@kya-os/mcp-i-cloudflare 1.14.8 → 1.15.1

package/dist/services/consent.service.js

@@ -8,13 +8,13 @@
  */
 import { ConsentConfigService } from "./consent-config.service";
 import { TemplateRenderer } from "./consent-templates/template-renderer";
-import { DEFAULT_AGENTSHIELD_URL, DEFAULT_SESSION_CACHE_TTL, KEY_PAIR_TTL_SECONDS, CONSENT_PROVIDER_TYPES, } from "../constants";
+import { DEFAULT_CHECKPOINT_URL, DEFAULT_SESSION_CACHE_TTL, KEY_PAIR_TTL_SECONDS, CONSENT_PROVIDER_TYPES, } from "../constants";
 import { STORAGE_KEYS, isPendingDelegationId } from "../constants/storage-keys";
 import { loadDay0Config, getDelegationFieldName } from "../utils/day0-config";
 import { buildProviderAuthorizeUrl } from "../runtime/oidc/authorize-url.js";
 import { resolveIdpScopes } from "../runtime/oidc/idp-scopes.js";
 import { validateConsentApprovalRequest, } from "@kya-os/contracts/consent";
-import { AGENTSHIELD_ENDPOINTS, createDelegationAPIResponseSchema, createDelegationResponseSchema, } from "@kya-os/contracts/agentshield-api";
+import { CHECKPOINT_ENDPOINTS, createDelegationAPIResponseSchema, createDelegationResponseSchema, } from "@kya-os/contracts/checkpoint-api";
 import { createUnsignedVCJWT, completeVCJWT, parseVCJWT, generateDidKeyFromBase64, createDelegationVerifier, createDidKeyResolver, logger, base64urlEncodeFromBytes, base64urlDecodeToBytes, bytesToBase64, wrapDelegationAsVC, } from "@kya-os/mcp";
 import { fetchRemoteConfig, normalizeAuthType, } from "@kya-os/mcp-i-runtime"; // product-layer symbols stay on OLD (C2 #2918)
 import { WebCryptoProvider } from "../providers/crypto";
@@ -580,7 +580,7 @@ export class ConsentService {
      *
      * NOTE: The generated key pair has its own did:key which may differ
      * from Checkpoint's persistentUserDid. Both are tied to the same
-     * OAuth identity. See docs/proposals/VC/AGENTSHIELD_SIGNING_ENDPOINT.md
+     * OAuth identity. See docs/proposals/VC/CHECKPOINT_SIGNING_ENDPOINT.md
      * for the future cleaner architecture.
      *
      * @param sessionId - Session ID for caching
@@ -1002,14 +1002,14 @@ export class ConsentService {
         }
         // Check project config to see if OAuth is configured
         try {
-            const agentShieldUrl = this.env.CHECKPOINT_API_URL || DEFAULT_AGENTSHIELD_URL;
+            const checkpointUrl = this.env.CHECKPOINT_API_URL || DEFAULT_CHECKPOINT_URL;
             const apiKey = this.env.CHECKPOINT_API_KEY;
             if (!apiKey) {
                 // No API key - can't check, assume OAuth not required
                 return false;
             }
             // Fetch project config to check for OAuth provider
-            const configUrl = `${agentShieldUrl}/api/v1/bouncer/projects/${projectId}/config`;
+            const configUrl = `${checkpointUrl}/api/v1/bouncer/projects/${projectId}/config`;
             const response = await fetch(configUrl, {
                 headers: {
                     Authorization: `Bearer ${apiKey}`,
@@ -1057,7 +1057,7 @@ export class ConsentService {
     oauthSecurityService, agentName, // Human-readable agent name for Checkpoint dashboard
     tool // Tool name to preserve through OAuth callback for clickwrap redirect
     ) {
-        const agentShieldUrl = this.env.CHECKPOINT_API_URL || DEFAULT_AGENTSHIELD_URL;
+        const checkpointUrl = this.env.CHECKPOINT_API_URL || DEFAULT_CHECKPOINT_URL;
         // Generate a temporary delegation ID for state (will be created after OAuth)
         const delegationId = `temp-${Date.now()}`;
         // ✅ Phase 1: Generate PKCE challenge if OAuthSecurityService is available
@@ -1138,7 +1138,7 @@ export class ConsentService {
                     provider,
                 });
                 try {
-                    await this.providerRegistry.loadFromAgentShield(projectId);
+                    await this.providerRegistry.loadFromCheckpoint(projectId);
                     logger.debug("[ConsentService] Providers loaded successfully", {
                         projectId,
                         providers: this.providerRegistry.getProviderNames(),
@@ -1240,7 +1240,7 @@ export class ConsentService {
         // NOTE: This is a legacy proxy mode path that requires Checkpoint to act as an OAuth proxy.
         // Most providers (GitHub, Google) use direct PKCE mode instead (see buildDirectOAuthUrl).
         // If this path is hit and results in a 404, check if the provider supports PKCE.
-        const oauthUrl = new URL(`${agentShieldUrl}/bouncer/oauth/authorize`);
+        const oauthUrl = new URL(`${checkpointUrl}/bouncer/oauth/authorize`);
         oauthUrl.searchParams.set("response_type", "code");
         oauthUrl.searchParams.set("client_id", projectId); // Use projectId as client_id
         oauthUrl.searchParams.set("redirect_uri", `${serverUrl}/oauth/callback`);
@@ -1416,7 +1416,7 @@ export class ConsentService {
                 provider: oauthIdentity.provider,
                 subject: oauthIdentity.subject.substring(0, 20) + "...",
                 userDid: userDid.substring(0, 30) + "...",
-                source: "agentshield_identity_resolution",
+                source: "checkpoint_identity_resolution",
             });
         }
         catch (error) {
@@ -1986,7 +1986,7 @@ export class ConsentService {
             // Build consent page config
             // ✅ CRITICAL: Pass the FULL consent config (ui, credentials, etc.) not just branding/terms
             // Type assertion to handle updated schema before rebuild
-            // The remote consent config (from agent-shield) carries fields that
+            // The remote consent config (from checkpoint) carries fields that
             // aren't in the trimmed contracts ConsentPageConfig type. Read them off
             // a Record<string, unknown> view so we can plumb them through without
             // touching contracts.
@@ -3801,7 +3801,7 @@ export class ConsentService {
             return { success: false, ...MANDATE_ERROR };
         }
         const mandate = mandateResolution.mandate;
-        const agentShieldUrl = this.env.CHECKPOINT_API_URL || DEFAULT_AGENTSHIELD_URL;
+        const checkpointUrl = this.env.CHECKPOINT_API_URL || DEFAULT_CHECKPOINT_URL;
         const apiKey = this.env.CHECKPOINT_API_KEY;
         if (!apiKey) {
             logger.warn("[ConsentService] No API key configured, cannot create delegation");
@@ -3924,7 +3924,7 @@ export class ConsentService {
                 ? withMandateConstraints(builtRequest, mandate.constraints)
                 : builtRequest;
             logger.debug("[ConsentService] Creating delegation:", {
-                url: `${agentShieldUrl}${AGENTSHIELD_ENDPOINTS.DELEGATIONS_CREATE}`,
+                url: `${checkpointUrl}${CHECKPOINT_ENDPOINTS.DELEGATIONS_CREATE}`,
                 agentDid: request.agent_did.substring(0, 20) + "...",
                 scopes: request.scopes,
                 expiresInDays,
@@ -3933,18 +3933,18 @@ export class ConsentService {
                 hasUserDid: !!userDid,
             });
             // Error-based format detection: try request format, fallback on error
-            const response = await this.tryAPICall(agentShieldUrl, apiKey, delegationRequest);
+            const response = await this.tryAPICall(checkpointUrl, apiKey, delegationRequest);
             if (!response.success) {
                 return response;
             }
             const responseData = response.data;
-            // Canonical format per @kya-os/contracts/agentshield-api:
+            // Canonical format per @kya-os/contracts/checkpoint-api:
             // Wrapped: { success: true, data: { delegation_id: string, agent_did: string, ... } }
             // Unwrapped: { delegation_id: string, agent_did: string, ... }
             //
             // IMPORTANT: delegation_token is NOT returned by POST /api/v1/bouncer/delegations.
             // delegation_token is only available via OAuth callback flow and is passed as a URL parameter.
-            // See: docs/agentshield/API_RESPONSE_FORMATS.md for canonical format documentation.
+            // See: docs/checkpoint/API_RESPONSE_FORMATS.md for canonical format documentation.
             // Try wrapped format first (canonical)
             const wrappedParse = createDelegationAPIResponseSchema.safeParse(responseData);
             if (wrappedParse.success) {
@@ -4762,7 +4762,7 @@ export class ConsentService {
      * @see OAuthConfigService.getOAuthConfig() for the same endpoint usage
      */
     async getCredentialProviderConfig(projectId, providerName) {
-        const agentShieldUrl = this.env.CHECKPOINT_API_URL || DEFAULT_AGENTSHIELD_URL;
+        const checkpointUrl = this.env.CHECKPOINT_API_URL || DEFAULT_CHECKPOINT_URL;
         const apiKey = this.env.CHECKPOINT_API_KEY;
         if (!apiKey) {
             logger.warn("[ConsentService] No Checkpoint API key configured");
@@ -4772,7 +4772,7 @@ export class ConsentService {
             // Use the /providers endpoint - same as OAuthConfigService.getOAuthConfig()
             // This endpoint was updated in fix/provider-config to read from oauthProviders JSONB
             // Authentication: Use Authorization: Bearer header for consistency with OAuthConfigService
-            const response = await fetch(`${agentShieldUrl}/api/v1/bouncer/projects/${encodeURIComponent(projectId)}/providers`, {
+            const response = await fetch(`${checkpointUrl}/api/v1/bouncer/projects/${encodeURIComponent(projectId)}/providers`, {
                 headers: {
                     Authorization: `Bearer ${apiKey}`,
                     "Content-Type": "application/json",
@@ -4922,14 +4922,14 @@ export class ConsentService {
      * Resolve identity via Checkpoint for credential-based auth
      */
     async resolveCredentialIdentity(params) {
-        const agentShieldUrl = this.env.CHECKPOINT_API_URL || DEFAULT_AGENTSHIELD_URL;
+        const checkpointUrl = this.env.CHECKPOINT_API_URL || DEFAULT_CHECKPOINT_URL;
         const apiKey = this.env.CHECKPOINT_API_KEY;
         if (!apiKey) {
             logger.warn("[ConsentService] No Checkpoint API key for identity resolution");
             return { success: false };
         }
         try {
-            const response = await fetch(`${agentShieldUrl}/api/v1/bouncer/identity/resolve`, {
+            const response = await fetch(`${checkpointUrl}/api/v1/bouncer/identity/resolve`, {
                 method: "POST",
                 headers: {
                     "X-API-Key": apiKey,
@@ -5624,11 +5624,11 @@ export class ConsentService {
     /**
      * Try API call with error-based format detection
      */
-    async tryAPICall(agentShieldUrl, apiKey, request) {
+    async tryAPICall(checkpointUrl, apiKey, request) {
         // Handle format detection
         if (request._tryFormats && request.fullFormat && request.simplifiedFormat) {
             // Try full format first
-            const fullResponse = await this.makeAPICall(agentShieldUrl, apiKey, request.fullFormat);
+            const fullResponse = await this.makeAPICall(checkpointUrl, apiKey, request.fullFormat);
             if (fullResponse.success) {
                 await this.cacheFormatPreference("full");
                 return fullResponse;
@@ -5641,14 +5641,14 @@ export class ConsentService {
             }
             // Full format failed with validation error, try simplified
             logger.debug("[ConsentService] Full format failed, trying simplified format...");
-            const simplifiedResponse = await this.makeAPICall(agentShieldUrl, apiKey, request.simplifiedFormat);
+            const simplifiedResponse = await this.makeAPICall(checkpointUrl, apiKey, request.simplifiedFormat);
             if (simplifiedResponse.success) {
                 await this.cacheFormatPreference("simplified");
             }
             return simplifiedResponse;
         }
         // Direct call (format already determined)
-        return this.makeAPICall(agentShieldUrl, apiKey, request);
+        return this.makeAPICall(checkpointUrl, apiKey, request);
     }
     /**
      * Make API call and parse response
@@ -5656,7 +5656,7 @@ export class ConsentService {
      * CRITICAL: This method ensures session_id and project_id are never sent to Checkpoint.
      * These fields are NOT part of the createDelegationSchema and will cause validation errors.
      */
-    async makeAPICall(agentShieldUrl, apiKey, requestBody) {
+    async makeAPICall(checkpointUrl, apiKey, requestBody) {
         try {
             // FINAL SAFEGUARD: Remove session_id and project_id if they somehow got added
             // This provides defense-in-depth protection
@@ -5669,7 +5669,7 @@ export class ConsentService {
                 logger.warn("[ConsentService] ⚠️ project_id detected in request body - removing (not in schema)");
                 delete sanitizedBody.project_id;
             }
-            const response = await fetch(`${agentShieldUrl}${AGENTSHIELD_ENDPOINTS.DELEGATIONS_CREATE}`, {
+            const response = await fetch(`${checkpointUrl}${CHECKPOINT_ENDPOINTS.DELEGATIONS_CREATE}`, {
                 method: "POST",
                 headers: {
                     Authorization: `Bearer ${apiKey}`,