@kya-os/mcp-i-cloudflare 1.14.7 → 1.15.0

package/dist/runtime/tool-activity.d.ts

@@ -0,0 +1,56 @@
+import { type DelegationDenial, type DelegationRequiredError } from "@kya-os/mcp-i-runtime";
+/**
+ * The activity verdict for one tool dispatch, as sent on `tool.invoked`.
+ *
+ * A fail excerpt is always one of: a denial code with its default message, a
+ * refusal code, or `needs_authorization`. It is never built from handler
+ * output, the consent URL or upstream verifier text, because Checkpoint
+ * promises that tool args and results never appear on activity events.
+ */
+export type ToolActivity = {
+    verdict: "pass";
+} | FailedToolActivity;
+/** A fail verdict and its safe excerpt. */
+export interface FailedToolActivity {
+    verdict: "fail";
+    excerpt: string;
+}
+/** Excerpt for a protected call that arrived without a grant. */
+export declare const NEEDS_AUTHORIZATION_EXCERPT = "needs_authorization";
+/**
+ * True for the runtime's delegation-required signal. Matched by name, like
+ * the agent and the audit mapper, so a second bundled copy of the runtime
+ * package still matches.
+ */
+export declare function isDelegationRequiredError(error: unknown): error is DelegationRequiredError;
+/**
+ * Activity for a result the handler returned. A result carrying the refusal
+ * marker is a fail with exactly its code; anything else, including a bare
+ * `isError` result, is a pass.
+ *
+ * @example
+ * ```typescript
+ * activityForResult({ isError: true, _meta: markToolRefusal("SPEND_CAP_EXCEEDED") });
+ * // { verdict: "fail", excerpt: "SPEND_CAP_EXCEEDED" }
+ * activityForResult({ isError: true, content: [] }); // { verdict: "pass" }
+ * ```
+ */
+export declare function activityForResult(result: unknown): ToolActivity;
+/**
+ * Activity for a call the runtime refused before the handler ran. A verifier
+ * denial gives `${code}: ${DEFAULT_DENIAL_MESSAGES[code]}`; a missing grant
+ * (or a code outside the allowlist) gives `needs_authorization`.
+ *
+ * The message is looked up by code rather than read from the error, so the
+ * excerpt can only ever be one of the fixed default strings.
+ *
+ * @example
+ * ```typescript
+ * activityForDenial(revokedError);
+ * // { verdict: "fail", excerpt: "delegation_revoked: This authorization was revoked. Nothing was executed." }
+ * ```
+ */
+export declare function activityForDenial(error: {
+    denial?: DelegationDenial;
+}): FailedToolActivity;
+//# sourceMappingURL=tool-activity.d.ts.map

package/dist/runtime/tool-activity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-activity.d.ts","sourceRoot":"","sources":["../../src/runtime/tool-activity.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC7B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACnB,kBAAkB,CAAC;AAEvB,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iEAAiE;AACjE,eAAO,MAAM,2BAA2B,wBAAwB,CAAC;AAIjE;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,uBAAuB,CAElC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,YAAY,CAG/D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B,GAAG,kBAAkB,CAYrB"}

package/dist/runtime/tool-activity.js

@@ -0,0 +1,55 @@
+import { readToolRefusal } from "@kya-os/contracts/config";
+import { DEFAULT_DENIAL_MESSAGES, } from "@kya-os/mcp-i-runtime";
+/** Excerpt for a protected call that arrived without a grant. */
+export const NEEDS_AUTHORIZATION_EXCERPT = "needs_authorization";
+const PASS = Object.freeze({ verdict: "pass" });
+/**
+ * True for the runtime's delegation-required signal. Matched by name, like
+ * the agent and the audit mapper, so a second bundled copy of the runtime
+ * package still matches.
+ */
+export function isDelegationRequiredError(error) {
+    return error instanceof Error && error.name === "DelegationRequiredError";
+}
+/**
+ * Activity for a result the handler returned. A result carrying the refusal
+ * marker is a fail with exactly its code; anything else, including a bare
+ * `isError` result, is a pass.
+ *
+ * @example
+ * ```typescript
+ * activityForResult({ isError: true, _meta: markToolRefusal("SPEND_CAP_EXCEEDED") });
+ * // { verdict: "fail", excerpt: "SPEND_CAP_EXCEEDED" }
+ * activityForResult({ isError: true, content: [] }); // { verdict: "pass" }
+ * ```
+ */
+export function activityForResult(result) {
+    const refusal = readToolRefusal(result);
+    return refusal ? { verdict: "fail", excerpt: refusal.code } : PASS;
+}
+/**
+ * Activity for a call the runtime refused before the handler ran. A verifier
+ * denial gives `${code}: ${DEFAULT_DENIAL_MESSAGES[code]}`; a missing grant
+ * (or a code outside the allowlist) gives `needs_authorization`.
+ *
+ * The message is looked up by code rather than read from the error, so the
+ * excerpt can only ever be one of the fixed default strings.
+ *
+ * @example
+ * ```typescript
+ * activityForDenial(revokedError);
+ * // { verdict: "fail", excerpt: "delegation_revoked: This authorization was revoked. Nothing was executed." }
+ * ```
+ */
+export function activityForDenial(error) {
+    const code = error.denial?.code;
+    if (code === undefined ||
+        !Object.prototype.hasOwnProperty.call(DEFAULT_DENIAL_MESSAGES, code)) {
+        return { verdict: "fail", excerpt: NEEDS_AUTHORIZATION_EXCERPT };
+    }
+    return {
+        verdict: "fail",
+        excerpt: `${code}: ${DEFAULT_DENIAL_MESSAGES[code]}`,
+    };
+}
+//# sourceMappingURL=tool-activity.js.map

package/dist/runtime/tool-activity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-activity.js","sourceRoot":"","sources":["../../src/runtime/tool-activity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EACL,uBAAuB,GAGxB,MAAM,uBAAuB,CAAC;AAoB/B,iEAAiE;AACjE,MAAM,CAAC,MAAM,2BAA2B,GAAG,qBAAqB,CAAC;AAEjE,MAAM,IAAI,GAAiB,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAe,EAAE,CAAC,CAAC;AAEvE;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAc;IAEd,OAAO,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,yBAAyB,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAe;IAC/C,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAEjC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC;IAChC,IACE,IAAI,KAAK,SAAS;QAClB,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,uBAAuB,EAAE,IAAI,CAAC,EACpE,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IACnE,CAAC;IACD,OAAO;QACL,OAAO,EAAE,MAAM;QACf,OAAO,EAAE,GAAG,IAAI,KAAK,uBAAuB,CAAC,IAAI,CAAC,EAAE;KACrD,CAAC;AACJ,CAAC"}

package/dist/runtime.d.ts

@@ -6,7 +6,7 @@
  *
  * This runtime automatically uses CloudflareProofGenerator for all proof generation,
  * producing full JWS compact format (header.payload.signature) compatible with
- * AgentShield and the MCP-I proof specification.
+ * Checkpoint and the MCP-I proof specification.
  */
 import { MCPIRuntimeBase, type ProviderRuntimeConfig, ToolProtectionService, type ToolProtectionServiceConfig, AccessControlApiService, ProofVerifier } from "@kya-os/mcp-i-runtime";
 import { CloudflareProofGenerator } from "./proof-generator";
@@ -14,11 +14,12 @@ import type { DetachedProof } from "@kya-os/contracts/proof";
 import { type KVNamespace } from "./cache/kv-tool-protection-cache";
 import type { CloudflareRuntimeConfig } from "./config";
 import type { AgentIdentity } from "@kya-os/mcp-i-runtime";
+import type { VerifiedDelegation } from "@kya-os/contracts/config";
 /**
  * CloudflareRuntime extends MCPIRuntimeBase with CloudflareProofGenerator
  */
 /**
- * Tool call context for AgentShield dashboard
+ * Tool call context for Checkpoint dashboard
  */
 export interface ToolCallContext {
     tool: string;
@@ -48,6 +49,15 @@ export declare class CloudflareRuntime extends MCPIRuntimeBase {
      * Set AccessControlApiService (injected by createCloudflareRuntime)
      */
     setAccessControlService(service: AccessControlApiService): void;
+    /**
+     * The injected delegation verifier, or undefined without an API key.
+     *
+     * Agent subclasses reach it through MCPICloudflareAgent's protected
+     * getDelegationVerifier(); this getter stays out of the documented API.
+     *
+     * @internal
+     */
+    getAccessControlService(): AccessControlApiService | undefined;
     /**
      * Set ProofVerifier (injected by createCloudflareRuntime)
      */
@@ -68,21 +78,28 @@ export declare class CloudflareRuntime extends MCPIRuntimeBase {
      * - jws: Full compact JWS (header.payload.signature)
      * - meta: ProofMeta with all required fields
      *
-     * The proof is compatible with AgentShield and follows MCP-I specification.
+     * The proof is compatible with Checkpoint and follows MCP-I specification.
      */
     createProof(data: any, session?: any): Promise<DetachedProof>;
     /**
      * Override processToolCall to pass tool metadata through session,
-     * automatically submit proofs to AgentShield, and attach proofs to result for MCP Inspector.
+     * automatically submit proofs to Checkpoint, and attach proofs to result for MCP Inspector.
      *
      * This ensures that CloudflareProofGenerator has access to the tool name
      * and parameters for generating accurate proof hashes, proofs are automatically
-     * submitted to AgentShield for dashboard integration, and proofs are included
+     * submitted to Checkpoint for dashboard integration, and proofs are included
      * in the response for MCP Inspector.
      *
      * Note: Creates a new session object to avoid mutating the input session.
      */
-    processToolCall(toolName: string, args: any, handler: (args: any) => Promise<any>, session?: any): Promise<any>;
+    processToolCall(toolName: string, args: any, handler: (args: any, verified?: VerifiedDelegation) => Promise<any>, session?: any): Promise<any>;
+    /**
+     * Send the activity event for a protected call refused before its handler
+     * ran. The proof service decides whether to send anything (structured mode
+     * only). Awaited so a Durable Object does not cancel the POST, and guarded
+     * so a telemetry failure never replaces the refusal the caller rethrows.
+     */
+    private reportDeniedToolCall;
     /**
      * Get the CloudflareProofGenerator instance (for advanced usage)
      */
@@ -141,7 +158,7 @@ export declare class CloudflareRuntime extends MCPIRuntimeBase {
     /**
      * Get the last tool call context
      *
-     * Returns plaintext tool execution data for AgentShield dashboard integration.
+     * Returns plaintext tool execution data for Checkpoint dashboard integration.
      * This context can be submitted alongside proofs for enhanced UX.
      */
     getLastToolCallContext(): ToolCallContext | undefined;
@@ -149,14 +166,14 @@ export declare class CloudflareRuntime extends MCPIRuntimeBase {
      * Override buildConsentUrl to use server-hosted consent page
      *
      * Auto-detects server URL from request origin (via session.serverOrigin),
-     * falls back to MCP_SERVER_URL env var, then to AgentShield dashboard.
+     * falls back to MCP_SERVER_URL env var, then to Checkpoint dashboard.
      *
      * Priority:
      * 1. session.serverOrigin (auto-detected from request)
      * 2. this.serverUrl (from MCP_SERVER_URL env var)
-     * 3. AgentShield dashboard (backward compatibility)
+     * 3. Checkpoint dashboard (backward compatibility)
      *
-     * AgentShield consent endpoint requires:
+     * Checkpoint consent endpoint requires:
      * - snake_case parameter names (agent_did, session_id, project_id)
      * - project_id parameter (required)
      * - provider parameter (optional, for selecting specific auth method)
@@ -167,7 +184,7 @@ export declare class CloudflareRuntime extends MCPIRuntimeBase {
     /**
      * Create a ToolProtectionService with CloudFlare KV cache
      *
-     * The service fetches tool protection config from AgentShield by agent DID.
+     * The service fetches tool protection config from Checkpoint by agent DID.
      * Config is cached in KV for 5 minutes to minimize API calls.
      *
      * Usage in CloudFlare Worker:
@@ -175,8 +192,8 @@ export declare class CloudflareRuntime extends MCPIRuntimeBase {
      * const toolProtectionService = CloudflareRuntime.createToolProtectionService(
      *   env.TOOL_PROTECTION_KV, // KV namespace from wrangler.toml
      *   {
-     *     apiUrl: env.AGENTSHIELD_API_URL || 'https://kya.vouched.id',
-     *     apiKey: env.AGENTSHIELD_API_KEY,
+     *     apiUrl: env.CHECKPOINT_API_URL || 'https://kya.vouched.id',
+     *     apiKey: env.CHECKPOINT_API_KEY,
      *     cacheTtl: 300000, // 5 minutes (default)
      *     debug: env.MCPI_ENV === 'development',
      *     localConfig: {

package/dist/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,eAAe,EACf,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,KAAK,2BAA2B,EAChC,uBAAuB,EACvB,aAAa,EACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAEL,KAAK,WAAW,EACjB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D;;GAEG;AACH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,iBAAkB,SAAQ,eAAe;IACpD,OAAO,CAAC,cAAc,CAAC,CAA2B;IAClD,OAAO,CAAC,iBAAiB,CAAC,CAAgB;IAC1C,OAAO,CAAC,mBAAmB,CAAC,CAAkB;IAC9C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoC;IACtE,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,YAAY,CAAC,CAAe;IAIpC;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB,CAAiC;gBAG9D,MAAM,EAAE,qBAAqB,EAC7B,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,uBAAuB;IAY5C;;OAEG;IACH,uBAAuB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI;IAM/D;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAM/C;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAI3C;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAejC;;;;;;;;OAQG;IACG,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC;IAwGnE;;;;;;;;;;OAUG;IACG,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,GAAG,EACT,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,EACpC,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,GAAG,CAAC;IA2Gf;;OAEG;IACH,iBAAiB,IAAI,wBAAwB,GAAG,SAAS;IAIzD;;;;;;;;;;;;;;;;;OAiBG;IACH,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE;IAI7C;;;;;;;;;;;;OAYG;IACH,4BAA4B,IAAI,IAAI;IAIpC;;;;;OAKG;IACH,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS;IAKtD;;;OAGG;IACH,2BAA2B,IAAI,IAAI;IAInC;;;;OAIG;IACH,YAAY,IAAI,aAAa,GAAG,SAAS;IAIzC;;;;;OAKG;IACH,sBAAsB,IAAI,eAAe,GAAG,SAAS;IAIrD;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,CAAC,eAAe,CACvB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,CAAC,EAAE,GAAG,EACb,WAAW,CAAC,EAAE,MAAM,EACpB,UAAU,CAAC,EAAE,MAAM,EAAE,iDAAiD;IACtE,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM;IA6DT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,MAAM,CAAC,2BAA2B,CAChC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,2BAA2B,GAClC,qBAAqB;CAIzB"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,eAAe,EACf,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,KAAK,2BAA2B,EAChC,uBAAuB,EACvB,aAAa,EACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAEL,KAAK,WAAW,EACjB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAMnE;;GAEG;AACH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,iBAAkB,SAAQ,eAAe;IACpD,OAAO,CAAC,cAAc,CAAC,CAA2B;IAClD,OAAO,CAAC,iBAAiB,CAAC,CAAgB;IAC1C,OAAO,CAAC,mBAAmB,CAAC,CAAkB;IAC9C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoC;IACtE,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,YAAY,CAAC,CAAe;IAIpC;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB,CAAiC;gBAG9D,MAAM,EAAE,qBAAqB,EAC7B,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,uBAAuB;IAY5C;;OAEG;IACH,uBAAuB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI;IAM/D;;;;;;;OAOG;IACH,uBAAuB,IAAI,uBAAuB,GAAG,SAAS;IAI9D;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAM/C;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAI3C;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAejC;;;;;;;;OAQG;IACG,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC;IAwGnE;;;;;;;;;;OAUG;IACG,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,GAAG,EACT,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,kBAAkB,KAAK,OAAO,CAAC,GAAG,CAAC,EACnE,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,GAAG,CAAC;IA+Hf;;;;;OAKG;YACW,oBAAoB;IAyBlC;;OAEG;IACH,iBAAiB,IAAI,wBAAwB,GAAG,SAAS;IAIzD;;;;;;;;;;;;;;;;;OAiBG;IACH,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE;IAI7C;;;;;;;;;;;;OAYG;IACH,4BAA4B,IAAI,IAAI;IAIpC;;;;;OAKG;IACH,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS;IAKtD;;;OAGG;IACH,2BAA2B,IAAI,IAAI;IAInC;;;;OAIG;IACH,YAAY,IAAI,aAAa,GAAG,SAAS;IAIzC;;;;;OAKG;IACH,sBAAsB,IAAI,eAAe,GAAG,SAAS;IAIrD;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,CAAC,eAAe,CACvB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,CAAC,EAAE,GAAG,EACb,WAAW,CAAC,EAAE,MAAM,EACpB,UAAU,CAAC,EAAE,MAAM,EAAE,iDAAiD;IACtE,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM;IA6DT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,MAAM,CAAC,2BAA2B,CAChC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,2BAA2B,GAClC,qBAAqB;CAIzB"}

package/dist/runtime.js

@@ -6,12 +6,13 @@
  *
  * This runtime automatically uses CloudflareProofGenerator for all proof generation,
  * producing full JWS compact format (header.payload.signature) compatible with
- * AgentShield and the MCP-I proof specification.
+ * Checkpoint and the MCP-I proof specification.
  */
 import { MCPIRuntimeBase, ToolProtectionService, } from "@kya-os/mcp-i-runtime";
 import { CloudflareProofGenerator } from "./proof-generator";
 import { KVToolProtectionCache, } from "./cache/kv-tool-protection-cache";
 import { ProofService } from "./services/proof.service";
+import { activityForResult, isDelegationRequiredError, } from "./runtime/tool-activity";
 export class CloudflareRuntime extends MCPIRuntimeBase {
     proofGenerator;
     lastDetachedProof;
@@ -45,6 +46,17 @@ export class CloudflareRuntime extends MCPIRuntimeBase {
         // Protected members are accessible from subclasses in TypeScript
         this.accessControlService = service;
     }
+    /**
+     * The injected delegation verifier, or undefined without an API key.
+     *
+     * Agent subclasses reach it through MCPICloudflareAgent's protected
+     * getDelegationVerifier(); this getter stays out of the documented API.
+     *
+     * @internal
+     */
+    getAccessControlService() {
+        return this.accessControlService;
+    }
     /**
      * Set ProofVerifier (injected by createCloudflareRuntime)
      */
@@ -80,7 +92,7 @@ export class CloudflareRuntime extends MCPIRuntimeBase {
      * - jws: Full compact JWS (header.payload.signature)
      * - meta: ProofMeta with all required fields
      *
-     * The proof is compatible with AgentShield and follows MCP-I specification.
+     * The proof is compatible with Checkpoint and follows MCP-I specification.
      */
     async createProof(data, session) {
         if (!this.proofGenerator) {
@@ -140,7 +152,7 @@ export class CloudflareRuntime extends MCPIRuntimeBase {
         if (auditInvocationId) {
             this.proofByInvocation.set(auditInvocationId, detachedProof);
         }
-        // ✅ Store tool call context for AgentShield dashboard
+        // ✅ Store tool call context for Checkpoint dashboard
         this.lastToolCallContext = {
             tool: session.toolName || "unknown",
             args: session.toolParams || session.args || {},
@@ -164,11 +176,11 @@ export class CloudflareRuntime extends MCPIRuntimeBase {
     }
     /**
      * Override processToolCall to pass tool metadata through session,
-     * automatically submit proofs to AgentShield, and attach proofs to result for MCP Inspector.
+     * automatically submit proofs to Checkpoint, and attach proofs to result for MCP Inspector.
      *
      * This ensures that CloudflareProofGenerator has access to the tool name
      * and parameters for generating accurate proof hashes, proofs are automatically
-     * submitted to AgentShield for dashboard integration, and proofs are included
+     * submitted to Checkpoint for dashboard integration, and proofs are included
      * in the response for MCP Inspector.
      *
      * Note: Creates a new session object to avoid mutating the input session.
@@ -187,20 +199,35 @@ export class CloudflareRuntime extends MCPIRuntimeBase {
                 auditInvocationId: invocationId,
             }
             : undefined;
+        // Set only when THIS call's verify passed. Local to the call, so concurrent
+        // calls on the same runtime never attribute a proof to another call's grant.
+        let verifiedDelegationId;
+        const handlerRecordingVerified = (handlerArgs, verified) => {
+            verifiedDelegationId = verified?.id;
+            // Keep the exact arity: an unverified call still receives only (args).
+            return verified ? handler(handlerArgs, verified) : handler(handlerArgs);
+        };
         try {
             // Call parent implementation with enhanced session (generates proof)
-            const result = await super.processToolCall(toolName, args, handler, enhancedSession);
+            let result;
+            try {
+                result = await super.processToolCall(toolName, args, handlerRecordingVerified, enhancedSession);
+            }
+            catch (error) {
+                await this.reportDeniedToolCall(error, toolName, enhancedSession);
+                throw error;
+            }
             // Resolve only the proof created for this invocation. `lastDetachedProof`
             // is retained solely as a legacy observational accessor.
             const proof = this.proofByInvocation.get(invocationId);
-            // Automatically submit proof to AgentShield if available
+            // Automatically submit proof to Checkpoint if available
             // CRITICAL FIX: Await the proof submission directly instead of using ctx.waitUntil()
             // In Durable Objects (McpAgent), ctx.waitUntil() doesn't reliably extend lifetime,
             // causing proof submissions to be cancelled before completion.
             if (proof && this.proofService && enhancedSession) {
                 try {
                     // Determine MCP server URL from session or stored serverUrl
-                    // Ensure URL has protocol (https://) for AgentShield tool discovery
+                    // Ensure URL has protocol (https://) for Checkpoint tool discovery
                     let mcpServerUrl = enhancedSession.serverOrigin || this.serverUrl;
                     if (mcpServerUrl &&
                         !mcpServerUrl.startsWith("http://") &&
@@ -220,6 +247,8 @@ export class CloudflareRuntime extends MCPIRuntimeBase {
                         args,
                         result,
                         mcpServerUrl,
+                        activity: activityForResult(result),
+                        verifiedDelegationId,
                     });
                     console.error("[CloudflareRuntime] ✅ Proof submission completed");
                 }
@@ -265,6 +294,30 @@ export class CloudflareRuntime extends MCPIRuntimeBase {
             this.proofByInvocation.delete(invocationId);
         }
     }
+    /**
+     * Send the activity event for a protected call refused before its handler
+     * ran. The proof service decides whether to send anything (structured mode
+     * only). Awaited so a Durable Object does not cancel the POST, and guarded
+     * so a telemetry failure never replaces the refusal the caller rethrows.
+     */
+    async reportDeniedToolCall(error, toolName, session) {
+        if (!this.proofService || !isDelegationRequiredError(error)) {
+            return;
+        }
+        try {
+            const identity = await this.getIdentity();
+            await this.proofService.reportDenied({
+                serverDid: identity.did,
+                sessionId: session?.id,
+                toolName,
+                error,
+                delegationId: session?.delegationId,
+            });
+        }
+        catch (reportError) {
+            console.error("[CloudflareRuntime] Failed to report denied tool call:", reportError);
+        }
+    }
     /**
      * Get the CloudflareProofGenerator instance (for advanced usage)
      */
@@ -336,7 +389,7 @@ export class CloudflareRuntime extends MCPIRuntimeBase {
     /**
      * Get the last tool call context
      *
-     * Returns plaintext tool execution data for AgentShield dashboard integration.
+     * Returns plaintext tool execution data for Checkpoint dashboard integration.
      * This context can be submitted alongside proofs for enhanced UX.
      */
     getLastToolCallContext() {
@@ -346,14 +399,14 @@ export class CloudflareRuntime extends MCPIRuntimeBase {
      * Override buildConsentUrl to use server-hosted consent page
      *
      * Auto-detects server URL from request origin (via session.serverOrigin),
-     * falls back to MCP_SERVER_URL env var, then to AgentShield dashboard.
+     * falls back to MCP_SERVER_URL env var, then to Checkpoint dashboard.
      *
      * Priority:
      * 1. session.serverOrigin (auto-detected from request)
      * 2. this.serverUrl (from MCP_SERVER_URL env var)
-     * 3. AgentShield dashboard (backward compatibility)
+     * 3. Checkpoint dashboard (backward compatibility)
      *
-     * AgentShield consent endpoint requires:
+     * Checkpoint consent endpoint requires:
      * - snake_case parameter names (agent_did, session_id, project_id)
      * - project_id parameter (required)
      * - provider parameter (optional, for selecting specific auth method)
@@ -371,7 +424,7 @@ export class CloudflareRuntime extends MCPIRuntimeBase {
             session_id: session?.id || "",
             agent_did: session?.agentDid || "",
         });
-        // Add agent_name for AgentShield dashboard display
+        // Add agent_name for Checkpoint dashboard display
         // Priority: session.agentName > "Unknown Agent"
         const agentName = session?.agentName;
         if (agentName) {
@@ -393,7 +446,7 @@ export class CloudflareRuntime extends MCPIRuntimeBase {
         // Determine server URL with priority:
         // 1. Auto-detected from request origin (session.serverOrigin)
         // 2. From env var (this.serverUrl)
-        // 3. Fallback to AgentShield dashboard
+        // 3. Fallback to Checkpoint dashboard
         let serverUrl;
         if (session?.serverOrigin) {
             // Use auto-detected origin from request
@@ -409,13 +462,13 @@ export class CloudflareRuntime extends MCPIRuntimeBase {
             const baseUrl = serverUrl.replace(/\/$/, "");
             return `${baseUrl}/consent?${params.toString()}`;
         }
-        // Fallback to AgentShield dashboard (for backward compatibility or when server URL not available)
+        // Fallback to Checkpoint dashboard (for backward compatibility or when server URL not available)
         return `https://kya.vouched.id/bouncer/consent?${params.toString()}`;
     }
     /**
      * Create a ToolProtectionService with CloudFlare KV cache
      *
-     * The service fetches tool protection config from AgentShield by agent DID.
+     * The service fetches tool protection config from Checkpoint by agent DID.
      * Config is cached in KV for 5 minutes to minimize API calls.
      *
      * Usage in CloudFlare Worker:
@@ -423,8 +476,8 @@ export class CloudflareRuntime extends MCPIRuntimeBase {
      * const toolProtectionService = CloudflareRuntime.createToolProtectionService(
      *   env.TOOL_PROTECTION_KV, // KV namespace from wrangler.toml
      *   {
-     *     apiUrl: env.AGENTSHIELD_API_URL || 'https://kya.vouched.id',
-     *     apiKey: env.AGENTSHIELD_API_KEY,
+     *     apiUrl: env.CHECKPOINT_API_URL || 'https://kya.vouched.id',
+     *     apiKey: env.CHECKPOINT_API_KEY,
      *     cacheTtl: 300000, // 5 minutes (default)
      *     debug: env.MCPI_ENV === 'development',
      *     localConfig: {

package/dist/runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,eAAe,EAEf,qBAAqB,GAItB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,EACL,qBAAqB,GAEtB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAkBxD,MAAM,OAAO,iBAAkB,SAAQ,eAAe;IAC5C,cAAc,CAA4B;IAC1C,iBAAiB,CAAiB;IAClC,mBAAmB,CAAmB;IAC7B,iBAAiB,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC9D,SAAS,CAAU,CAAC,4CAA4C;IAChE,YAAY,CAAgB,CAAC,2BAA2B;IAChE,2FAA2F;IAC3F,oFAAoF;IAEpF;;;;;;;OAOG;IACK,uBAAuB,GAAuB,IAAI,GAAG,EAAE,CAAC;IAEhE,YACE,MAA6B,EAC7B,SAAkB,EAClB,gBAA0C;QAE1C,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,yDAAyD;QACzD,wFAAwF;QACxF,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAClC,gBAAgB,IAAK,MAAkC,EACvD,IAAI,CACL,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,OAAgC;QACtD,8DAA8D;QAC9D,iEAAiE;QACjE,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,QAAuB;QACtC,8DAA8D;QAC9D,iEAAiE;QACjE,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW;QACf,OAAO,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;QAEzB,oDAAoD;QACpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,cAAc,GAAG,IAAI,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QAE7D,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;YAC9C,OAAO,CAAC,KAAK,CACX,qEAAqE,CACtE,CAAC;YACF,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAAC,IAAS,EAAE,OAAa;QACxC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QAED,wDAAwD;QACxD,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC1C,8CAA8C;YAC9C,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;QACxB,CAAC;QAED,sCAAsC;QACtC,iEAAiE;QACjE,MAAM,OAAO,GAAG;YACd,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS;YACrC,MAAM,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE;SACjD,CAAC;QAEF,qBAAqB;QACrB,MAAM,QAAQ,GAAG;YACf,IAAI;SACL,CAAC;QAEF,oDAAoD;QACpD,MAAM,cAAc,GAAG;YACrB,KAAK;YACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,YAAY;YAC1C,SAAS,EAAE,OAAO,CAAC,EAAE;SACtB,CAAC;QAEF,0DAA0D;QAC1D,IAAI,OAA2B,CAAC;QAEhC,oDAAoD;QACpD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;YACrB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC5B,CAAC;QACD,4CAA4C;aACvC,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YAC3B,OAAO,GAAG,GAAG,OAAO,CAAC,QAAQ,UAAU,CAAC;QAC1C,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,aAAa,IAAI,OAAO,EAAE,CAAC;YACzD,OAAO,CAAC,KAAK,CACX,mCAAmC,OAAO,CAAC,QAAQ,MAAM,OAAO,EAAE,CACnE,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAC3D,OAAO,EACP,QAAQ,EACR,cAAc,EACd;YACE,OAAO,EAAE,gDAAgD;YACzD,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,uCAAuC;SACtE,CACF,CAAC;QAEF,yEAAyE;QACzE,2EAA2E;QAC3E,4CAA4C;QAC5C,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC;QACvC,MAAM,iBAAiB,GAAG,OAAO,OAAO,CAAC,iBAAiB,KAAK,QAAQ;YACrE,CAAC,CAAC,OAAO,CAAC,iBAAiB;YAC3B,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,iBAAiB,EAAE,CAAC;YACtB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAC/D,CAAC;QAED,sDAAsD;QACtD,IAAI,CAAC,mBAAmB,GAAG;YACzB,IAAI,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS;YACnC,IAAI,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE;YAC9C,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,OAAO,IAAI,SAAS;YAC7B,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,2BAA2B;SACpD,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;YAC9C,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE;gBACxC,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG;gBAC3B,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS;gBACvC,WAAW,EAAE,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACpE,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACtE,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,uBAAuB;gBAC5D,SAAS,EACP,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;oBACvC,CAAC,CAAC,iBAAiB;oBACnB,CAAC,CAAC,SAAS;aAChB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,eAAe,CACnB,QAAgB,EAChB,IAAS,EACT,OAAoC,EACpC,OAAa;QAEb,MAAM,YAAY,GAAG,OAAO,OAAO,EAAE,iBAAiB,KAAK,QAAQ;YACjE,CAAC,CAAC,OAAO,CAAC,iBAAiB;YAC3B,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACxB,0DAA0D;QAC1D,kFAAkF;QAClF,MAAM,eAAe,GAAG,OAAO;YAC7B,CAAC,CAAC;gBACE,GAAG,OAAO;gBACV,QAAQ;gBACR,UAAU,EAAE,IAAI;gBAChB,iBAAiB,EAAE,YAAY;aAChC;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,CAAC;YACH,qEAAqE;YACrE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,eAAe,CACxC,QAAQ,EACR,IAAI,EACJ,OAAO,EACP,eAAe,CAChB,CAAC;YAEF,0EAA0E;YAC1E,yDAAyD;YACzD,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAEzD,yDAAyD;YACzD,qFAAqF;YACrF,mFAAmF;YACnF,+DAA+D;YAC/D,IAAI,KAAK,IAAI,IAAI,CAAC,YAAY,IAAI,eAAe,EAAE,CAAC;gBAClD,IAAI,CAAC;oBACH,4DAA4D;oBAC5D,oEAAoE;oBACpE,IAAI,YAAY,GAAG,eAAe,CAAC,YAAY,IAAI,IAAI,CAAC,SAAS,CAAC;oBAClE,IACE,YAAY;wBACZ,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC;wBACnC,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,EACpC,CAAC;wBACD,wCAAwC;wBACxC,YAAY,GAAG,WAAW,YAAY,EAAE,CAAC;oBAC3C,CAAC;oBAED,0DAA0D;oBAC1D,+DAA+D;oBAC/D,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;oBACvE,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;wBACzC,OAAO,EAAE;4BACP,EAAE,EAAE,eAAe,CAAC,EAAE,IAAI,SAAS;4BACnC,YAAY,EAAE,eAAe,CAAC,YAAY;yBAC3C;wBACD,QAAQ;wBACR,IAAI;wBACJ,MAAM;wBACN,YAAY;qBACb,CAAC,CAAC;oBACH,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACpE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,8CAA8C;oBAC9C,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;gBACtE,CAAC;wBAAS,CAAC;oBACT,0EAA0E;oBAC1E,4EAA4E;oBAC5E,wEAAwE;oBACxE,yEAAyE;oBACzE,sEAAsE;oBACtE,2EAA2E;oBAC3E,yEAAyE;oBACzE,2EAA2E;oBAC3E,qCAAqC;oBACrC,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;oBAClC,CAAC;oBAAC,OAAO,UAAU,EAAE,CAAC;wBACpB,OAAO,CAAC,KAAK,CACX,sDAAsD,EACtD,UAAU,CACX,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,oEAAoE;YACpE,IACE,KAAK;gBACL,MAAM;gBACN,OAAO,MAAM,KAAK,QAAQ;gBAC1B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACtB,CAAC;gBACD,8DAA8D;gBAC9D,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;gBACpB,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG;oBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,IAAI,EAAE,KAAK,CAAC,IAAI;iBACjB,CAAC;YACJ,CAAC;YAED,OAAO,MAAM,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,0BAA0B;QACxB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,4BAA4B;QAC1B,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,yBAAyB;QACvB,MAAM,WAAW,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACtD,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC;IAED;;;OAGG;IACH,2BAA2B;QACzB,IAAI,CAAC,4BAA4B,EAAE,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,sBAAsB;QACpB,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACO,eAAe,CACvB,QAAgB,EAChB,MAAgB,EAChB,OAAa,EACb,WAAoB,EACpB,UAAmB,EAAE,iDAAiD;IACtE,QAAiB;QAEjB,2DAA2D;QAC3D,MAAM,qBAAqB,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAChE,MAAM,SAAS,GAAG,qBAAqB,EAAE,YAAY,EAAE,EAAE,CAAC;QAE1D,+DAA+D;QAC/D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACxB,UAAU,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE;YAC7B,SAAS,EAAE,OAAO,EAAE,QAAQ,IAAI,EAAE;SACnC,CAAC,CAAC;QAEH,mDAAmD;QACnD,gDAAgD;QAChD,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,CAAC;QACrC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;QAED,6DAA6D;QAC7D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;QAED,+BAA+B;QAC/B,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC1C,CAAC;QAED,mGAAmG;QACnG,wEAAwE;QACxE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACnC,CAAC;QAED,sCAAsC;QACtC,8DAA8D;QAC9D,mCAAmC;QACnC,uCAAuC;QACvC,IAAI,SAA6B,CAAC;QAElC,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;YAC1B,wCAAwC;YACxC,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC;QACnC,CAAC;aAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1B,yBAAyB;YACzB,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC;QAED,4DAA4D;QAC5D,IAAI,SAAS,EAAE,CAAC;YACd,gDAAgD;YAChD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC7C,OAAO,GAAG,OAAO,YAAY,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QACnD,CAAC;QAED,kGAAkG;QAClG,OAAO,0CAA0C,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,MAAM,CAAC,2BAA2B,CAChC,EAAe,EACf,MAAmC;QAEnC,MAAM,KAAK,GAAG,IAAI,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAC5C,OAAO,IAAI,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;CACF"}
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,eAAe,EAEf,qBAAqB,GAItB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,EACL,qBAAqB,GAEtB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAIxD,OAAO,EACL,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AAgBjC,MAAM,OAAO,iBAAkB,SAAQ,eAAe;IAC5C,cAAc,CAA4B;IAC1C,iBAAiB,CAAiB;IAClC,mBAAmB,CAAmB;IAC7B,iBAAiB,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC9D,SAAS,CAAU,CAAC,4CAA4C;IAChE,YAAY,CAAgB,CAAC,2BAA2B;IAChE,2FAA2F;IAC3F,oFAAoF;IAEpF;;;;;;;OAOG;IACK,uBAAuB,GAAuB,IAAI,GAAG,EAAE,CAAC;IAEhE,YACE,MAA6B,EAC7B,SAAkB,EAClB,gBAA0C;QAE1C,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,yDAAyD;QACzD,wFAAwF;QACxF,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAClC,gBAAgB,IAAK,MAAkC,EACvD,IAAI,CACL,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,OAAgC;QACtD,8DAA8D;QAC9D,iEAAiE;QACjE,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC;IACtC,CAAC;IAED;;;;;;;OAOG;IACH,uBAAuB;QACrB,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,QAAuB;QACtC,8DAA8D;QAC9D,iEAAiE;QACjE,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW;QACf,OAAO,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;QAEzB,oDAAoD;QACpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,cAAc,GAAG,IAAI,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QAE7D,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;YAC9C,OAAO,CAAC,KAAK,CACX,qEAAqE,CACtE,CAAC;YACF,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAAC,IAAS,EAAE,OAAa;QACxC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QAED,wDAAwD;QACxD,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC1C,8CAA8C;YAC9C,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;QACxB,CAAC;QAED,sCAAsC;QACtC,iEAAiE;QACjE,MAAM,OAAO,GAAG;YACd,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS;YACrC,MAAM,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE;SACjD,CAAC;QAEF,qBAAqB;QACrB,MAAM,QAAQ,GAAG;YACf,IAAI;SACL,CAAC;QAEF,oDAAoD;QACpD,MAAM,cAAc,GAAG;YACrB,KAAK;YACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,YAAY;YAC1C,SAAS,EAAE,OAAO,CAAC,EAAE;SACtB,CAAC;QAEF,0DAA0D;QAC1D,IAAI,OAA2B,CAAC;QAEhC,oDAAoD;QACpD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;YACrB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC5B,CAAC;QACD,4CAA4C;aACvC,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YAC3B,OAAO,GAAG,GAAG,OAAO,CAAC,QAAQ,UAAU,CAAC;QAC1C,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,aAAa,IAAI,OAAO,EAAE,CAAC;YACzD,OAAO,CAAC,KAAK,CACX,mCAAmC,OAAO,CAAC,QAAQ,MAAM,OAAO,EAAE,CACnE,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAC3D,OAAO,EACP,QAAQ,EACR,cAAc,EACd;YACE,OAAO,EAAE,gDAAgD;YACzD,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,uCAAuC;SACtE,CACF,CAAC;QAEF,yEAAyE;QACzE,2EAA2E;QAC3E,4CAA4C;QAC5C,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC;QACvC,MAAM,iBAAiB,GAAG,OAAO,OAAO,CAAC,iBAAiB,KAAK,QAAQ;YACrE,CAAC,CAAC,OAAO,CAAC,iBAAiB;YAC3B,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,iBAAiB,EAAE,CAAC;YACtB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAC/D,CAAC;QAED,qDAAqD;QACrD,IAAI,CAAC,mBAAmB,GAAG;YACzB,IAAI,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS;YACnC,IAAI,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE;YAC9C,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,OAAO,IAAI,SAAS;YAC7B,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,2BAA2B;SACpD,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;YAC9C,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE;gBACxC,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG;gBAC3B,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS;gBACvC,WAAW,EAAE,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACpE,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACtE,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,uBAAuB;gBAC5D,SAAS,EACP,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;oBACvC,CAAC,CAAC,iBAAiB;oBACnB,CAAC,CAAC,SAAS;aAChB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,eAAe,CACnB,QAAgB,EAChB,IAAS,EACT,OAAmE,EACnE,OAAa;QAEb,MAAM,YAAY,GAAG,OAAO,OAAO,EAAE,iBAAiB,KAAK,QAAQ;YACjE,CAAC,CAAC,OAAO,CAAC,iBAAiB;YAC3B,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACxB,0DAA0D;QAC1D,kFAAkF;QAClF,MAAM,eAAe,GAAG,OAAO;YAC7B,CAAC,CAAC;gBACE,GAAG,OAAO;gBACV,QAAQ;gBACR,UAAU,EAAE,IAAI;gBAChB,iBAAiB,EAAE,YAAY;aAChC;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,4EAA4E;QAC5E,6EAA6E;QAC7E,IAAI,oBAAwC,CAAC;QAC7C,MAAM,wBAAwB,GAAG,CAC/B,WAAgB,EAChB,QAA6B,EACf,EAAE;YAChB,oBAAoB,GAAG,QAAQ,EAAE,EAAE,CAAC;YACpC,uEAAuE;YACvE,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1E,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,qEAAqE;YACrE,IAAI,MAAW,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,KAAK,CAAC,eAAe,CAClC,QAAQ,EACR,IAAI,EACJ,wBAAwB,EACxB,eAAe,CAChB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;gBAClE,MAAM,KAAK,CAAC;YACd,CAAC;YAED,0EAA0E;YAC1E,yDAAyD;YACzD,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAEzD,wDAAwD;YACxD,qFAAqF;YACrF,mFAAmF;YACnF,+DAA+D;YAC/D,IAAI,KAAK,IAAI,IAAI,CAAC,YAAY,IAAI,eAAe,EAAE,CAAC;gBAClD,IAAI,CAAC;oBACH,4DAA4D;oBAC5D,mEAAmE;oBACnE,IAAI,YAAY,GAAG,eAAe,CAAC,YAAY,IAAI,IAAI,CAAC,SAAS,CAAC;oBAClE,IACE,YAAY;wBACZ,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC;wBACnC,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,EACpC,CAAC;wBACD,wCAAwC;wBACxC,YAAY,GAAG,WAAW,YAAY,EAAE,CAAC;oBAC3C,CAAC;oBAED,0DAA0D;oBAC1D,+DAA+D;oBAC/D,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;oBACvE,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;wBACzC,OAAO,EAAE;4BACP,EAAE,EAAE,eAAe,CAAC,EAAE,IAAI,SAAS;4BACnC,YAAY,EAAE,eAAe,CAAC,YAAY;yBAC3C;wBACD,QAAQ;wBACR,IAAI;wBACJ,MAAM;wBACN,YAAY;wBACZ,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC;wBACnC,oBAAoB;qBACrB,CAAC,CAAC;oBACH,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACpE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,8CAA8C;oBAC9C,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;gBACtE,CAAC;wBAAS,CAAC;oBACT,0EAA0E;oBAC1E,4EAA4E;oBAC5E,wEAAwE;oBACxE,yEAAyE;oBACzE,sEAAsE;oBACtE,2EAA2E;oBAC3E,yEAAyE;oBACzE,2EAA2E;oBAC3E,qCAAqC;oBACrC,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;oBAClC,CAAC;oBAAC,OAAO,UAAU,EAAE,CAAC;wBACpB,OAAO,CAAC,KAAK,CACX,sDAAsD,EACtD,UAAU,CACX,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,oEAAoE;YACpE,IACE,KAAK;gBACL,MAAM;gBACN,OAAO,MAAM,KAAK,QAAQ;gBAC1B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACtB,CAAC;gBACD,8DAA8D;gBAC9D,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;gBACpB,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG;oBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,IAAI,EAAE,KAAK,CAAC,IAAI;iBACjB,CAAC;YACJ,CAAC;YAED,OAAO,MAAM,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,oBAAoB,CAChC,KAAc,EACd,QAAgB,EAChB,OAAgD;QAEhD,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;gBACnC,SAAS,EAAE,QAAQ,CAAC,GAAG;gBACvB,SAAS,EAAE,OAAO,EAAE,EAAE;gBACtB,QAAQ;gBACR,KAAK;gBACL,YAAY,EAAE,OAAO,EAAE,YAAY;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CACX,wDAAwD,EACxD,WAAW,CACZ,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,0BAA0B;QACxB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,4BAA4B;QAC1B,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,yBAAyB;QACvB,MAAM,WAAW,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACtD,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC;IAED;;;OAGG;IACH,2BAA2B;QACzB,IAAI,CAAC,4BAA4B,EAAE,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,sBAAsB;QACpB,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACO,eAAe,CACvB,QAAgB,EAChB,MAAgB,EAChB,OAAa,EACb,WAAoB,EACpB,UAAmB,EAAE,iDAAiD;IACtE,QAAiB;QAEjB,2DAA2D;QAC3D,MAAM,qBAAqB,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAChE,MAAM,SAAS,GAAG,qBAAqB,EAAE,YAAY,EAAE,EAAE,CAAC;QAE1D,+DAA+D;QAC/D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACxB,UAAU,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE;YAC7B,SAAS,EAAE,OAAO,EAAE,QAAQ,IAAI,EAAE;SACnC,CAAC,CAAC;QAEH,kDAAkD;QAClD,gDAAgD;QAChD,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,CAAC;QACrC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;QAED,6DAA6D;QAC7D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;QAED,+BAA+B;QAC/B,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC1C,CAAC;QAED,mGAAmG;QACnG,wEAAwE;QACxE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACnC,CAAC;QAED,sCAAsC;QACtC,8DAA8D;QAC9D,mCAAmC;QACnC,sCAAsC;QACtC,IAAI,SAA6B,CAAC;QAElC,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;YAC1B,wCAAwC;YACxC,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC;QACnC,CAAC;aAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1B,yBAAyB;YACzB,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC;QAED,4DAA4D;QAC5D,IAAI,SAAS,EAAE,CAAC;YACd,gDAAgD;YAChD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC7C,OAAO,GAAG,OAAO,YAAY,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QACnD,CAAC;QAED,iGAAiG;QACjG,OAAO,0CAA0C,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,MAAM,CAAC,2BAA2B,CAChC,EAAe,EACf,MAAmC;QAEnC,MAAM,KAAK,GAAG,IAAI,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAC5C,OAAO,IAAI,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;CACF"}

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA8B5D,MAAM,WAAW,2BAA2B;IAC1C,GAAG,EAAE,aAAa,CAAC;IACnB,MAAM,EAAE,uBAAuB,CAAC;IAChC,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,iBAAiB,CAAoB;IAC7C,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,YAAY,CAAC,CAAe;IACpC,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,OAAO,CAAC,CAAoB;IACpC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,GAAG,CAAgB;IAC3B,OAAO,CAAC,aAAa,CAAgB;IAErC,OAAO,CAAC,gBAAgB,CAAC,CAAmD;IAC5E,OAAO,CAAC,gBAAgB,CAAC,CAAwD;IAEjF,OAAO,CAAC,2BAA2B,CAAC,CAAgB;gBAExC,OAAO,EAAE,2BAA2B;IA6DhD;;;OAGG;YACW,0BAA0B;IAsExC;;;;;;OAMG;YACW,2BAA2B;IAgBzC;;;OAGG;IACG,aAAa,CACjB,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,gBAAgB,GACrB,OAAO,CAAC,QAAQ,CAAC;IAmFpB;;OAEG;YACW,mBAAmB;IA8CjC;;OAEG;IACG,eAAe,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB3D;;OAEG;IACH,oBAAoB,IAAI,iBAAiB;IAIzC;;OAEG;IACH,eAAe,IAAI,YAAY;IAI/B;;OAEG;IACH,eAAe,IAAI,YAAY,GAAG,SAAS;IAI3C;;OAEG;IACH,iBAAiB,IAAI,cAAc;IAInC;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAWxB;;;;;OAKG;YACW,WAAW;CAmB1B"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA+B5D,MAAM,WAAW,2BAA2B;IAC1C,GAAG,EAAE,aAAa,CAAC;IACnB,MAAM,EAAE,uBAAuB,CAAC;IAChC,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,iBAAiB,CAAoB;IAC7C,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,YAAY,CAAC,CAAe;IACpC,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,OAAO,CAAC,CAAoB;IACpC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,GAAG,CAAgB;IAC3B,OAAO,CAAC,aAAa,CAAgB;IAErC,OAAO,CAAC,gBAAgB,CAAC,CAAmD;IAC5E,OAAO,CAAC,gBAAgB,CAAC,CAAwD;IAEjF,OAAO,CAAC,2BAA2B,CAAC,CAAgB;gBAExC,OAAO,EAAE,2BAA2B;IA8DhD;;;OAGG;YACW,0BAA0B;IAsExC;;;;;;OAMG;YACW,2BAA2B;IAgBzC;;;OAGG;IACG,aAAa,CACjB,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,gBAAgB,GACrB,OAAO,CAAC,QAAQ,CAAC;IAmFpB;;OAEG;YACW,mBAAmB;IA+CjC;;OAEG;IACG,eAAe,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB3D;;OAEG;IACH,oBAAoB,IAAI,iBAAiB;IAIzC;;OAEG;IACH,eAAe,IAAI,YAAY;IAI/B;;OAEG;IACH,eAAe,IAAI,YAAY,GAAG,SAAS;IAI3C;;OAEG;IACH,iBAAiB,IAAI,cAAc;IAInC;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAWxB;;;;;OAKG;YACW,WAAW;CAmB1B"}

package/dist/server.js

@@ -15,6 +15,7 @@ import { WebCryptoProvider } from "./providers/crypto";
 // at module load time, preventing esbuild from tree-shaking the OAuth services
 import { getOAuthServices, isOAuthServicesAvailable, } from "./utils/oauth-service-registry";
 import { WorkersClockProvider, WorkersFetchProvider, KVNonceCacheProvider, } from "./providers/storage";
+import { withCheckpointNames } from "@kya-os/contracts/config";
 // CRITICAL: Force OAuth registry evaluation at module load time
 // This creates an observable side effect that esbuild cannot tree-shake
 // Without this, esbuild may eliminate oauth-service-registry.ts entirely
@@ -38,7 +39,7 @@ export class MCPICloudflareServer {
     // Store the initialization promise so consent routes can wait for it
     providerServicesInitPromise;
     constructor(options) {
-        this.env = options.env;
+        this.env = withCheckpointNames(options.env);
         this.config = options.config;
         this.runtime = options.runtime;
         // Initialize all services
@@ -47,30 +48,30 @@ export class MCPICloudflareServer {
         // Phase 2: Initialize provider services if OAuth is configured
         // Note: These are initialized lazily in an async method to avoid await in constructor
         this.consentService = new ConsentService(this.env, this.runtime, undefined, // providerResolver - initialized lazily
-        undefined // providerRegistry - initialized lazily
-        );
+        undefined, // providerRegistry - initialized lazily
+        { delegationMandate: this.config.delegationMandate });
         // Initialize provider services asynchronously (if needed)
         // Store the promise so consent routes can wait for initialization
-        if (this.env.AGENTSHIELD_API_KEY && this.runtime) {
+        if (this.env.CHECKPOINT_API_KEY && this.runtime) {
             this.providerServicesInitPromise = this.initializeProviderServices();
         }
         // Admin service is optional based on config
-        // Auto-enable if AGENTSHIELD_API_KEY is present and admin config is not explicitly disabled
+        // Auto-enable if CHECKPOINT_API_KEY is present and admin config is not explicitly disabled
         const shouldEnableAdmin = this.config.admin?.enabled !== false && // Not explicitly disabled
             (this.config.admin?.enabled === true || // Explicitly enabled OR
-                !!this.env.AGENTSHIELD_API_KEY); // Auto-enable when API key present
+                !!this.env.CHECKPOINT_API_KEY); // Auto-enable when API key present
         if (shouldEnableAdmin) {
             console.error("[MCPICloudflareServer] Initializing admin service", {
                 adminEnabled: this.config.admin?.enabled,
-                hasApiKey: !!this.env.AGENTSHIELD_API_KEY,
-                autoEnabled: !this.config.admin && !!this.env.AGENTSHIELD_API_KEY,
+                hasApiKey: !!this.env.CHECKPOINT_API_KEY,
+                autoEnabled: !this.config.admin && !!this.env.CHECKPOINT_API_KEY,
             });
             this.adminService = new AdminService(this.env);
         }
         else {
             console.error("[MCPICloudflareServer] Admin service disabled", {
                 adminEnabled: this.config.admin?.enabled,
-                hasApiKey: !!this.env.AGENTSHIELD_API_KEY,
+                hasApiKey: !!this.env.CHECKPOINT_API_KEY,
             });
         }
         // Initialize ProofVerifier with dependency injection
@@ -92,7 +93,7 @@ export class MCPICloudflareServer {
      * This is called lazily to avoid await in constructor
      */
     async initializeProviderServices() {
-        if (!this.env.AGENTSHIELD_API_KEY || !this.runtime) {
+        if (!this.env.CHECKPOINT_API_KEY || !this.runtime) {
             return;
         }
         try {
@@ -109,8 +110,8 @@ export class MCPICloudflareServer {
                 ? new KVOAuthConfigCache({ kv: this.env.TOOL_PROTECTION_KV })
                 : undefined;
             const oauthConfigService = new ConfigService({
-                baseUrl: this.env.AGENTSHIELD_API_URL || "https://kya.vouched.id",
-                apiKey: this.env.AGENTSHIELD_API_KEY,
+                baseUrl: this.env.CHECKPOINT_API_URL || "https://kya.vouched.id",
+                apiKey: this.env.CHECKPOINT_API_KEY,
                 fetchProvider,
                 cache: oauthConfigCache,
             });
@@ -179,12 +180,12 @@ export class MCPICloudflareServer {
                 method: request.method,
                 hasAdminService: !!this.adminService,
                 adminEnabled: this.config.admin?.enabled,
-                hasApiKey: !!this.env.AGENTSHIELD_API_KEY,
+                hasApiKey: !!this.env.CHECKPOINT_API_KEY,
             });
             if (!this.adminService) {
                 console.warn("[MCPICloudflareServer] Admin service not initialized", {
                     adminEnabled: this.config.admin?.enabled,
-                    hasApiKey: !!this.env.AGENTSHIELD_API_KEY,
+                    hasApiKey: !!this.env.CHECKPOINT_API_KEY,
                     configAdmin: this.config.admin,
                 });
                 return new Response(JSON.stringify({
@@ -241,7 +242,7 @@ export class MCPICloudflareServer {
         // FIX: Pass consentService so OAuth callback can call getUserDidForSession()
         // Without this, effectiveUserDid is undefined and IDP tokens are not stored
         const handler = createOAuthCallbackHandler({
-            agentShieldApiUrl: this.env.AGENTSHIELD_API_URL,
+            checkpointApiUrl: this.env.CHECKPOINT_API_URL,
             delegationStorage: this.env.DELEGATION_STORAGE,
             oauthSecurityService,
             consentService: this.consentService, // FIX: Enable session userDid lookup
@@ -252,6 +253,7 @@ export class MCPICloudflareServer {
         const mockContext = {
             env: this.env,
             req: {
+                url: request.url,
                 query: (key) => url.searchParams.get(key) || undefined,
                 header: (name) => request.headers.get(name) || undefined,
             },