@kya-os/mcp-i-cloudflare 1.3.9 → 1.4.0

package/dist/services/admin.service.js

@@ -0,0 +1,151 @@
+/**
+ * Admin Service
+ *
+ * Handles admin endpoints for cache management and debugging.
+ * Only enabled when config.admin.enabled === true
+ */
+import { DEFAULT_AGENTSHIELD_URL } from "../constants";
+export class AdminService {
+    env;
+    constructor(env) {
+        this.env = env;
+    }
+    /**
+     * Handle admin requests
+     * @param request - Incoming request
+     * @returns Response
+     */
+    async handle(request) {
+        const url = new URL(request.url);
+        // Only POST /admin/clear-cache is supported
+        if (url.pathname === "/admin/clear-cache") {
+            if (request.method !== "POST") {
+                return new Response(JSON.stringify({
+                    success: false,
+                    error: "Method not allowed. Use POST.",
+                }), {
+                    status: 405,
+                    headers: { "Content-Type": "application/json" },
+                });
+            }
+            return this.handleClearCache(request);
+        }
+        return new Response(JSON.stringify({
+            success: false,
+            error: "Not found",
+        }), {
+            status: 404,
+            headers: { "Content-Type": "application/json" },
+        });
+    }
+    /**
+     * Handle cache clearing request
+     */
+    async handleClearCache(request) {
+        try {
+            // Parse request body
+            const body = (await request.json().catch(() => ({})));
+            const agentDid = body.agent_did;
+            if (!agentDid || typeof agentDid !== "string") {
+                return new Response(JSON.stringify({
+                    success: false,
+                    error: "Bad Request - agent_did required in body",
+                }), {
+                    status: 400,
+                    headers: { "Content-Type": "application/json" },
+                });
+            }
+            // Extract API key from Authorization header
+            const authHeader = request.headers.get("Authorization");
+            if (!authHeader || !authHeader.startsWith("Bearer ")) {
+                return new Response(JSON.stringify({
+                    success: false,
+                    error: "Unauthorized - Missing or invalid Authorization header",
+                }), {
+                    status: 401,
+                    headers: { "Content-Type": "application/json" },
+                });
+            }
+            const apiKey = authHeader.slice(7); // Remove "Bearer " prefix
+            // Validate API key by making a test call to AgentShield
+            const agentShieldUrl = this.env.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
+            const validationUrl = `${agentShieldUrl}/api/v1/bouncer/config?agent_did=${encodeURIComponent(agentDid)}`;
+            try {
+                const validationResponse = await fetch(validationUrl, {
+                    method: "GET",
+                    headers: {
+                        "Content-Type": "application/json",
+                        Authorization: `Bearer ${apiKey}`,
+                    },
+                });
+                if (!validationResponse.ok) {
+                    console.warn("[Admin] API key validation failed:", validationResponse.status);
+                    return new Response(JSON.stringify({
+                        success: false,
+                        error: "Unauthorized - Invalid API key",
+                    }), {
+                        status: 401,
+                        headers: { "Content-Type": "application/json" },
+                    });
+                }
+                // API key is valid, proceed to clear cache
+                console.log("[Admin] API key validated successfully");
+            }
+            catch (error) {
+                console.error("[Admin] API key validation error:", error);
+                return new Response(JSON.stringify({
+                    success: false,
+                    error: "Failed to validate API key with AgentShield",
+                }), {
+                    status: 500,
+                    headers: { "Content-Type": "application/json" },
+                });
+            }
+            // Clear cache from KV
+            // Cache key format: KVToolProtectionCache uses 'tool-protection:' prefix + agentDid
+            const cacheKey = `tool-protection:${agentDid}`;
+            const kvNamespace = this.env.TOOL_PROTECTION_KV;
+            if (!kvNamespace) {
+                return new Response(JSON.stringify({
+                    success: false,
+                    error: "Tool protection KV namespace not configured",
+                }), {
+                    status: 500,
+                    headers: { "Content-Type": "application/json" },
+                });
+            }
+            // Log before and after for debugging
+            const before = await kvNamespace.get(cacheKey);
+            await kvNamespace.delete(cacheKey);
+            const after = await kvNamespace.get(cacheKey);
+            console.log("[Admin] Cache clear operation", {
+                agentDid: agentDid.slice(0, 20) + "...",
+                cacheKey,
+                hadValue: !!before,
+                cleared: !after,
+            });
+            return new Response(JSON.stringify({
+                success: true,
+                message: "Cache cleared successfully. Next tool call will fetch fresh config from AgentShield.",
+                agent_did: agentDid,
+                cache_key: cacheKey,
+                had_value: !!before,
+            }), {
+                status: 200,
+                headers: { "Content-Type": "application/json" },
+            });
+        }
+        catch (error) {
+            console.error("[Admin] Failed to clear cache:", error);
+            return new Response(JSON.stringify({
+                success: false,
+                error: "Internal error clearing cache",
+                details: error instanceof Error ? error.message : String(error),
+            }), {
+                status: 500,
+                headers: { "Content-Type": "application/json" },
+            });
+        }
+    }
+}
+//# sourceMappingURL=admin.service.js.map

package/dist/services/admin.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.service.js","sourceRoot":"","sources":["../../src/services/admin.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,OAAO,YAAY;IACf,GAAG,CAAgB;IAE3B,YAAY,GAAkB;QAC5B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,OAAgB;QAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEjC,4CAA4C;QAC5C,IAAI,GAAG,CAAC,QAAQ,KAAK,oBAAoB,EAAE,CAAC;YAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,+BAA+B;iBACvC,CAAC,EACF;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CACF,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;YACb,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,WAAW;SACnB,CAAC,EACF;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAAC,OAAgB;QAC7C,IAAI,CAAC;YACH,qBAAqB;YACrB,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAEnD,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;YAEhC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9C,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,0CAA0C;iBAClD,CAAC,EACF;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CACF,CAAC;YACJ,CAAC;YAED,4CAA4C;YAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACxD,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACrD,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,wDAAwD;iBAChE,CAAC,EACF;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CACF,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B;YAE9D,wDAAwD;YACxD,MAAM,cAAc,GAClB,IAAI,CAAC,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;YAC1D,MAAM,aAAa,GAAG,GAAG,cAAc,oCAAoC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAE1G,IAAI,CAAC;gBACH,MAAM,kBAAkB,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;oBACpD,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;qBAClC;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC;oBAC3B,OAAO,CAAC,IAAI,CACV,oCAAoC,EACpC,kBAAkB,CAAC,MAAM,CAC1B,CAAC;oBACF,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;wBACb,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,gCAAgC;qBACxC,CAAC,EACF;wBACE,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;qBAChD,CACF,CAAC;gBACJ,CAAC;gBAED,2CAA2C;gBAC3C,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;gBAC1D,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,6CAA6C;iBACrD,CAAC,EACF;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CACF,CAAC;YACJ,CAAC;YAED,sBAAsB;YACtB,oFAAoF;YACpF,MAAM,QAAQ,GAAG,mBAAmB,QAAQ,EAAE,CAAC;YAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAEhD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,6CAA6C;iBACrD,CAAC,EACF;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CACF,CAAC;YACJ,CAAC;YAED,qCAAqC;YACrC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/C,MAAM,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAE9C,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE;gBAC3C,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACvC,QAAQ;gBACR,QAAQ,EAAE,CAAC,CAAC,MAAM;gBAClB,OAAO,EAAE,CAAC,KAAK;aAChB,CAAC,CAAC;YAEH,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,IAAI;gBACb,OAAO,EACL,sFAAsF;gBACxF,SAAS,EAAE,QAAQ;gBACnB,SAAS,EAAE,QAAQ;gBACnB,SAAS,EAAE,CAAC,CAAC,MAAM;aACpB,CAAC,EACF;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;YACvD,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,+BAA+B;gBACtC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAChE,CAAC,EACF;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/services/consent.service.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Consent Service
+ *
+ * Handles consent page rendering and approval handling.
+ * Structure only - full implementation in Phase 0.
+ */
+export declare class ConsentService {
+    /**
+     * Handle consent requests
+     * @param request - Incoming request
+     * @returns Response
+     */
+    handle(request: Request): Promise<Response>;
+    /**
+     * Render consent page
+     * TODO: Implement in Phase 0
+     */
+    private renderConsentPage;
+    /**
+     * Handle consent approval
+     * TODO: Implement in Phase 0
+     */
+    private handleApproval;
+}
+//# sourceMappingURL=consent.service.d.ts.map

package/dist/services/consent.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.service.d.ts","sourceRoot":"","sources":["../../src/services/consent.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qBAAa,cAAc;IACzB;;;;OAIG;IACG,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAgBjD;;;OAGG;YACW,iBAAiB;IAQ/B;;;OAGG;YACW,cAAc;CAO7B"}

package/dist/services/consent.service.js

@@ -0,0 +1,48 @@
+/**
+ * Consent Service
+ *
+ * Handles consent page rendering and approval handling.
+ * Structure only - full implementation in Phase 0.
+ */
+export class ConsentService {
+    /**
+     * Handle consent requests
+     * @param request - Incoming request
+     * @returns Response
+     */
+    async handle(request) {
+        const url = new URL(request.url);
+        if (request.method === 'GET') {
+            // Render consent page
+            return this.renderConsentPage(url.searchParams);
+        }
+        if (request.method === 'POST') {
+            // Handle approval
+            return this.handleApproval(request);
+        }
+        return new Response('Method not allowed', { status: 405 });
+    }
+    /**
+     * Render consent page
+     * TODO: Implement in Phase 0
+     */
+    async renderConsentPage(params) {
+        // Placeholder - will be implemented in Phase 0
+        return new Response('Consent page - Phase 0 implementation', {
+            status: 501,
+            headers: { 'Content-Type': 'text/plain' }
+        });
+    }
+    /**
+     * Handle consent approval
+     * TODO: Implement in Phase 0
+     */
+    async handleApproval(request) {
+        // Placeholder - will be implemented in Phase 0
+        return new Response('Consent approval - Phase 0 implementation', {
+            status: 501,
+            headers: { 'Content-Type': 'text/plain' }
+        });
+    }
+}
+//# sourceMappingURL=consent.service.js.map

package/dist/services/consent.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.service.js","sourceRoot":"","sources":["../../src/services/consent.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,OAAO,cAAc;IACzB;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,OAAgB;QAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,sBAAsB;YACtB,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,kBAAkB;YAClB,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,iBAAiB,CAAC,MAAuB;QACrD,+CAA+C;QAC/C,OAAO,IAAI,QAAQ,CAAC,uCAAuC,EAAE;YAC3D,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;SAC1C,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc,CAAC,OAAgB;QAC3C,+CAA+C;QAC/C,OAAO,IAAI,QAAQ,CAAC,2CAA2C,EAAE;YAC/D,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;SAC1C,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/services/delegation.service.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Delegation Service
+ *
+ * Handles delegation token retrieval, verification, and cache management
+ * for MCP-I Cloudflare servers.
+ */
+import type { CloudflareEnv } from '../types';
+import type { CloudflareRuntime } from '../runtime';
+export declare class DelegationService {
+    private env;
+    private runtime?;
+    constructor(env: CloudflareEnv, runtime?: CloudflareRuntime);
+    /**
+     * Get delegation token from cache or storage
+     * @param sessionId - Optional session ID for session-based lookup
+     * @returns Delegation token or null if not found
+     */
+    getDelegationToken(sessionId?: string): Promise<string | null>;
+    /**
+     * Verify delegation token with AgentShield API
+     * @param token - Delegation token to verify
+     * @returns True if token is valid, false otherwise
+     */
+    verifyDelegation(token: string): Promise<boolean>;
+    /**
+     * Invalidate delegation token in all caches
+     * @param sessionId - Session ID to clear
+     * @param token - Token to invalidate
+     * @param agentDid - Agent DID to clear
+     */
+    invalidateCache(sessionId?: string, token?: string, agentDid?: string): Promise<void>;
+}
+//# sourceMappingURL=delegation.service.d.ts.map

package/dist/services/delegation.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.service.d.ts","sourceRoot":"","sources":["../../src/services/delegation.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,GAAG,CAAgB;IAC3B,OAAO,CAAC,OAAO,CAAC,CAAoB;gBAExB,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,iBAAiB;IAK3D;;;;OAIG;IACG,kBAAkB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAoEpE;;;;OAIG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAyDvD;;;;;OAKG;IACG,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CA6B5F"}

package/dist/services/delegation.service.js

@@ -0,0 +1,168 @@
+/**
+ * Delegation Service
+ *
+ * Handles delegation token retrieval, verification, and cache management
+ * for MCP-I Cloudflare servers.
+ */
+import { DEFAULT_AGENTSHIELD_URL, DEFAULT_VERIFICATION_CACHE_TTL, DEFAULT_SESSION_CACHE_TTL } from '../constants';
+export class DelegationService {
+    env;
+    runtime;
+    constructor(env, runtime) {
+        this.env = env;
+        this.runtime = runtime;
+    }
+    /**
+     * Get delegation token from cache or storage
+     * @param sessionId - Optional session ID for session-based lookup
+     * @returns Delegation token or null if not found
+     */
+    async getDelegationToken(sessionId) {
+        const delegationStorage = this.env.DELEGATION_STORAGE;
+        if (!delegationStorage) {
+            console.log('[Delegation] No delegation storage configured');
+            return null;
+        }
+        try {
+            // Fast path: Try session cache first
+            if (sessionId) {
+                const sessionKey = `session:${sessionId}`;
+                const sessionToken = await delegationStorage.get(sessionKey);
+                if (sessionToken) {
+                    // Verify token is still valid before returning
+                    const isValid = await this.verifyDelegation(sessionToken);
+                    if (isValid) {
+                        console.log('[Delegation] ✅ Token retrieved from session cache and verified');
+                        return sessionToken;
+                    }
+                    else {
+                        // Token invalid, remove from cache
+                        await this.invalidateCache(sessionId, sessionToken);
+                        console.log('[Delegation] ⚠️ Cached token was invalid, removed from cache');
+                    }
+                }
+            }
+            // Fallback: Try agent DID (stable across session changes)
+            if (this.runtime) {
+                const identity = await this.runtime.getIdentity();
+                if (identity?.did) {
+                    const agentKey = `agent:${identity.did}:delegation`;
+                    const agentToken = await delegationStorage.get(agentKey);
+                    if (agentToken) {
+                        // Verify token is still valid before returning
+                        const isValid = await this.verifyDelegation(agentToken);
+                        if (isValid) {
+                            console.log('[Delegation] ✅ Token retrieved using agent DID and verified');
+                            // Re-cache for current session (performance optimization)
+                            if (sessionId) {
+                                const sessionCacheKey = `session:${sessionId}`;
+                                await delegationStorage.put(sessionCacheKey, agentToken, {
+                                    expirationTtl: DEFAULT_SESSION_CACHE_TTL
+                                });
+                                console.log('[Delegation] Token cached for session with 5-minute TTL:', sessionId);
+                            }
+                            return agentToken;
+                        }
+                        else {
+                            // Token invalid, remove from cache
+                            await this.invalidateCache(sessionId, agentToken, identity.did);
+                            console.log('[Delegation] ⚠️ Agent token was invalid, removed from cache');
+                        }
+                    }
+                }
+            }
+            console.log('[Delegation] No delegation token found');
+            return null;
+        }
+        catch (error) {
+            console.error('[Delegation] Failed to retrieve token:', error);
+            return null;
+        }
+    }
+    /**
+     * Verify delegation token with AgentShield API
+     * @param token - Delegation token to verify
+     * @returns True if token is valid, false otherwise
+     */
+    async verifyDelegation(token) {
+        // Check verification cache first
+        const verificationCache = this.env.TOOL_PROTECTION_KV;
+        if (verificationCache) {
+            const cacheKey = `verified:${token.substring(0, 16)}`; // Use prefix to avoid key size issues
+            const cached = await verificationCache.get(cacheKey);
+            if (cached === '1') {
+                console.log('[Delegation] Token verification cached as valid');
+                return true;
+            }
+        }
+        try {
+            const agentShieldUrl = this.env.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
+            const apiKey = this.env.AGENTSHIELD_API_KEY;
+            if (!apiKey) {
+                console.warn('[Delegation] No AgentShield API key configured, skipping verification');
+                return true; // Allow in development without API key
+            }
+            // Verify with AgentShield API
+            const response = await fetch(`${agentShieldUrl}/api/v1/bouncer/delegations/verify`, {
+                method: 'POST',
+                headers: {
+                    'Authorization': `Bearer ${apiKey}`,
+                    'Content-Type': 'application/json'
+                },
+                body: JSON.stringify({ token })
+            });
+            if (response.ok) {
+                // Cache successful verification
+                if (verificationCache) {
+                    const cacheKey = `verified:${token.substring(0, 16)}`;
+                    await verificationCache.put(cacheKey, '1', {
+                        expirationTtl: DEFAULT_VERIFICATION_CACHE_TTL
+                    });
+                }
+                console.log('[Delegation] Token verified successfully with AgentShield');
+                return true;
+            }
+            if (response.status === 401 || response.status === 403) {
+                console.log('[Delegation] Token verification failed: unauthorized');
+                return false;
+            }
+            console.warn('[Delegation] Token verification returned unexpected status:', response.status);
+            return false; // Fail closed for security
+        }
+        catch (error) {
+            console.error('[Delegation] Error verifying token with AgentShield:', error);
+            return false; // Fail closed on errors
+        }
+    }
+    /**
+     * Invalidate delegation token in all caches
+     * @param sessionId - Session ID to clear
+     * @param token - Token to invalidate
+     * @param agentDid - Agent DID to clear
+     */
+    async invalidateCache(sessionId, token, agentDid) {
+        const delegationStorage = this.env.DELEGATION_STORAGE;
+        const verificationCache = this.env.TOOL_PROTECTION_KV;
+        if (!delegationStorage)
+            return;
+        const deletions = [];
+        // Clear session cache
+        if (sessionId) {
+            const sessionKey = `session:${sessionId}`;
+            deletions.push(delegationStorage.delete(sessionKey));
+        }
+        // Clear agent cache
+        if (agentDid) {
+            const agentKey = `agent:${agentDid}:delegation`;
+            deletions.push(delegationStorage.delete(agentKey));
+        }
+        // Clear verification cache
+        if (token && verificationCache) {
+            const cacheKey = `verified:${token.substring(0, 16)}`;
+            deletions.push(verificationCache.delete(cacheKey));
+        }
+        await Promise.all(deletions);
+        console.log('[Delegation] Cache invalidated for revoked/invalid token');
+    }
+}
+//# sourceMappingURL=delegation.service.js.map

package/dist/services/delegation.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.service.js","sourceRoot":"","sources":["../../src/services/delegation.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAGlH,MAAM,OAAO,iBAAiB;IACpB,GAAG,CAAgB;IACnB,OAAO,CAAqB;IAEpC,YAAY,GAAkB,EAAE,OAA2B;QACzD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,SAAkB;QACzC,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAEtD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,qCAAqC;YACrC,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,UAAU,GAAG,WAAW,SAAS,EAAE,CAAC;gBAC1C,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAE7D,IAAI,YAAY,EAAE,CAAC;oBACjB,+CAA+C;oBAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;oBAC1D,IAAI,OAAO,EAAE,CAAC;wBACZ,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;wBAC9E,OAAO,YAAY,CAAC;oBACtB,CAAC;yBAAM,CAAC;wBACN,mCAAmC;wBACnC,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;wBACpD,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;oBAC9E,CAAC;gBACH,CAAC;YACH,CAAC;YAED,0DAA0D;YAC1D,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBAClD,IAAI,QAAQ,EAAE,GAAG,EAAE,CAAC;oBAClB,MAAM,QAAQ,GAAG,SAAS,QAAQ,CAAC,GAAG,aAAa,CAAC;oBACpD,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;oBAEzD,IAAI,UAAU,EAAE,CAAC;wBACf,+CAA+C;wBAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;wBACxD,IAAI,OAAO,EAAE,CAAC;4BACZ,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;4BAE3E,0DAA0D;4BAC1D,IAAI,SAAS,EAAE,CAAC;gCACd,MAAM,eAAe,GAAG,WAAW,SAAS,EAAE,CAAC;gCAC/C,MAAM,iBAAiB,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,EAAE;oCACvD,aAAa,EAAE,yBAAyB;iCACzC,CAAC,CAAC;gCACH,OAAO,CAAC,GAAG,CAAC,0DAA0D,EAAE,SAAS,CAAC,CAAC;4BACrF,CAAC;4BAED,OAAO,UAAU,CAAC;wBACpB,CAAC;6BAAM,CAAC;4BACN,mCAAmC;4BACnC,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;4BAChE,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;wBAC7E,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAClC,iCAAiC;QACjC,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACtD,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,YAAY,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,sCAAsC;YAC7F,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;gBAC/D,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;YAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;YAE5C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;gBACtF,OAAO,IAAI,CAAC,CAAC,uCAAuC;YACtD,CAAC;YAED,8BAA8B;YAC9B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,oCAAoC,EAAE;gBAClF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,eAAe,EAAE,UAAU,MAAM,EAAE;oBACnC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;aAChC,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,gCAAgC;gBAChC,IAAI,iBAAiB,EAAE,CAAC;oBACtB,MAAM,QAAQ,GAAG,YAAY,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;oBACtD,MAAM,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE;wBACzC,aAAa,EAAE,8BAA8B;qBAC9C,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;gBACzE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvD,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;gBACpE,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,6DAA6D,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC7F,OAAO,KAAK,CAAC,CAAC,2BAA2B;QAE3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,sDAAsD,EAAE,KAAK,CAAC,CAAC;YAC7E,OAAO,KAAK,CAAC,CAAC,wBAAwB;QACxC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,SAAkB,EAAE,KAAc,EAAE,QAAiB;QACzE,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACtD,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAEtD,IAAI,CAAC,iBAAiB;YAAE,OAAO;QAE/B,MAAM,SAAS,GAAoB,EAAE,CAAC;QAEtC,sBAAsB;QACtB,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,UAAU,GAAG,WAAW,SAAS,EAAE,CAAC;YAC1C,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACvD,CAAC;QAED,oBAAoB;QACpB,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,SAAS,QAAQ,aAAa,CAAC;YAChD,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,2BAA2B;QAC3B,IAAI,KAAK,IAAI,iBAAiB,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,YAAY,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YACtD,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;IAC1E,CAAC;CACF"}

package/dist/services/proof.service.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Proof Service
+ *
+ * Handles proof submission to AgentShield API with optional context
+ * for dashboard integration.
+ */
+import type { DetachedProof } from '@kya-os/contracts/proof';
+import type { CloudflareRuntimeConfig } from '../config';
+import type { CloudflareRuntime } from '../runtime';
+export interface ProofSubmissionContext {
+    session: {
+        id: string;
+    };
+    toolName: string;
+    args: Record<string, unknown>;
+    result: unknown;
+    mcpServerUrl?: string;
+}
+export declare class ProofService {
+    private config;
+    private runtime?;
+    constructor(config: CloudflareRuntimeConfig, runtime?: CloudflareRuntime);
+    /**
+     * Submit proof to AgentShield API
+     * Uses the proof.jws directly (full JWS format from CloudflareRuntime)
+     *
+     * Also submits optional context for AgentShield dashboard integration.
+     * Context provides plaintext tool/args data while proof provides cryptographic verification.
+     */
+    submitProof(proof: DetachedProof, context: ProofSubmissionContext): Promise<void>;
+}
+//# sourceMappingURL=proof.service.d.ts.map

package/dist/services/proof.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.service.d.ts","sourceRoot":"","sources":["../../src/services/proof.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAmB,MAAM,YAAY,CAAC;AAGrE,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,OAAO,CAAC,CAAoB;gBAExB,MAAM,EAAE,uBAAuB,EAAE,OAAO,CAAC,EAAE,iBAAiB;IAKxE;;;;;;OAMG;IACG,WAAW,CACf,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,IAAI,CAAC;CA6FjB"}

package/dist/services/proof.service.js

@@ -0,0 +1,95 @@
+/**
+ * Proof Service
+ *
+ * Handles proof submission to AgentShield API with optional context
+ * for dashboard integration.
+ */
+export class ProofService {
+    config;
+    runtime;
+    constructor(config, runtime) {
+        this.config = config;
+        this.runtime = runtime;
+    }
+    /**
+     * Submit proof to AgentShield API
+     * Uses the proof.jws directly (full JWS format from CloudflareRuntime)
+     *
+     * Also submits optional context for AgentShield dashboard integration.
+     * Context provides plaintext tool/args data while proof provides cryptographic verification.
+     */
+    async submitProof(proof, context) {
+        if (!proof.jws || !proof.meta) {
+            console.warn('[ProofService] Proof missing jws or meta, skipping submission');
+            return;
+        }
+        // Get AgentShield config from proofing config
+        const proofingConfig = this.config.proofing;
+        if (!proofingConfig?.enabled || !proofingConfig.batchQueue?.destinations) {
+            console.log('[ProofService] Proof submission disabled or no destinations configured');
+            return;
+        }
+        // Find AgentShield destination
+        const agentShieldDest = proofingConfig.batchQueue.destinations.find((dest) => dest.type === 'agentshield' && dest.apiKey);
+        if (!agentShieldDest || !agentShieldDest.apiKey || !agentShieldDest.apiUrl) {
+            console.log('[ProofService] No AgentShield destination configured');
+            return;
+        }
+        const apiUrl = agentShieldDest.apiUrl;
+        const apiKey = agentShieldDest.apiKey;
+        // Get tool call context from runtime (if available)
+        const toolCallContext = this.runtime?.getLastToolCallContext();
+        // Proof already has correct format from CloudflareRuntime
+        // Adding optional context for AgentShield dashboard (Option A architecture)
+        const requestBody = {
+            session_id: context.session.id,
+            delegation_id: null,
+            proofs: [{
+                    jws: proof.jws, // Already in full JWS format
+                    meta: proof.meta // Already has all required fields
+                }],
+            // Optional context for dashboard integration
+            context: {
+                toolCalls: toolCallContext ? [toolCallContext] : [{
+                        // Fallback if context not available from runtime
+                        tool: context.toolName,
+                        args: context.args,
+                        result: context.result,
+                        scopeId: proof.meta.scopeId || `${context.toolName}:execute`
+                    }],
+                // MCP server URL for tool discovery (optional, only needed once)
+                mcpServerUrl: context.mcpServerUrl
+            }
+        };
+        console.log('[ProofService] Submitting proof with context:', {
+            did: proof.meta.did,
+            sessionId: proof.meta.sessionId,
+            jwsFormat: proof.jws.split('.').length === 3 ? 'valid (3 parts)' : 'invalid',
+            contextTool: requestBody.context.toolCalls[0]?.tool,
+            contextScopeId: requestBody.context.toolCalls[0]?.scopeId,
+            mcpServerUrl: requestBody.context.mcpServerUrl || 'not-set'
+        });
+        const response = await fetch(`${apiUrl}/api/v1/bouncer/proofs`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Authorization': `Bearer ${apiKey}`
+            },
+            body: JSON.stringify(requestBody)
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            console.error('[ProofService] Submission failed:', response.status, errorText);
+            throw new Error(`AgentShield error: ${response.status}`);
+        }
+        const responseData = await response.json();
+        console.log('[ProofService] Response:', responseData);
+        if (responseData.accepted) {
+            console.log('[ProofService] ✅ Proofs accepted:', responseData.accepted);
+        }
+        if (responseData.rejected) {
+            console.log('[ProofService] ❌ Proofs rejected:', responseData.rejected);
+        }
+    }
+}
+//# sourceMappingURL=proof.service.js.map

package/dist/services/proof.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.service.js","sourceRoot":"","sources":["../../src/services/proof.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAeH,MAAM,OAAO,YAAY;IACf,MAAM,CAA0B;IAChC,OAAO,CAAqB;IAEpC,YAAY,MAA+B,EAAE,OAA2B;QACtE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CACf,KAAoB,EACpB,OAA+B;QAE/B,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QAED,8CAA8C;QAC9C,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5C,IAAI,CAAC,cAAc,EAAE,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC;YACzE,OAAO,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QAED,+BAA+B;QAC/B,MAAM,eAAe,GAAG,cAAc,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CACjE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,MAAM,CACrD,CAAC;QAEF,IAAI,CAAC,eAAe,IAAI,CAAC,eAAe,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;YAC3E,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC;QACtC,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC;QAEtC,oDAAoD;QACpD,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,EAAE,sBAAsB,EAAE,CAAC;QAE/D,0DAA0D;QAC1D,4EAA4E;QAC5E,MAAM,WAAW,GAAG;YAClB,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;YAC9B,aAAa,EAAE,IAAI;YACnB,MAAM,EAAE,CAAC;oBACP,GAAG,EAAE,KAAK,CAAC,GAAG,EAAG,6BAA6B;oBAC9C,IAAI,EAAE,KAAK,CAAC,IAAI,CAAE,kCAAkC;iBACrD,CAAC;YACF,6CAA6C;YAC7C,OAAO,EAAE;gBACP,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;wBAChD,iDAAiD;wBACjD,IAAI,EAAE,OAAO,CAAC,QAAQ;wBACtB,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,GAAG,OAAO,CAAC,QAAQ,UAAU;qBAC7D,CAAC;gBACF,iEAAiE;gBACjE,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC;SACF,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,+CAA+C,EAAE;YAC3D,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG;YACnB,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;YAC/B,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;YAC5E,WAAW,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI;YACnD,cAAc,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO;YACzD,YAAY,EAAE,WAAW,CAAC,OAAO,CAAC,YAAY,IAAI,SAAS;SAC5D,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,wBAAwB,EAAE;YAC9D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,eAAe,EAAE,UAAU,MAAM,EAAE;aACpC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAOvC,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,YAAY,CAAC,CAAC;QAEtD,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,mCAAmC,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,mCAAmC,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;CACF"}

package/dist/types.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Shared type definitions for @kya-os/mcp-i-cloudflare
+ *
+ * These types are separated to avoid circular dependencies.
+ */
+import type { KVNamespace, DurableObjectState } from '@cloudflare/workers-types';
+/**
+ * Cloudflare environment bindings for MCP-I
+ */
+export interface CloudflareEnv {
+    NONCE_CACHE: KVNamespace;
+    PROOF_ARCHIVE?: KVNamespace;
+    IDENTITY_STORAGE?: KVNamespace;
+    TOOL_PROTECTION_KV?: KVNamespace;
+    DELEGATION_STORAGE?: KVNamespace;
+    MCP_IDENTITY_PRIVATE_KEY?: string;
+    MCP_IDENTITY_PUBLIC_KEY?: string;
+    MCP_IDENTITY_AGENT_DID?: string;
+    MCP_SERVER_URL?: string;
+    AGENTSHIELD_API_URL?: string;
+    AGENTSHIELD_API_KEY?: string;
+    AGENTSHIELD_PROJECT_ID?: string;
+    MCPI_ENV?: string;
+    ENVIRONMENT?: string;
+    _durableObjectState?: DurableObjectState;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEjF;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,WAAW,CAAC;IACzB,aAAa,CAAC,EAAE,WAAW,CAAC;IAC5B,gBAAgB,CAAC,EAAE,WAAW,CAAC;IAC/B,kBAAkB,CAAC,EAAE,WAAW,CAAC;IACjC,kBAAkB,CAAC,EAAE,WAAW,CAAC;IACjC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;CAC1C"}

package/dist/types.js

@@ -0,0 +1,7 @@
+/**
+ * Shared type definitions for @kya-os/mcp-i-cloudflare
+ *
+ * These types are separated to avoid circular dependencies.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}