@kya-os/mcp-i 1.7.9 → 1.7.11

package/dist/runtime/tool-protection.d.ts

@@ -9,6 +9,7 @@
  * 2. Local file (tool-protections.json) - for development
  * 3. AgentShield API - for production (NOT IMPLEMENTED YET)
  */
+import type { AuthorizationRequirement } from '@kya-os/contracts/tool-protection';
 /**
  * Protection configuration for a single tool
  */
@@ -21,16 +22,8 @@ export interface ToolProtectionConfig {
     riskLevel?: 'low' | 'medium' | 'high' | 'critical';
     /** Optional custom authorization URL for this specific tool */
     authorizationUrl?: string;
-    /** Authorization method required for this tool */
-    authorization?: {
-        type: 'oauth' | 'oauth2' | 'password' | 'credential' | 'webauthn' | 'siwe' | 'none';
-        provider?: string;
-        credentialType?: string;
-        rpId?: string;
-        userVerification?: 'required' | 'preferred' | 'discouraged';
-        chainId?: number;
-        domain?: string;
-    };
+    /** Authorization method required for this tool (uses contracts type) */
+    authorization?: AuthorizationRequirement;
 }
 /**
  * Map of tool names to their protection configurations

package/dist/runtime/utils/tools.js

@@ -10,6 +10,24 @@ const session_1 = require("../session");
 const request_context_1 = require("../request-context");
 const proof_batch_queue_1 = require("../proof-batch-queue");
 const mcp_i_core_1 = require("@kya-os/mcp-i-core");
+/**
+ * Format authorization info for error messages.
+ * Safely handles discriminated union types by checking for property existence.
+ * Supports: provider (oauth/password), issuer (mdl/vc), credentialType (vc/mdl)
+ */
+function formatAuthInfo(auth) {
+    let result = auth.type;
+    if ('provider' in auth && auth.provider) {
+        result += `:${auth.provider}`;
+    }
+    if ('issuer' in auth && auth.issuer) {
+        result += `:${auth.issuer}`;
+    }
+    if ('credentialType' in auth && auth.credentialType) {
+        result += `:${auth.credentialType}`;
+    }
+    return result;
+}
 const rawRuntimeConfigPath = typeof RUNTIME_CONFIG_PATH !== "undefined" ? RUNTIME_CONFIG_PATH : undefined;
 // Single-parse to match single-stringify from webpack DefinePlugin
 const runtimeConfigPath = rawRuntimeConfigPath
@@ -553,9 +571,7 @@ async function addToolsToServer(server, toolModules, identityConfig, clientMessa
                                     type: "text",
                                     text: JSON.stringify({
                                         error: "authorization_data_missing",
-                                        message: `Tool "${name}" requires authorization method ${toolAuth.type}` +
-                                            `${toolAuth.provider ? `:${toolAuth.provider}` : ""}` +
-                                            `${toolAuth.credentialType ? `:${toolAuth.credentialType}` : ""} ` +
+                                        message: `Tool "${name}" requires authorization ${formatAuthInfo(toolAuth)} ` +
                                             `but delegation credential does not contain authorization data. Please re-authorize.`,
                                         authorizationUrl: authUrl.toString(),
                                         scopes: toolProtection.requiredScopes || [],
@@ -583,12 +599,8 @@ async function addToolsToServer(server, toolModules, identityConfig, clientMessa
                                     text: JSON.stringify({
                                         error: "authorization_method_mismatch",
                                         message: `Tool "${name}" requires re-authorization. ` +
-                                            `Delegation was created with ${delegationAuth.type}` +
-                                            `${delegationAuth.provider ? `:${delegationAuth.provider}` : ""}` +
-                                            `${delegationAuth.credentialType ? `:${delegationAuth.credentialType}` : ""} ` +
-                                            `but tool now requires ${toolAuth.type}` +
-                                            `${toolAuth.provider ? `:${toolAuth.provider}` : ""}` +
-                                            `${toolAuth.credentialType ? `:${toolAuth.credentialType}` : ""}.`,
+                                            `Delegation was created with ${formatAuthInfo(delegationAuth)} ` +
+                                            `but tool now requires ${formatAuthInfo(toolAuth)}.`,
                                         authorizationUrl: authUrl.toString(),
                                         scopes: toolProtection.requiredScopes || [],
                                         currentAuth: delegationAuth,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/mcp-i",
-  "version": "1.7.9",
+  "version": "1.7.11",
   "description": "The TypeScript MCP framework with identity features built-in",
   "type": "commonjs",
   "main": "dist/index.js",