@kya-os/mcp-i-cloudflare 1.4.1-canary.1 → 1.4.1-canary.11

package/dist/services/consent.service.js

@@ -2,46 +2,401 @@
  * Consent Service
  *
  * Handles consent page rendering and approval handling.
- * Structure only - full implementation in Phase 0.
+ * Complete implementation for Phase 0.
+ *
+ * Related Spec: MCP-I Phase 0 Implementation Plan, Task B.5
  */
+import { ConsentConfigService } from './consent-config.service';
+import { ConsentPageRenderer } from './consent-page-renderer';
+import { DEFAULT_AGENTSHIELD_URL, DEFAULT_SESSION_CACHE_TTL } from '../constants';
+import { validateConsentApprovalRequest, } from '@kya-os/contracts/consent';
+import { AGENTSHIELD_ENDPOINTS } from '@kya-os/contracts/agentshield-api';
 export class ConsentService {
+    configService;
+    renderer;
+    env;
+    runtime;
+    constructor(env, runtime) {
+        this.env = env;
+        this.runtime = runtime;
+        this.configService = new ConsentConfigService(env);
+        this.renderer = new ConsentPageRenderer();
+    }
     /**
      * Handle consent requests
+     *
+     * Routes:
+     * - GET /consent - Render consent page
+     * - POST /consent/approve - Handle approval
+     * - GET /consent/success - Success page
+     *
      * @param request - Incoming request
      * @returns Response
      */
     async handle(request) {
         const url = new URL(request.url);
-        if (request.method === 'GET') {
-            // Render consent page
-            return this.renderConsentPage(url.searchParams);
+        // GET /consent - Render page
+        if (request.method === 'GET' && url.pathname === '/consent') {
+            return this.renderConsentPage(url.searchParams, request);
         }
-        if (request.method === 'POST') {
-            // Handle approval
+        // POST /consent/approve - Handle approval
+        if (request.method === 'POST' && url.pathname === '/consent/approve') {
             return this.handleApproval(request);
         }
+        // GET /consent/success - Success page
+        if (request.method === 'GET' && url.pathname === '/consent/success') {
+            return this.renderSuccessPage(url.searchParams);
+        }
         return new Response('Method not allowed', { status: 405 });
     }
     /**
      * Render consent page
-     * TODO: Implement in Phase 0
+     *
+     * Query parameters:
+     * - tool: Tool name
+     * - scopes: Comma-separated scopes
+     * - agent_did: Agent DID
+     * - session_id: Session ID
+     * - project_id: Project ID
+     *
+     * @param params - URL search parameters
+     * @param request - Original request (for extracting origin)
+     * @returns HTML response
      */
-    async renderConsentPage(params) {
-        // Placeholder - will be implemented in Phase 0
-        return new Response('Consent page - Phase 0 implementation', {
-            status: 501,
-            headers: { 'Content-Type': 'text/plain' }
-        });
+    async renderConsentPage(params, request) {
+        try {
+            // Extract required parameters
+            const tool = params.get('tool');
+            const scopesParam = params.get('scopes');
+            const agentDid = params.get('agent_did');
+            const sessionId = params.get('session_id');
+            const projectId = params.get('project_id');
+            // Validate required parameters
+            if (!tool || !agentDid || !sessionId || !projectId) {
+                return new Response(JSON.stringify({
+                    success: false,
+                    error: 'Missing required parameters',
+                    error_code: 'missing_parameters',
+                }), {
+                    status: 400,
+                    headers: { 'Content-Type': 'application/json' },
+                });
+            }
+            // Parse scopes
+            const scopes = scopesParam ? scopesParam.split(',').map((s) => s.trim()) : [];
+            // Get tool description (try to fetch from runtime or use default)
+            let toolDescription = `Execute ${tool}`;
+            if (this.runtime) {
+                try {
+                    // Try to get tool description from runtime if available
+                    // This is a placeholder - actual implementation depends on runtime API
+                    toolDescription = `Execute ${tool} with requested permissions`;
+                }
+                catch {
+                    // Fallback to default
+                }
+            }
+            // Get consent config from AgentShield or defaults
+            const consentConfig = await this.configService.getConsentConfig(projectId);
+            // Build server URL from request origin
+            // Priority: 1) env var, 2) request origin, 3) error if neither available
+            let serverUrl = this.env.MCP_SERVER_URL;
+            if (!serverUrl) {
+                // Extract origin from request URL
+                const requestUrl = new URL(request.url);
+                serverUrl = requestUrl.origin;
+                // Validate that we have a valid origin
+                if (!serverUrl || serverUrl === 'null' || !serverUrl.startsWith('http')) {
+                    return new Response(JSON.stringify({
+                        success: false,
+                        error: 'Cannot determine server URL. Please set MCP_SERVER_URL environment variable.',
+                        error_code: 'server_url_required',
+                    }), {
+                        status: 500,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+            }
+            // Build consent page config
+            const pageConfig = {
+                tool,
+                toolDescription,
+                scopes,
+                agentDid,
+                sessionId,
+                projectId,
+                serverUrl,
+                branding: consentConfig.branding,
+                terms: consentConfig.terms,
+                customFields: consentConfig.customFields,
+                autoClose: consentConfig.ui?.autoClose,
+            };
+            // Render page
+            const html = this.renderer.render(pageConfig);
+            return new Response(html, {
+                status: 200,
+                headers: {
+                    'Content-Type': 'text/html; charset=utf-8',
+                    'Cache-Control': 'no-cache, no-store, must-revalidate',
+                },
+            });
+        }
+        catch (error) {
+            console.error('[ConsentService] Error rendering consent page:', error);
+            return new Response(JSON.stringify({
+                success: false,
+                error: 'Failed to render consent page',
+                error_code: 'render_error',
+            }), {
+                status: 500,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
     }
     /**
      * Handle consent approval
-     * TODO: Implement in Phase 0
+     *
+     * Validates request, creates delegation via AgentShield API,
+     * stores token in KV, and returns success response.
+     *
+     * @param request - Approval request
+     * @returns JSON response
      */
     async handleApproval(request) {
-        // Placeholder - will be implemented in Phase 0
-        return new Response('Consent approval - Phase 0 implementation', {
-            status: 501,
-            headers: { 'Content-Type': 'text/plain' }
+        try {
+            // Parse and validate request body
+            const body = await request.json();
+            const validation = validateConsentApprovalRequest(body);
+            if (!validation.success) {
+                return new Response(JSON.stringify({
+                    success: false,
+                    error: 'Invalid request',
+                    error_code: 'validation_error',
+                    details: validation.error.errors,
+                }), {
+                    status: 400,
+                    headers: { 'Content-Type': 'application/json' },
+                });
+            }
+            const approvalRequest = validation.data;
+            // Validate terms acceptance if required
+            const consentConfig = await this.configService.getConsentConfig(approvalRequest.project_id);
+            if (consentConfig.terms?.required && !approvalRequest.termsAccepted) {
+                return new Response(JSON.stringify({
+                    success: false,
+                    error: 'Terms and conditions must be accepted',
+                    error_code: 'terms_not_accepted',
+                }), {
+                    status: 400,
+                    headers: { 'Content-Type': 'application/json' },
+                });
+            }
+            // Create delegation via AgentShield API
+            const delegationResult = await this.createDelegation(approvalRequest);
+            if (!delegationResult.success) {
+                return new Response(JSON.stringify({
+                    success: false,
+                    error: delegationResult.error || 'Failed to create delegation',
+                    error_code: delegationResult.error_code || 'delegation_creation_failed',
+                }), {
+                    status: 500,
+                    headers: { 'Content-Type': 'application/json' },
+                });
+            }
+            // Store delegation token in KV
+            await this.storeDelegationToken(approvalRequest.session_id, approvalRequest.agent_did, delegationResult.delegation_token, delegationResult.delegation_id);
+            // Return success response
+            const response = {
+                success: true,
+                delegation_id: delegationResult.delegation_id,
+                delegation_token: delegationResult.delegation_token,
+            };
+            return new Response(JSON.stringify(response), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        catch (error) {
+            console.error('[ConsentService] Error handling approval:', error);
+            return new Response(JSON.stringify({
+                success: false,
+                error: 'Internal server error',
+                error_code: 'internal_error',
+            }), {
+                status: 500,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+    }
+    /**
+     * Create delegation via AgentShield API
+     *
+     * @param request - Approval request
+     * @returns Delegation creation result
+     */
+    async createDelegation(request) {
+        const agentShieldUrl = this.env.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
+        const apiKey = this.env.AGENTSHIELD_API_KEY;
+        if (!apiKey) {
+            console.warn('[ConsentService] No API key configured, cannot create delegation');
+            return {
+                success: false,
+                error: 'API key not configured',
+                error_code: 'api_key_missing',
+            };
+        }
+        try {
+            // Calculate expiration (7 days from now)
+            const expiresAt = new Date();
+            expiresAt.setDate(expiresAt.getDate() + 7);
+            const expiresAtISO = expiresAt.toISOString();
+            // Create delegation request
+            // Note: AgentShield API may accept a simplified format for consent flows
+            // This is a simplified version - adjust based on actual API requirements
+            const delegationRequest = {
+                agent_did: request.agent_did,
+                scopes: request.scopes,
+                session_id: request.session_id,
+                project_id: request.project_id,
+                expires_at: expiresAtISO,
+                // Include custom fields if provided
+                ...(request.customFields && Object.keys(request.customFields).length > 0
+                    ? { custom_fields: request.customFields }
+                    : {}),
+            };
+            const response = await fetch(`${agentShieldUrl}${AGENTSHIELD_ENDPOINTS.DELEGATIONS_CREATE}`, {
+                method: 'POST',
+                headers: {
+                    'Authorization': `Bearer ${apiKey}`,
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify(delegationRequest),
+            });
+            if (!response.ok) {
+                const errorText = await response.text();
+                console.error('[ConsentService] Delegation creation failed:', response.status, errorText);
+                return {
+                    success: false,
+                    error: `API error: ${response.status}`,
+                    error_code: 'api_error',
+                };
+            }
+            const responseData = (await response.json());
+            // Extract delegation_id and delegation_token from response
+            // Response format may vary - handle both wrapped and unwrapped formats
+            const delegationId = responseData.delegation_id ||
+                responseData.data?.delegation_id ||
+                responseData.delegation?.id ||
+                responseData.id;
+            const delegationToken = responseData.delegation_token ||
+                responseData.data?.delegation_token ||
+                responseData.token ||
+                responseData.data?.token;
+            if (!delegationId || !delegationToken) {
+                console.error('[ConsentService] Invalid response format:', responseData);
+                return {
+                    success: false,
+                    error: 'Invalid API response format',
+                    error_code: 'invalid_response',
+                };
+            }
+            console.log('[ConsentService] ✅ Delegation created successfully:', {
+                delegationId,
+                agentDid: request.agent_did.substring(0, 20) + '...',
+                scopes: request.scopes,
+            });
+            return {
+                success: true,
+                delegation_id: delegationId,
+                delegation_token: delegationToken,
+            };
+        }
+        catch (error) {
+            console.error('[ConsentService] Error creating delegation:', error);
+            return {
+                success: false,
+                error: error instanceof Error ? error.message : 'Unknown error',
+                error_code: 'creation_error',
+            };
+        }
+    }
+    /**
+     * Store delegation token in KV
+     *
+     * Stores token using both session ID and agent DID keys for resilience.
+     *
+     * @param sessionId - Session ID
+     * @param agentDid - Agent DID
+     * @param token - Delegation token
+     * @param delegationId - Delegation ID
+     */
+    async storeDelegationToken(sessionId, agentDid, token, delegationId) {
+        const delegationStorage = this.env.DELEGATION_STORAGE;
+        if (!delegationStorage) {
+            console.warn('[ConsentService] No delegation storage configured, token not stored');
+            return;
+        }
+        try {
+            // Default TTL: 7 days (same as delegation expiration)
+            const ttl = 7 * 24 * 60 * 60; // 7 days in seconds
+            // Store using agent DID (primary, survives session changes)
+            const agentKey = `agent:${agentDid}:delegation`;
+            await delegationStorage.put(agentKey, token, {
+                expirationTtl: ttl,
+            });
+            console.log('[ConsentService] ✅ Token stored with agent DID:', {
+                key: agentKey,
+                ttl,
+                delegationId,
+            });
+            // Store using session ID (secondary cache, shorter TTL for performance)
+            const sessionKey = `session:${sessionId}`;
+            await delegationStorage.put(sessionKey, token, {
+                expirationTtl: Math.min(ttl, DEFAULT_SESSION_CACHE_TTL),
+            });
+            console.log('[ConsentService] ✅ Token cached for session:', {
+                key: sessionKey,
+                ttl: Math.min(ttl, DEFAULT_SESSION_CACHE_TTL),
+                sessionId,
+            });
+        }
+        catch (error) {
+            // Storage errors are non-fatal - log but don't fail the request
+            console.error('[ConsentService] Storage error (non-fatal):', error);
+        }
+    }
+    /**
+     * Render success page
+     *
+     * @param params - URL search parameters (delegation_id)
+     * @returns HTML response
+     */
+    async renderSuccessPage(params) {
+        const delegationId = params.get('delegation_id') || 'unknown';
+        // Get consent config to check auto-close setting
+        const projectId = params.get('project_id');
+        let autoClose = false;
+        if (projectId) {
+            try {
+                // Await config fetch to ensure autoClose is set before rendering
+                const config = await this.configService.getConsentConfig(projectId);
+                autoClose = config.ui?.autoClose || false;
+            }
+            catch (error) {
+                // Ignore errors, use default (autoClose = false)
+                console.warn('[ConsentService] Failed to fetch config for autoClose:', error);
+            }
+        }
+        const html = this.renderer.renderSuccess({
+            delegationId,
+            autoClose,
+        });
+        return new Response(html, {
+            status: 200,
+            headers: {
+                'Content-Type': 'text/html; charset=utf-8',
+                'Cache-Control': 'no-cache, no-store, must-revalidate',
+            },
         });
     }
 }

package/dist/services/consent.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"consent.service.js","sourceRoot":"","sources":["../../src/services/consent.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,OAAO,cAAc;IACzB;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,OAAgB;QAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,sBAAsB;YACtB,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,kBAAkB;YAClB,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,iBAAiB,CAAC,MAAuB;QACrD,+CAA+C;QAC/C,OAAO,IAAI,QAAQ,CAAC,uCAAuC,EAAE;YAC3D,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;SAC1C,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc,CAAC,OAAgB;QAC3C,+CAA+C;QAC/C,OAAO,IAAI,QAAQ,CAAC,2CAA2C,EAAE;YAC/D,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;SAC1C,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"consent.service.js","sourceRoot":"","sources":["../../src/services/consent.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAMlF,OAAO,EAEL,8BAA8B,GAC/B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,MAAM,OAAO,cAAc;IACjB,aAAa,CAAuB;IACpC,QAAQ,CAAsB;IAC9B,GAAG,CAAgB;IACnB,OAAO,CAAqB;IAEpC,YAAY,GAAkB,EAAE,OAA2B;QACzD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,aAAa,GAAG,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,GAAG,IAAI,mBAAmB,EAAE,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CAAC,OAAgB;QAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEjC,6BAA6B;QAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC3D,CAAC;QAED,0CAA0C;QAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QAED,sCAAsC;QACtC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;YACpE,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,KAAK,CAAC,iBAAiB,CAAC,MAAuB,EAAE,OAAgB;QACvE,IAAI,CAAC;YACH,8BAA8B;YAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACzC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAE3C,+BAA+B;YAC/B,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnD,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,6BAA6B;oBACpC,UAAU,EAAE,oBAAoB;iBACjC,CAAC,EACF;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CACF,CAAC;YACJ,CAAC;YAED,eAAe;YACf,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAE9E,kEAAkE;YAClE,IAAI,eAAe,GAAG,WAAW,IAAI,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,wDAAwD;oBACxD,uEAAuE;oBACvE,eAAe,GAAG,WAAW,IAAI,6BAA6B,CAAC;gBACjE,CAAC;gBAAC,MAAM,CAAC;oBACP,sBAAsB;gBACxB,CAAC;YACH,CAAC;YAED,kDAAkD;YAClD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAE3E,uCAAuC;YACvC,yEAAyE;YACzE,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;YACxC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,kCAAkC;gBAClC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACxC,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC;gBAE9B,uCAAuC;gBACvC,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxE,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;wBACb,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,8EAA8E;wBACrF,UAAU,EAAE,qBAAqB;qBAClC,CAAC,EACF;wBACE,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;qBAChD,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,4BAA4B;YAC5B,MAAM,UAAU,GAAsB;gBACpC,IAAI;gBACJ,eAAe;gBACf,MAAM;gBACN,QAAQ;gBACR,SAAS;gBACT,SAAS;gBACT,SAAS;gBACT,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,KAAK,EAAE,aAAa,CAAC,KAAK;gBAC1B,YAAY,EAAE,aAAa,CAAC,YAAY;gBACxC,SAAS,EAAE,aAAa,CAAC,EAAE,EAAE,SAAS;aACvC,CAAC;YAEF,cAAc;YACd,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAE9C,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,0BAA0B;oBAC1C,eAAe,EAAE,qCAAqC;iBACvD;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAAC;YACvE,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,+BAA+B;gBACtC,UAAU,EAAE,cAAc;aAC3B,CAAC,EACF;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,cAAc,CAAC,OAAgB;QAC3C,IAAI,CAAC;YACH,kCAAkC;YAClC,MAAM,IAAI,GAAY,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YAC3C,MAAM,UAAU,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;YAExD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,iBAAiB;oBACxB,UAAU,EAAE,kBAAkB;oBAC9B,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM;iBACjC,CAAC,EACF;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CACF,CAAC;YACJ,CAAC;YAED,MAAM,eAAe,GAA2B,UAAU,CAAC,IAAI,CAAC;YAEhE,wCAAwC;YACxC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YAC5F,IAAI,aAAa,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,CAAC;gBACpE,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,uCAAuC;oBAC9C,UAAU,EAAE,oBAAoB;iBACjC,CAAC,EACF;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CACF,CAAC;YACJ,CAAC;YAED,wCAAwC;YACxC,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;YAEtE,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;gBAC9B,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,gBAAgB,CAAC,KAAK,IAAI,6BAA6B;oBAC9D,UAAU,EAAE,gBAAgB,CAAC,UAAU,IAAI,4BAA4B;iBACxE,CAAC,EACF;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CACF,CAAC;YACJ,CAAC;YAED,+BAA+B;YAC/B,MAAM,IAAI,CAAC,oBAAoB,CAC7B,eAAe,CAAC,UAAU,EAC1B,eAAe,CAAC,SAAS,EACzB,gBAAgB,CAAC,gBAAiB,EAClC,gBAAgB,CAAC,aAAc,CAChC,CAAC;YAEF,0BAA0B;YAC1B,MAAM,QAAQ,GAA4B;gBACxC,OAAO,EAAE,IAAI;gBACb,aAAa,EAAE,gBAAgB,CAAC,aAAc;gBAC9C,gBAAgB,EAAE,gBAAgB,CAAC,gBAAiB;aACrD,CAAC;YAEF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;gBAC5C,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;YAClE,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,uBAAuB;gBAC9B,UAAU,EAAE,gBAAgB;aAC7B,CAAC,EACF;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,gBAAgB,CAC5B,OAA+B;QAE/B,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;QAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAE5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;YACjF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,wBAAwB;gBAC/B,UAAU,EAAE,iBAAiB;aAC9B,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,yCAAyC;YACzC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;YAC7B,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3C,MAAM,YAAY,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;YAE7C,4BAA4B;YAC5B,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,iBAAiB,GAAG;gBACxB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,UAAU,EAAE,YAAY;gBACxB,oCAAoC;gBACpC,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC;oBACtE,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,YAAY,EAAE;oBACzC,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;YAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,GAAG,qBAAqB,CAAC,kBAAkB,EAAE,EAAE;gBAC3F,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,eAAe,EAAE,UAAU,MAAM,EAAE;oBACnC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC;aACxC,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBAC1F,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,cAAc,QAAQ,CAAC,MAAM,EAAE;oBACtC,UAAU,EAAE,WAAW;iBACxB,CAAC;YACJ,CAAC;YAED,MAAM,YAAY,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;YAExE,2DAA2D;YAC3D,uEAAuE;YACvE,MAAM,YAAY,GACf,YAAY,CAAC,aAAoC;gBAChD,YAAY,CAAC,IAAgC,EAAE,aAAoC;gBACnF,YAAY,CAAC,UAAsC,EAAE,EAAyB;gBAC/E,YAAY,CAAC,EAAyB,CAAC;YAE1C,MAAM,eAAe,GAClB,YAAY,CAAC,gBAAuC;gBACnD,YAAY,CAAC,IAAgC,EAAE,gBAAuC;gBACvF,YAAY,CAAC,KAA4B;gBACxC,YAAY,CAAC,IAAgC,EAAE,KAA4B,CAAC;YAEhF,IAAI,CAAC,YAAY,IAAI,CAAC,eAAe,EAAE,CAAC;gBACtC,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,YAAY,CAAC,CAAC;gBACzE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,6BAA6B;oBACpC,UAAU,EAAE,kBAAkB;iBAC/B,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,qDAAqD,EAAE;gBACjE,YAAY;gBACZ,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACpD,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,aAAa,EAAE,YAAY;gBAC3B,gBAAgB,EAAE,eAAe;aAClC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;YACpE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;gBAC/D,UAAU,EAAE,gBAAgB;aAC7B,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,oBAAoB,CAChC,SAAiB,EACjB,QAAgB,EAChB,KAAa,EACb,YAAoB;QAEpB,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAEtD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,sDAAsD;YACtD,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,oBAAoB;YAElD,4DAA4D;YAC5D,MAAM,QAAQ,GAAG,SAAS,QAAQ,aAAa,CAAC;YAChD,MAAM,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE;gBAC3C,aAAa,EAAE,GAAG;aACnB,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,iDAAiD,EAAE;gBAC7D,GAAG,EAAE,QAAQ;gBACb,GAAG;gBACH,YAAY;aACb,CAAC,CAAC;YAEH,wEAAwE;YACxE,MAAM,UAAU,GAAG,WAAW,SAAS,EAAE,CAAC;YAC1C,MAAM,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE;gBAC7C,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,yBAAyB,CAAC;aACxD,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,8CAA8C,EAAE;gBAC1D,GAAG,EAAE,UAAU;gBACf,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,yBAAyB,CAAC;gBAC7C,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gEAAgE;YAChE,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,iBAAiB,CAAC,MAAuB;QACrD,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC;QAE9D,iDAAiD;QACjD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,SAAS,GAAG,KAAK,CAAC;QAEtB,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,iEAAiE;gBACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBACpE,SAAS,GAAG,MAAM,CAAC,EAAE,EAAE,SAAS,IAAI,KAAK,CAAC;YAC5C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,iDAAiD;gBACjD,OAAO,CAAC,IAAI,CAAC,wDAAwD,EAAE,KAAK,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;YACvC,YAAY;YACZ,SAAS;SACV,CAAC,CAAC;QAEH,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,0BAA0B;gBAC1C,eAAe,EAAE,qCAAqC;aACvD;SACF,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/services/proof-batch-queue.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Proof Batch Queue (Cloudflare Workers Implementation)
+ *
+ * Platform-agnostic proof batching for Cloudflare Workers.
+ * Copied from @kya-os/mcp-i to avoid pulling in @swc/core dependency.
+ *
+ * Collects proofs in memory and submits them in batches to AgentShield.
+ * This prevents blocking tool execution while ensuring proofs are eventually submitted.
+ *
+ * Performance:
+ * - Batch size: 10 proofs (configurable)
+ * - Flush interval: 5 seconds (configurable)
+ * - Fire-and-forget submission (doesn't block tool execution)
+ *
+ * Retry Strategy:
+ * - Exponential backoff: 1s, 2s, 4s, 8s, 16s
+ * - Max retries: 5
+ * - Failed proofs logged and dropped after max retries
+ */
+import type { DetachedProof } from '@kya-os/contracts/proof';
+/**
+ * Proof submission destination
+ */
+export interface ProofDestination {
+    /** Destination name (for logging) */
+    name: string;
+    /** Submit batch of proofs */
+    submit(proofs: DetachedProof[]): Promise<void>;
+}
+/**
+ * AgentShield proof submission destination
+ *
+ * Submits proofs to AgentShield's /api/v1/bouncer/proofs endpoint
+ * with proper authentication and session grouping.
+ */
+export declare class AgentShieldProofDestination implements ProofDestination {
+    name: string;
+    private apiUrl;
+    private apiKey;
+    constructor(apiUrl: string, apiKey: string);
+    submit(proofs: DetachedProof[]): Promise<void>;
+}
+/**
+ * Proof batch queue configuration
+ */
+export interface ProofBatchQueueConfig {
+    /** Destinations to submit proofs to */
+    destinations: ProofDestination[];
+    /** Maximum batch size before auto-flush */
+    maxBatchSize?: number;
+    /** Flush interval in milliseconds (not used in Cloudflare Workers - rely on cron) */
+    flushIntervalMs?: number;
+    /** Maximum retry attempts for failed batches */
+    maxRetries?: number;
+    /** Enable debug logging */
+    debug?: boolean;
+}
+/**
+ * Proof Batch Queue
+ *
+ * Collects proofs and submits them in batches to multiple destinations.
+ *
+ * Note: In Cloudflare Workers, timers don't persist across requests,
+ * so automatic flush timers are disabled. Use manual flush() calls via cron jobs.
+ */
+export declare class ProofBatchQueue {
+    private queue;
+    private pendingBatches;
+    private config;
+    private closed;
+    private stats;
+    constructor(config: ProofBatchQueueConfig);
+    /**
+     * Add proof to queue
+     */
+    enqueue(proof: DetachedProof): void;
+    /**
+     * Flush queue immediately (submit all queued proofs)
+     */
+    flush(): Promise<void>;
+    /**
+     * Submit batch to destination (with retries)
+     */
+    private submitBatch;
+    /**
+     * Retry pending batches that are ready
+     * Called by cron job or manually
+     */
+    retryPending(): Promise<void>;
+    /**
+     * Close queue and flush remaining proofs
+     */
+    close(): Promise<void>;
+    /**
+     * Get queue statistics
+     */
+    getStats(): {
+        queued: number;
+        submitted: number;
+        failed: number;
+        batchesSubmitted: number;
+    };
+}
+//# sourceMappingURL=proof-batch-queue.d.ts.map

package/dist/services/proof-batch-queue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-batch-queue.d.ts","sourceRoot":"","sources":["../../src/services/proof-batch-queue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE7D;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IAEb,6BAA6B;IAC7B,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,YAAW,gBAAgB;IAClE,IAAI,SAAiB;IACrB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,MAAM,CAAS;gBAEX,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAKpC,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAiCrD;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,uCAAuC;IACvC,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AASD;;;;;;;GAOG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,cAAc,CAAoB;IAC1C,OAAO,CAAC,MAAM,CAAkC;IAChD,OAAO,CAAC,MAAM,CAAS;IAGvB,OAAO,CAAC,KAAK,CAKX;gBAEU,MAAM,EAAE,qBAAqB;IAazC;;OAEG;IACH,OAAO,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI;IAmBnC;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAuB5B;;OAEG;YACW,WAAW;IAyCzB;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAmBnC;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA4B5B;;OAEG;IACH,QAAQ;;;;;;CAGT"}