parentClientConfig:t.parentClientConfig})({callerClientConfig:r}).then(e=>(0,s.g)(e,"CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN","q"))))(p,g,d);var h;if((e=>Boolean(e)&&"object"==typeof e&&"string"==typeof e.credential_process)(p))return(async(e,t)=>n.e(861).then(n.bind(n,46242)).then(({fromProcess:n})=>n({...e,profile:t})().then(e=>(0,s.g)(e,"CREDENTIALS_PROFILE_PROCESS","v"))))(g,e);if((e=>e&&("string"==typeof e.sso_start_url||"string"==typeof e.sso_account_id||"string"==typeof e.sso_session||"string"==typeof e.sso_region||"string"==typeof e.sso_role_name))(p))return await(async(e,t,r={},o)=>{const{fromSSO:i}=await n.e(533).then(n.bind(n,32914));return i({profile:e,logger:r.logger,parentClientConfig:r.parentClientConfig,clientConfig:r.clientConfig})({callerClientConfig:o}).then(e=>t.sso_session?(0,s.g)(e,"CREDENTIALS_PROFILE_SSO","r"):(0,s.g)(e,"CREDENTIALS_PROFILE_SSO_LEGACY","t"))})(e,p,g,d);if((e=>Boolean(e&&e.login_session))(p))return(async(e,t,n)=>{const a=await(c={...t,profile:e},async({callerClientConfig:e}={})=>{c?.logger?.debug?.("@aws-sdk/credential-providers - fromLoginCredentials");const t=await(0,r.Y)(c||{}),n=(0,o.Bz)({profile:c?.profile??e?.profile}),a=t[n];if(!a?.login_session)throw new i.C(`Profile ${n} does not contain login_session.`,{tryNextLink:!0,logger:c?.logger});const l=new _(a,c,e),g=await l.loadCredentials();return(0,s.g)(g,"CREDENTIALS_LOGIN","AD")})({callerClientConfig:n});var c;return(0,s.g)(a,"CREDENTIALS_PROFILE_LOGIN","AC")})(e,g,d);throw new i.C(`Could not resolve credentials using profile: [${e}] in configuration/credentials file(s).`,{logger:g.logger})},k=(e={})=>async({callerClientConfig:t}={})=>{e.logger?.debug("@aws-sdk/credential-provider-ini - fromIni");const n=await(0,r.Y)(e);return C((0,o.Bz)({profile:e.profile??t?.profile}),n,e,t)}}};

package/dist/auth/oauth/router.js

@@ -3,13 +3,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createOAuthRouter = createOAuthRouter;
 exports.createOAuthMiddleware = createOAuthMiddleware;
 const express_1 = require("express");
-const mcp_i_core_1 = require("@kya-os/mcp-i-core");
+const mcp_i_runtime_1 = require("@kya-os/mcp-i-runtime");
 function createOAuthRouter(config) {
     const router = (0, express_1.Router)();
     const { provider, issuerUrl, baseUrl, serviceDocumentationUrl, pathPrefix = "/oauth2", } = config;
     router.use((req, res, next) => {
         // Apply shared CORS headers for OAuth endpoints
-        (0, mcp_i_core_1.applyCORSHeaders)(res, mcp_i_core_1.OAUTH_CORS_HEADERS);
+        (0, mcp_i_runtime_1.applyCORSHeaders)(res, mcp_i_runtime_1.OAUTH_CORS_HEADERS);
         if (req.method === "OPTIONS") {
             res.sendStatus(200);
             return;

package/dist/cli-adapter/index.js

@@ -9,7 +9,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.enableMCPIdentityCLI = enableMCPIdentityCLI;
 const identity_1 = require("../runtime/identity");
-const did_helpers_1 = require("@kya-os/mcp-i-core/utils/did-helpers");
+const did_helpers_1 = require("@kya-os/mcp-i-runtime/utils/did-helpers");
 const kta_registration_1 = require("./kta-registration");
 /**
  * Enable MCP Identity for CLI

package/dist/providers/node-providers.d.ts

@@ -4,7 +4,7 @@
  * Wraps existing Node.js implementations to work with the provider-based core.
  * This maintains backward compatibility while enabling the new architecture.
  */
-import { CryptoProvider, ClockProvider, FetchProvider, StorageProvider, NonceCacheProvider, IdentityProvider, type AgentIdentity } from '@kya-os/mcp-i-core';
+import { CryptoProvider, ClockProvider, FetchProvider, StorageProvider, NonceCacheProvider, IdentityProvider, type AgentIdentity } from '@kya-os/mcp-i-runtime';
 /**
  * Node.js Crypto Provider using built-in crypto module
  */

package/dist/providers/node-providers.js

@@ -48,11 +48,11 @@ const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const axios_1 = __importDefault(require("axios"));
-const mcp_i_core_1 = require("@kya-os/mcp-i-core");
+const mcp_i_runtime_1 = require("@kya-os/mcp-i-runtime");
 /**
  * Node.js Crypto Provider using built-in crypto module
  */
-class NodeCryptoProvider extends mcp_i_core_1.CryptoProvider {
+class NodeCryptoProvider extends mcp_i_runtime_1.CryptoProvider {
     async sign(data, privateKeyBase64) {
         const privateKey = Buffer.from(privateKeyBase64, 'base64');
         // Handle both raw 32-byte and full 64-byte Ed25519 keys
@@ -114,7 +114,7 @@ exports.NodeCryptoProvider = NodeCryptoProvider;
 /**
  * Node.js Clock Provider
  */
-class NodeClockProvider extends mcp_i_core_1.ClockProvider {
+class NodeClockProvider extends mcp_i_runtime_1.ClockProvider {
     now() {
         return Date.now();
     }
@@ -137,7 +137,7 @@ exports.NodeClockProvider = NodeClockProvider;
 /**
  * Node.js Fetch Provider using axios
  */
-class NodeFetchProvider extends mcp_i_core_1.FetchProvider {
+class NodeFetchProvider extends mcp_i_runtime_1.FetchProvider {
     async resolveDID(did) {
         if (did.startsWith('did:key:')) {
             const publicKeyMultibase = did.slice('did:key:'.length);
@@ -208,7 +208,7 @@ exports.NodeFetchProvider = NodeFetchProvider;
 /**
  * File System Storage Provider
  */
-class FileStorageProvider extends mcp_i_core_1.StorageProvider {
+class FileStorageProvider extends mcp_i_runtime_1.StorageProvider {
     basePath;
     constructor(basePath) {
         super();
@@ -269,7 +269,7 @@ exports.FileStorageProvider = FileStorageProvider;
 /**
  * File System Identity Provider
  */
-class FileIdentityProvider extends mcp_i_core_1.IdentityProvider {
+class FileIdentityProvider extends mcp_i_runtime_1.IdentityProvider {
     basePath;
     cryptoProvider;
     identityFile;
@@ -357,12 +357,12 @@ function getNonceCacheProvider() {
         case 'redis':
             // TODO: Add Redis support
             console.warn('Redis cache not yet supported in this version, falling back to memory');
-            return new mcp_i_core_1.MemoryNonceCacheProvider();
+            return new mcp_i_runtime_1.MemoryNonceCacheProvider();
         case 'dynamodb':
             // TODO: Add DynamoDB support
             console.warn('DynamoDB cache not yet supported in this version, falling back to memory');
-            return new mcp_i_core_1.MemoryNonceCacheProvider();
+            return new mcp_i_runtime_1.MemoryNonceCacheProvider();
         default:
-            return new mcp_i_core_1.MemoryNonceCacheProvider();
+            return new mcp_i_runtime_1.MemoryNonceCacheProvider();
     }
 }