@kya-os/mcp-i-cloudflare 1.3.6 → 1.3.8

package/dist/adapter.js

@@ -8,9 +8,9 @@
  * This implementation avoids Node.js dependencies by implementing
  * the MCP protocol directly.
  */
-import { createCloudflareRuntime } from './index';
-import { WELL_KNOWN_CORS_HEADERS, MCP_CORS_HEADERS, PREFLIGHT_CORS_HEADERS } from '@kya-os/mcp-i-core';
-import { KVProofArchive } from './storage/kv-proof-archive';
+import { createCloudflareRuntime } from "./index";
+import { WELL_KNOWN_CORS_HEADERS, MCP_CORS_HEADERS, PREFLIGHT_CORS_HEADERS, } from "@kya-os/mcp-i-core";
+import { KVProofArchive } from "./storage/kv-proof-archive";
 /**
  * Lightweight MCP protocol implementation for Cloudflare Workers
  */
@@ -22,7 +22,7 @@ class CloudflareMCPServer {
     constructor(runtime, serverInfo, tools = [], proofArchive) {
         this.runtime = runtime;
         this.serverInfo = serverInfo;
-        this.tools = new Map(tools.map(t => [t.name, t]));
+        this.tools = new Map(tools.map((t) => [t.name, t]));
         this.proofArchive = proofArchive;
     }
     /**
@@ -32,34 +32,34 @@ class CloudflareMCPServer {
         const { jsonrpc, id, method, params } = request;
         try {
             // Initialize/describe request
-            if (method === 'initialize') {
+            if (method === "initialize") {
                 return {
-                    jsonrpc: '2.0',
+                    jsonrpc: "2.0",
                     id,
                     result: {
-                        protocolVersion: '2025-06-18',
+                        protocolVersion: "2025-06-18",
                         capabilities: {
-                            tools: {}
+                            tools: {},
                         },
-                        serverInfo: this.serverInfo
-                    }
+                        serverInfo: this.serverInfo,
+                    },
                 };
             }
             // List tools
-            if (method === 'tools/list') {
-                const tools = Array.from(this.tools.values()).map(t => ({
+            if (method === "tools/list") {
+                const tools = Array.from(this.tools.values()).map((t) => ({
                     name: t.name,
                     description: t.description,
-                    inputSchema: t.inputSchema
+                    inputSchema: t.inputSchema,
                 }));
                 return {
-                    jsonrpc: '2.0',
+                    jsonrpc: "2.0",
                     id,
-                    result: { tools }
+                    result: { tools },
                 };
             }
             // Call tool with identity/proof wrapping
-            if (method === 'tools/call') {
+            if (method === "tools/call") {
                 const toolName = params.name;
                 const tool = this.tools.get(toolName);
                 if (!tool) {
@@ -73,11 +73,11 @@ class CloudflareMCPServer {
                     const randomSuffix = Math.random().toString(36).substring(2, 10);
                     session = {
                         id: `ephemeral-${timestamp}-${randomSuffix}`,
-                        audience: params.audience || 'mcp-client',
+                        audience: params.audience || "mcp-client",
                         clientDid: params.clientDid,
                         agentDid: (await this.runtime.getIdentity()).did,
                         createdAt: timestamp,
-                        expiresAt: timestamp + (30 * 60 * 1000), // 30 minutes
+                        expiresAt: timestamp + 30 * 60 * 1000, // 30 minutes
                         // Extract delegation token from MCP request if provided
                         delegationToken: params.delegationToken,
                         consentProof: params.consentProof,
@@ -99,7 +99,8 @@ class CloudflareMCPServer {
                 // Check if runtime has tool protection configured with requiredScopes
                 if (runtimeConfig?.delegation?.toolProtections?.[toolName]) {
                     const toolProtection = runtimeConfig.delegation.toolProtections[toolName];
-                    if (toolProtection.requiredScopes && toolProtection.requiredScopes.length > 0) {
+                    if (toolProtection.requiredScopes &&
+                        toolProtection.requiredScopes.length > 0) {
                         // Use the first required scope as the scopeId (e.g., "files:read")
                         scopeId = toolProtection.requiredScopes[0];
                     }
@@ -125,26 +126,26 @@ class CloudflareMCPServer {
                     }
                     catch (error) {
                         // Log error but don't fail the request
-                        console.error('Failed to store proof:', error);
+                        console.error("Failed to store proof:", error);
                     }
                 }
                 // Return result with detached proof (matching MCP-I pattern)
                 return {
-                    jsonrpc: '2.0',
+                    jsonrpc: "2.0",
                     id,
                     result: {
                         result, // Tool execution result
-                        proof // Detached proof with sessionId, audience, timestamp, etc.
-                    }
+                        proof, // Detached proof with sessionId, audience, timestamp, etc.
+                    },
                 };
             }
             // Handle MCP-I specific handshake
-            if (method === 'handshake') {
+            if (method === "handshake") {
                 const handshakeResult = await this.runtime.handleHandshake(params || {});
                 return {
-                    jsonrpc: '2.0',
+                    jsonrpc: "2.0",
                     id,
-                    result: handshakeResult
+                    result: handshakeResult,
                 };
             }
             // Unknown method
@@ -152,31 +153,44 @@ class CloudflareMCPServer {
         }
         catch (error) {
             // Check if this is a DelegationRequiredError - include consent URL in response
-            if (error.name === 'DelegationRequiredError' || error.constructor?.name === 'DelegationRequiredError') {
+            if (error &&
+                (error.name === "DelegationRequiredError" ||
+                    error.constructor?.name === "DelegationRequiredError")) {
                 return {
-                    jsonrpc: '2.0',
+                    jsonrpc: "2.0",
                     id,
                     error: {
                         code: -32001, // Custom error code for authorization required
-                        message: error.message || `Delegation required for tool "${error.toolName || 'unknown'}"`,
+                        message: error.consentUrl
+                            ? `${error.message || `Delegation required for tool "${error.toolName || "unknown"}"`}. <authorization_url>${error.consentUrl}</authorization_url>`
+                            : error.message || `Delegation required for tool "${error.toolName || "unknown"}"`,
                         data: {
                             toolName: error.toolName,
                             requiredScopes: error.requiredScopes || [],
                             consentUrl: error.consentUrl,
+                            resumeToken: error.resumeToken, // Include resume token for resumption
                             // MCP-I specific: provide authorization URL for client to display
                             authorizationUrl: error.consentUrl,
-                        }
-                    }
+                        },
+                    },
                 };
             }
             // Generic error handler
+            let errorMessage = "Internal error";
+            if (error) {
+                // Only use error message if it's an Error object with a message property
+                if (typeof error === 'object' && error instanceof Error && error.message) {
+                    errorMessage = error.message;
+                }
+                // For non-Error objects (strings, null, etc.), use default "Internal error"
+            }
             return {
-                jsonrpc: '2.0',
+                jsonrpc: "2.0",
                 id,
                 error: {
                     code: -32603,
-                    message: error.message || 'Internal error'
-                }
+                    message: errorMessage,
+                },
             };
         }
     }
@@ -193,12 +207,14 @@ export function createMCPICloudflareAdapter(config) {
     const runtime = createCloudflareRuntime(config);
     // Server info
     const serverInfo = config.serverInfo || {
-        name: 'MCP-I Cloudflare Server',
-        version: '1.0.0'
+        name: "MCP-I Cloudflare Server",
+        version: "1.0.0",
     };
     // Initialize proof archive if PROOF_ARCHIVE KV is available
     const env = config.env;
-    const proofArchive = env.PROOF_ARCHIVE ? new KVProofArchive(env.PROOF_ARCHIVE) : undefined;
+    const proofArchive = env.PROOF_ARCHIVE
+        ? new KVProofArchive(env.PROOF_ARCHIVE)
+        : undefined;
     // Create lightweight MCP server
     const server = new CloudflareMCPServer(runtime, serverInfo, config.tools || [], proofArchive);
     // Return fetch handler
@@ -211,94 +227,97 @@ export function createMCPICloudflareAdapter(config) {
             const url = new URL(request.url);
             const identity = await runtime.getIdentity();
             // Health check endpoint
-            if (url.pathname === '/health') {
+            if (url.pathname === "/health") {
                 return new Response(JSON.stringify({
-                    status: 'healthy',
+                    status: "healthy",
                     timestamp: new Date().toISOString(),
                     identity: {
-                        did: identity.did
+                        did: identity.did,
                     },
                     transport: {
-                        http: '/mcp',
-                        sse: '/sse',
-                        streamableHttp: '/mcp'
+                        http: "/mcp",
+                        sse: "/sse",
+                        streamableHttp: "/mcp",
                     },
-                    features: ['identity', 'proof', 'delegation', 'audit']
+                    features: ["identity", "proof", "delegation", "audit"],
                 }), {
-                    headers: { 'Content-Type': 'application/json' }
+                    headers: { "Content-Type": "application/json" },
                 });
             }
             // Well-known endpoints for identity verification
-            if (url.pathname.startsWith('/.well-known/')) {
+            if (url.pathname.startsWith("/.well-known/")) {
                 const handler = runtime.createWellKnownHandler({
                     serviceName: serverInfo.name,
-                    serviceEndpoint: request.headers.get('host') || 'localhost'
+                    serviceEndpoint: request.headers.get("host") || "localhost",
                 });
                 const result = await handler(url.pathname);
                 if (result) {
-                    if (result.status && result.headers && result.body) {
+                    // Check if it's a WellKnownResponse (has status, headers, body)
+                    if ("status" in result && "headers" in result && "body" in result) {
                         return new Response(result.body, {
                             status: result.status,
                             headers: {
                                 ...result.headers,
-                                ...WELL_KNOWN_CORS_HEADERS
-                            }
+                                ...WELL_KNOWN_CORS_HEADERS,
+                            },
                         });
                     }
+                    // Otherwise it's an MCPIdentity object, return as JSON
                     return new Response(JSON.stringify(result), {
+                        status: 200,
                         headers: {
-                            'Content-Type': 'application/json',
-                            ...WELL_KNOWN_CORS_HEADERS
-                        }
+                            "Content-Type": "application/json",
+                            ...WELL_KNOWN_CORS_HEADERS,
+                        },
                     });
                 }
             }
             // Debug endpoint (development only)
-            if (url.pathname === '/debug' && config.environment !== 'production') {
+            if (url.pathname === "/debug" && config.environment !== "production") {
                 const debugHandler = runtime.createDebugEndpoint();
                 if (debugHandler) {
                     const result = await debugHandler();
                     return new Response(JSON.stringify(result), {
-                        headers: { 'Content-Type': 'application/json' }
+                        headers: { "Content-Type": "application/json" },
                     });
                 }
             }
             // Main MCP protocol endpoint - supports both POST and SSE
-            if (url.pathname === '/mcp') {
+            if (url.pathname === "/mcp") {
                 // Handle SSE streaming (for Claude Desktop via mcp-remote)
-                if (request.method === 'GET') {
-                    const acceptHeader = request.headers.get('Accept') || '';
-                    if (acceptHeader.includes('text/event-stream')) {
+                if (request.method === "GET") {
+                    const acceptHeader = request.headers.get("Accept") || "";
+                    if (acceptHeader.includes("text/event-stream")) {
                         return handleSSE(server, runtime);
                     }
                     // GET requests without SSE Accept header should return Method Not Allowed
                     // MCP protocol primarily uses POST for JSON-RPC
-                    return new Response('Method Not Allowed: Use POST for JSON-RPC or GET with Accept: text/event-stream for SSE', {
+                    return new Response("Method Not Allowed: Use POST for JSON-RPC or GET with Accept: text/event-stream for SSE", {
                         status: 405,
                         headers: {
-                            'Content-Type': 'text/plain',
-                            'Allow': 'POST, GET',
-                            ...MCP_CORS_HEADERS
-                        }
+                            "Content-Type": "text/plain",
+                            Allow: "POST, GET",
+                            ...MCP_CORS_HEADERS,
+                        },
                     });
                 }
                 // Handle DELETE requests (session termination)
-                if (request.method === 'DELETE') {
+                if (request.method === "DELETE") {
                     // MCP Inspector and clients may send DELETE to terminate sessions
                     // Return 200 OK with empty body (some environments don't support 204 well)
-                    return new Response('', {
+                    return new Response("", {
                         status: 200,
                         headers: {
-                            'Content-Length': '0',
-                            ...MCP_CORS_HEADERS
-                        }
+                            "Content-Length": "0",
+                            ...MCP_CORS_HEADERS,
+                        },
                     });
                 }
                 // Handle standard POST (existing functionality)
-                if (request.method === 'POST') {
-                    const acceptHeader = request.headers.get('Accept') || '';
+                if (request.method === "POST") {
+                    const acceptHeader = request.headers.get("Accept") || "";
                     // Check if client wants SSE response
-                    if (acceptHeader.includes('text/event-stream')) {
+                    if (acceptHeader.includes("text/event-stream")) {
                         // Return SSE stream for POST (Streamable HTTP mode)
                         return handleSSEPost(server, runtime, request);
                     }
@@ -310,100 +329,102 @@ export function createMCPICloudflareAdapter(config) {
                         const response = await server.handleRequest(jsonRpcRequest);
                         return new Response(JSON.stringify(response), {
                             headers: {
-                                'Content-Type': 'application/json',
-                                ...MCP_CORS_HEADERS
-                            }
+                                "Content-Type": "application/json",
+                                ...MCP_CORS_HEADERS,
+                            },
                         });
                     }
                     catch (error) {
                         return new Response(JSON.stringify({
-                            jsonrpc: '2.0',
+                            jsonrpc: "2.0",
                             error: {
                                 code: -32603,
-                                message: error.message || 'Internal error'
-                            }
+                                message: error.message || "Internal error",
+                            },
                         }), {
                             status: 500,
-                            headers: { 'Content-Type': 'application/json' }
+                            headers: { "Content-Type": "application/json" },
                         });
                     }
                 }
             }
             // SSE endpoint for backward compatibility and Claude Desktop
-            if (url.pathname === '/sse') {
-                if (request.method === 'GET') {
+            if (url.pathname === "/sse") {
+                if (request.method === "GET") {
                     return handleSSE(server, runtime);
                 }
-                if (request.method === 'POST') {
+                if (request.method === "POST") {
                     return handleSSEPost(server, runtime, request);
                 }
             }
             // Standalone verify endpoint for external verification
-            if (url.pathname === '/verify' && request.method === 'POST') {
+            if (url.pathname === "/verify" && request.method === "POST") {
                 try {
-                    const { data, proof } = await request.json();
+                    const { data, proof } = (await request.json());
                     const isValid = await runtime.verifyProof(data, proof);
                     return new Response(JSON.stringify({
                         verified: isValid,
-                        agent: isValid ? {
-                            did: proof.did,
-                            timestamp: proof.timestamp,
-                            sessionId: proof.sessionId
-                        } : null
+                        agent: isValid
+                            ? {
+                                did: proof.did,
+                                timestamp: proof.timestamp,
+                                sessionId: proof.sessionId,
+                            }
+                            : null,
                     }), {
-                        headers: { 'Content-Type': 'application/json' }
+                        headers: { "Content-Type": "application/json" },
                     });
                 }
                 catch (error) {
                     return new Response(JSON.stringify({
-                        error: error.message || 'Verification failed'
+                        error: error.message || "Verification failed",
                     }), {
                         status: 400,
-                        headers: { 'Content-Type': 'application/json' }
+                        headers: { "Content-Type": "application/json" },
                     });
                 }
             }
             // Admin endpoints for viewing nonces and proofs
-            if (url.pathname.startsWith('/admin/')) {
+            if (url.pathname.startsWith("/admin/")) {
                 // Only allow in development or if explicitly configured
-                if (config.environment === 'production') {
+                if (config.environment === "production") {
                     return new Response(JSON.stringify({
-                        error: 'Admin endpoints disabled in production'
+                        error: "Admin endpoints disabled in production",
                     }), {
                         status: 403,
-                        headers: { 'Content-Type': 'application/json' }
+                        headers: { "Content-Type": "application/json" },
                     });
                 }
                 const env = config.env;
                 // GET /admin/nonces - List active nonces
-                if (url.pathname === '/admin/nonces') {
+                if (url.pathname === "/admin/nonces") {
                     try {
                         // Use KV list to get nonce keys
-                        const noncesList = await env.NONCE_CACHE.list({ prefix: 'nonce:' });
+                        const noncesList = await env.NONCE_CACHE.list({ prefix: "nonce:" });
                         const nonces = [];
                         for (const key of noncesList.keys) {
                             const value = await env.NONCE_CACHE.get(key.name);
                             if (value) {
                                 nonces.push({
-                                    nonce: key.name.replace('nonce:', ''),
-                                    storedAt: key.metadata?.storedAt || 'unknown',
-                                    expiresAt: key.expiration
+                                    nonce: key.name.replace("nonce:", ""),
+                                    storedAt: key.metadata?.storedAt || "unknown",
+                                    expiresAt: key.expiration,
                                 });
                             }
                         }
                         return new Response(JSON.stringify({
                             total: nonces.length,
-                            nonces
+                            nonces,
                         }), {
-                            headers: { 'Content-Type': 'application/json' }
+                            headers: { "Content-Type": "application/json" },
                         });
                     }
                     catch (error) {
                         return new Response(JSON.stringify({
-                            error: error.message || 'Failed to list nonces'
+                            error: error.message || "Failed to list nonces",
                         }), {
                             status: 500,
-                            headers: { 'Content-Type': 'application/json' }
+                            headers: { "Content-Type": "application/json" },
                         });
                     }
                 }
@@ -413,18 +434,18 @@ export function createMCPICloudflareAdapter(config) {
                     : null;
                 if (!proofArchive) {
                     return new Response(JSON.stringify({
-                        error: 'PROOF_ARCHIVE KV namespace not configured'
+                        error: "PROOF_ARCHIVE KV namespace not configured",
                     }), {
                         status: 503,
-                        headers: { 'Content-Type': 'application/json' }
+                        headers: { "Content-Type": "application/json" },
                     });
                 }
                 // GET /admin/proofs - List proofs with optional filters
-                if (url.pathname === '/admin/proofs') {
+                if (url.pathname === "/admin/proofs") {
                     try {
-                        const sessionId = url.searchParams.get('sessionId');
-                        const did = url.searchParams.get('did');
-                        const limit = parseInt(url.searchParams.get('limit') || '50');
+                        const sessionId = url.searchParams.get("sessionId");
+                        const did = url.searchParams.get("did");
+                        const limit = parseInt(url.searchParams.get("limit") || "50");
                         let proofs;
                         if (sessionId) {
                             proofs = await proofArchive.getBySession(sessionId, limit);
@@ -437,17 +458,17 @@ export function createMCPICloudflareAdapter(config) {
                         }
                         return new Response(JSON.stringify({
                             total: proofs.length,
-                            proofs
+                            proofs,
                         }), {
-                            headers: { 'Content-Type': 'application/json' }
+                            headers: { "Content-Type": "application/json" },
                         });
                     }
                     catch (error) {
                         return new Response(JSON.stringify({
-                            error: error.message || 'Failed to list proofs'
+                            error: error.message || "Failed to list proofs",
                         }), {
                             status: 500,
-                            headers: { 'Content-Type': 'application/json' }
+                            headers: { "Content-Type": "application/json" },
                         });
                     }
                 }
@@ -459,60 +480,60 @@ export function createMCPICloudflareAdapter(config) {
                         const proof = await proofArchive.get(proofId);
                         if (!proof) {
                             return new Response(JSON.stringify({
-                                error: 'Proof not found'
+                                error: "Proof not found",
                             }), {
                                 status: 404,
-                                headers: { 'Content-Type': 'application/json' }
+                                headers: { "Content-Type": "application/json" },
                             });
                         }
                         return new Response(JSON.stringify(proof), {
-                            headers: { 'Content-Type': 'application/json' }
+                            headers: { "Content-Type": "application/json" },
                         });
                     }
                     catch (error) {
                         return new Response(JSON.stringify({
-                            error: error.message || 'Failed to get proof'
+                            error: error.message || "Failed to get proof",
                         }), {
                             status: 500,
-                            headers: { 'Content-Type': 'application/json' }
+                            headers: { "Content-Type": "application/json" },
                         });
                     }
                 }
                 // GET /admin/stats - Combined statistics
-                if (url.pathname === '/admin/stats') {
+                if (url.pathname === "/admin/stats") {
                     try {
                         const [noncesList, proofStats] = await Promise.all([
-                            env.NONCE_CACHE.list({ prefix: 'nonce:' }),
-                            proofArchive.getStats()
+                            env.NONCE_CACHE.list({ prefix: "nonce:" }),
+                            proofArchive.getStats(),
                         ]);
                         return new Response(JSON.stringify({
                             nonces: {
-                                active: noncesList.keys.length
+                                active: noncesList.keys.length,
                             },
                             proofs: proofStats,
-                            timestamp: new Date().toISOString()
+                            timestamp: new Date().toISOString(),
                         }), {
-                            headers: { 'Content-Type': 'application/json' }
+                            headers: { "Content-Type": "application/json" },
                         });
                     }
                     catch (error) {
                         return new Response(JSON.stringify({
-                            error: error.message || 'Failed to get stats'
+                            error: error.message || "Failed to get stats",
                         }), {
                             status: 500,
-                            headers: { 'Content-Type': 'application/json' }
+                            headers: { "Content-Type": "application/json" },
                         });
                     }
                 }
             }
             // CORS preflight
-            if (request.method === 'OPTIONS') {
+            if (request.method === "OPTIONS") {
                 return new Response(null, {
-                    headers: PREFLIGHT_CORS_HEADERS
+                    headers: PREFLIGHT_CORS_HEADERS,
                 });
             }
-            return new Response('Not found', { status: 404 });
-        }
+            return new Response("Not found", { status: 404 });
+        },
     };
 }
 /**
@@ -525,14 +546,14 @@ async function handleSSE(server, runtime) {
     const encoder = new TextEncoder();
     // Return a simple SSE ping response
     // This establishes the SSE connection but doesn't try to keep it alive
-    const sseData = ': ping\n\n';
+    const sseData = ": ping\n\n";
     return new Response(encoder.encode(sseData), {
         headers: {
-            'Content-Type': 'text/event-stream',
-            'Cache-Control': 'no-cache',
-            'X-Content-Type-Options': 'nosniff',
-            ...MCP_CORS_HEADERS
-        }
+            "Content-Type": "text/event-stream",
+            "Cache-Control": "no-cache",
+            "X-Content-Type-Options": "nosniff",
+            ...MCP_CORS_HEADERS,
+        },
     });
 }
 /**
@@ -553,30 +574,30 @@ async function handleSSEPost(server, runtime, request) {
         // Return SSE response directly without TransformStream
         return new Response(encoder.encode(eventData), {
             headers: {
-                'Content-Type': 'text/event-stream',
-                'Cache-Control': 'no-cache',
-                'X-Content-Type-Options': 'nosniff',
-                ...MCP_CORS_HEADERS
-            }
+                "Content-Type": "text/event-stream",
+                "Cache-Control": "no-cache",
+                "X-Content-Type-Options": "nosniff",
+                ...MCP_CORS_HEADERS,
+            },
         });
     }
     catch (error) {
         const errorResponse = {
-            jsonrpc: '2.0',
+            jsonrpc: "2.0",
             error: {
                 code: -32603,
-                message: error.message || 'Internal error'
-            }
+                message: error.message || "Internal error",
+            },
         };
         const eventData = `data: ${JSON.stringify(errorResponse)}\n\n`;
         // Return error as SSE event (status 200 per SSE spec)
         return new Response(encoder.encode(eventData), {
             status: 200, // SSE always returns 200, even for errors
             headers: {
-                'Content-Type': 'text/event-stream',
-                'Cache-Control': 'no-cache',
-                ...MCP_CORS_HEADERS
-            }
+                "Content-Type": "text/event-stream",
+                "Cache-Control": "no-cache",
+                ...MCP_CORS_HEADERS,
+            },
         });
     }
 }