@kya-os/mcp-i 1.12.3 → 1.13.0

package/dist/runtime/{delegation-verifier-agentshield.d.ts → delegation-verifier-checkpoint.d.ts}

@@ -1,13 +1,14 @@
 /**
- * AgentShield API Delegation Verifier
+ * Checkpoint API Delegation Verifier
  *
- * Queries delegations from AgentShield managed service API.
- * Includes local caching to minimize network calls and maximize performance.
+ * Queries delegations from Checkpoint managed service API.
+ * No verdict is cached: every verification asks Checkpoint, so a revocation
+ * refuses the very next call and a delegation granted (or replaced) after a
+ * refusal is accepted on the next call. `cacheTtl`, `skipCache` and
+ * `maxCacheAge` therefore have no effect on this verifier.
  *
  * Performance:
- * - Fast path (cached): < 5ms
- * - Slow path (API call): < 100ms
- * - Cache TTL: 1 minute (configurable)
+ * - API call: < 100ms
  *
  * API Endpoints:
  * - POST /api/v1/delegations/verify - Verify delegation by agent DID + scopes
@@ -18,20 +19,18 @@
  * Authentication: Bearer token via X-API-Key header
  *
  * Related: PHASE_1_XMCP_I_SERVER.md Ticket 1.3
- * Related: AGENTSHIELD_DASHBOARD_PLAN.md Epic 2 (Public API)
+ * Related: CHECKPOINT_DASHBOARD_PLAN.md Epic 2 (Public API)
  */
 import { DelegationRecord } from "@kya-os/contracts/delegation";
 import { DelegationVerifier, DelegationVerifierConfig, VerifyDelegationResult, VerifyDelegationOptions } from "./delegation-verifier";
 /**
- * AgentShield API Delegation Verifier
+ * Checkpoint API Delegation Verifier
  *
- * Managed mode: Queries delegations from AgentShield dashboard API
+ * Managed mode: Queries delegations from Checkpoint dashboard API
  */
-export declare class AgentShieldAPIDelegationVerifier implements DelegationVerifier {
+export declare class CheckpointAPIDelegationVerifier implements DelegationVerifier {
     private apiUrl;
     private apiKey;
-    private cache;
-    private cacheTtl;
     private debug;
     private accessControlService;
     constructor(config: DelegationVerifierConfig);
@@ -46,7 +45,7 @@ export declare class AgentShieldAPIDelegationVerifier implements DelegationVerif
     /**
      * Store delegation (admin operation via API)
      *
-     * Note: This is typically done via AgentShield dashboard UI,
+     * Note: This is typically done via Checkpoint dashboard UI,
      * not by the bouncer directly. Included for completeness.
      */
     put(delegation: DelegationRecord): Promise<void>;
@@ -55,11 +54,7 @@ export declare class AgentShieldAPIDelegationVerifier implements DelegationVerif
      */
     revoke(delegationId: string, reason?: string): Promise<void>;
     /**
-     * Close connections (cleanup)
+     * Close connections (cleanup). The verifier holds no cache or connection.
      */
     close(): Promise<void>;
-    /**
-     * Build deterministic scopes key for caching
-     */
-    private buildScopesKey;
 }

package/dist/runtime/{delegation-verifier-agentshield.js → delegation-verifier-checkpoint.js}

@@ -1,14 +1,15 @@
 "use strict";
 /**
- * AgentShield API Delegation Verifier
+ * Checkpoint API Delegation Verifier
  *
- * Queries delegations from AgentShield managed service API.
- * Includes local caching to minimize network calls and maximize performance.
+ * Queries delegations from Checkpoint managed service API.
+ * No verdict is cached: every verification asks Checkpoint, so a revocation
+ * refuses the very next call and a delegation granted (or replaced) after a
+ * refusal is accepted on the next call. `cacheTtl`, `skipCache` and
+ * `maxCacheAge` therefore have no effect on this verifier.
  *
  * Performance:
- * - Fast path (cached): < 5ms
- * - Slow path (API call): < 100ms
- * - Cache TTL: 1 minute (configurable)
+ * - API call: < 100ms
  *
  * API Endpoints:
  * - POST /api/v1/delegations/verify - Verify delegation by agent DID + scopes
@@ -19,74 +20,38 @@
  * Authentication: Bearer token via X-API-Key header
  *
  * Related: PHASE_1_XMCP_I_SERVER.md Ticket 1.3
- * Related: AGENTSHIELD_DASHBOARD_PLAN.md Epic 2 (Public API)
+ * Related: CHECKPOINT_DASHBOARD_PLAN.md Epic 2 (Public API)
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AgentShieldAPIDelegationVerifier = void 0;
+exports.CheckpointAPIDelegationVerifier = void 0;
 const delegation_1 = require("@kya-os/contracts/delegation");
+// The former subpath on purpose: it is in every contracts release mcp-i's range
+// allows (^1.12.4), while "@kya-os/contracts/checkpoint-api" is only in releases
+// from this rename on. Its AgentShieldAPIError is CheckpointAPIError there. Move
+// to "@kya-os/contracts/checkpoint-api" once mcp-i requires such a release.
 const agentshield_api_1 = require("@kya-os/contracts/agentshield-api");
 const delegation_verifier_1 = require("./delegation-verifier");
 // C4 drain: stays on @kya-os/mcp-i-core - the test vi.mocks that specifier; source import + mock must drain together in L-Node-tests.
 const mcp_i_core_1 = require("@kya-os/mcp-i-core");
 const node_providers_1 = require("../providers/node-providers");
+// Use standard Checkpoint API response types from contracts
 /**
- * Simple in-memory cache (same as KV verifier)
- */
-class DelegationCache {
-    cache = new Map();
-    maxSize;
-    constructor(maxSize = 1000) {
-        this.maxSize = maxSize;
-    }
-    get(key) {
-        const entry = this.cache.get(key);
-        if (!entry)
-            return null;
-        if (Date.now() > entry.expiresAt) {
-            this.cache.delete(key);
-            return null;
-        }
-        return entry.data;
-    }
-    set(key, data, ttlMs) {
-        if (this.cache.size >= this.maxSize) {
-            const firstKey = this.cache.keys().next().value;
-            if (firstKey)
-                this.cache.delete(firstKey);
-        }
-        this.cache.set(key, {
-            data,
-            expiresAt: Date.now() + ttlMs,
-        });
-    }
-    delete(key) {
-        this.cache.delete(key);
-    }
-    clear() {
-        this.cache.clear();
-    }
-}
-// Use standard AgentShield API response types from contracts
-/**
- * AgentShield API Delegation Verifier
+ * Checkpoint API Delegation Verifier
  *
- * Managed mode: Queries delegations from AgentShield dashboard API
+ * Managed mode: Queries delegations from Checkpoint dashboard API
  */
-class AgentShieldAPIDelegationVerifier {
+class CheckpointAPIDelegationVerifier {
     apiUrl;
     apiKey;
-    cache;
-    cacheTtl;
     debug;
     accessControlService;
     constructor(config) {
-        if (!config.agentshield?.apiUrl || !config.agentshield?.apiKey) {
-            throw new Error("AgentShieldAPIDelegationVerifier requires agentshield.apiUrl and agentshield.apiKey in config");
+        const checkpoint = config.checkpoint ?? config.agentshield;
+        if (!checkpoint?.apiUrl || !checkpoint?.apiKey) {
+            throw new Error("CheckpointAPIDelegationVerifier requires checkpoint.apiUrl and checkpoint.apiKey in config");
         }
-        this.apiUrl = config.agentshield.apiUrl.replace(/\/$/, ""); // Remove trailing slash
-        this.apiKey = config.agentshield.apiKey;
-        this.cache = new DelegationCache();
-        this.cacheTtl = config.cacheTtl || 60_000; // Default 1 minute
+        this.apiUrl = checkpoint.apiUrl.replace(/\/$/, ""); // Remove trailing slash
+        this.apiKey = checkpoint.apiKey;
         this.debug = config.debug || false;
         // Create AccessControlApiService instance
         const fetchProvider = new node_providers_1.NodeFetchProvider();
@@ -95,7 +60,7 @@ class AgentShieldAPIDelegationVerifier {
             apiKey: this.apiKey,
             fetchProvider,
             logger: this.debug
-                ? (msg, data) => console.error(`[AgentShield] ${msg}`, data)
+                ? (msg, data) => console.error(`[Checkpoint] ${msg}`, data)
                 : undefined,
         });
     }
@@ -116,26 +81,10 @@ class AgentShieldAPIDelegationVerifier {
             };
         }
         const startTime = Date.now();
-        // Build cache key
-        const scopesKey = this.buildScopesKey(scopes);
-        const cacheKey = `verify:${agentDid}:${scopesKey}`;
-        // Fast path: Check cache
-        if (!options?.skipCache) {
-            const cached = this.cache.get(cacheKey);
-            if (cached) {
-                if (this.debug) {
-                    console.error(`[AgentShield] Cache HIT for ${agentDid} (${Date.now() - startTime}ms)`);
-                }
-                // Return cached result with cached flag set to true
-                return {
-                    ...cached,
-                    cached: true,
-                };
-            }
-        }
-        // Slow path: API call
+        // Every verification asks Checkpoint: a cached acceptance would outlive a
+        // revocation, and a cached refusal would hide a delegation granted since.
         if (this.debug) {
-            console.error(`[AgentShield] Cache MISS for ${agentDid}, calling API...`);
+            console.error(`[Checkpoint] Verifying ${agentDid}, calling API...`);
         }
         try {
             // Validate request input using contracts schema
@@ -148,8 +97,6 @@ class AgentShieldAPIDelegationVerifier {
             // Extract data from wrapped response
             const data = response.data;
             // Build result from validated response
-            // Note: Don't include 'cached' property in the result that gets cached
-            // We'll add it when returning (false for API calls, true for cache hits)
             const result = {
                 valid: data.valid,
                 delegation: data.delegation,
@@ -157,17 +104,13 @@ class AgentShieldAPIDelegationVerifier {
                 credential: data.credential,
                 reason: data.error ? data.error.message : data.reason,
             };
-            // Cache result (without cached property)
-            const ttl = data.valid ? this.cacheTtl : this.cacheTtl / 2;
-            this.cache.set(cacheKey, result, ttl);
             if (this.debug) {
-                console.error(`[AgentShield] Delegation ${data.valid ? "verified" : "rejected"} (${Date.now() - startTime}ms)`);
+                console.error(`[Checkpoint] Delegation ${data.valid ? "verified" : "rejected"} (${Date.now() - startTime}ms)`);
             }
-            // Return result with cached: false for API calls
             return { ...result, cached: false };
         }
         catch (error) {
-            console.error("[AgentShield] API call failed:", error);
+            console.error("[Checkpoint] API call failed:", error);
             // Return negative result on error (don't cache failures)
             // Use standard error format
             if (error instanceof agentshield_api_1.AgentShieldAPIError) {
@@ -204,25 +147,25 @@ class AgentShieldAPIDelegationVerifier {
             if (!response.ok) {
                 if (response.status === 404)
                     return null;
-                throw new Error(`AgentShield API error: ${response.status}`);
+                throw new Error(`Checkpoint API error: ${response.status}`);
             }
             const data = await response.json();
             const parsed = delegation_1.DelegationRecordSchema.safeParse(data);
             if (!parsed.success) {
-                console.error("[AgentShield] Invalid delegation in API response:", parsed.error);
+                console.error("[Checkpoint] Invalid delegation in API response:", parsed.error);
                 return null;
             }
             return parsed.data;
         }
         catch (error) {
-            console.error("[AgentShield] Failed to get delegation:", error);
+            console.error("[Checkpoint] Failed to get delegation:", error);
             return null;
         }
     }
     /**
      * Store delegation (admin operation via API)
      *
-     * Note: This is typically done via AgentShield dashboard UI,
+     * Note: This is typically done via Checkpoint dashboard UI,
      * not by the bouncer directly. Included for completeness.
      */
     async put(delegation) {
@@ -241,19 +184,14 @@ class AgentShieldAPIDelegationVerifier {
                 body: JSON.stringify(delegation),
             });
             if (!response.ok) {
-                throw new Error(`AgentShield API error: ${response.status} ${response.statusText}`);
+                throw new Error(`Checkpoint API error: ${response.status} ${response.statusText}`);
             }
-            // Invalidate cache
-            const delegationScopes = (0, delegation_verifier_1.extractScopes)(delegation);
-            const scopesKey = this.buildScopesKey(delegationScopes);
-            this.cache.delete(`delegation:${delegation.id}`);
-            this.cache.delete(`verify:${delegation.subjectDid}:${scopesKey}`);
             if (this.debug) {
-                console.error(`[AgentShield] Stored delegation ${delegation.id}`);
+                console.error(`[Checkpoint] Stored delegation ${delegation.id}`);
             }
         }
         catch (error) {
-            console.error("[AgentShield] Failed to store delegation:", error);
+            console.error("[Checkpoint] Failed to store delegation:", error);
             throw error;
         }
     }
@@ -271,38 +209,20 @@ class AgentShieldAPIDelegationVerifier {
                 body: JSON.stringify({ reason }),
             });
             if (!response.ok) {
-                throw new Error(`AgentShield API error: ${response.status} ${response.statusText}`);
+                throw new Error(`Checkpoint API error: ${response.status} ${response.statusText}`);
             }
-            // Invalidate cache
-            this.cache.delete(`delegation:${delegationId}`);
             if (this.debug) {
-                console.error(`[AgentShield] Revoked delegation ${delegationId}`);
+                console.error(`[Checkpoint] Revoked delegation ${delegationId}`);
             }
         }
         catch (error) {
-            console.error("[AgentShield] Failed to revoke delegation:", error);
+            console.error("[Checkpoint] Failed to revoke delegation:", error);
             throw error;
         }
     }
     /**
-     * Close connections (cleanup)
+     * Close connections (cleanup). The verifier holds no cache or connection.
      */
-    async close() {
-        this.cache.clear();
-    }
-    /**
-     * Build deterministic scopes key for caching
-     */
-    buildScopesKey(scopes) {
-        const sorted = [...scopes].sort();
-        const str = sorted.join(",");
-        let hash = 0;
-        for (let i = 0; i < str.length; i++) {
-            const char = str.charCodeAt(i);
-            hash = (hash << 5) - hash + char;
-            hash = hash & hash;
-        }
-        return Math.abs(hash).toString(36);
-    }
+    async close() { }
 }
-exports.AgentShieldAPIDelegationVerifier = AgentShieldAPIDelegationVerifier;
+exports.CheckpointAPIDelegationVerifier = CheckpointAPIDelegationVerifier;

package/dist/runtime/delegation-verifier.d.ts

@@ -6,7 +6,7 @@
  *
  * Architecture:
  * - DelegationVerifier: Abstract interface (Dependency Inversion Principle)
- * - Concrete adapters: CloudflareKVVerifier, AgentShieldAPIVerifier
+ * - Concrete adapters: CloudflareKVVerifier, CheckpointAPIVerifier
  * - Factory: createDelegationVerifier() selects adapter based on config
  *
  * Related: PHASE_1_XMCP_I_SERVER.md Epic 1 (Delegation Storage Layer)
@@ -21,7 +21,7 @@ export interface VerifyDelegationResult {
     valid: boolean;
     /** The delegation record (if found) */
     delegation?: DelegationRecord;
-    /** Credential from AgentShield API (includes authorization method) */
+    /** Credential from Checkpoint API (includes authorization method) */
     credential?: {
         agent_did: string;
         user_did: string;
@@ -56,7 +56,7 @@ export interface VerifyDelegationOptions {
  *
  * Implementations:
  * - CloudflareKVDelegationVerifier (local storage)
- * - AgentShieldAPIDelegationVerifier (remote managed service)
+ * - CheckpointAPIDelegationVerifier (remote managed service)
  *
  * Follows Interface Segregation Principle (SOLID) - minimal required methods
  */
@@ -155,8 +155,11 @@ export declare const VerifyDelegationInputSchema: z.ZodObject<{
  * Configuration for delegation verifiers
  */
 export interface DelegationVerifierConfig {
-    /** Verifier type */
-    type: 'cloudflare-kv' | 'agentshield-api' | 'memory';
+    /**
+     * Verifier type. `'agentshield-api'` is the former name of `'checkpoint-api'`
+     * and selects the same verifier.
+     */
+    type: 'cloudflare-kv' | 'checkpoint-api' | 'agentshield-api' | 'memory';
     /** Cloudflare KV namespace (for cloudflare-kv type) */
     kvNamespace?: {
         get(key: string): Promise<string | null>;
@@ -170,7 +173,12 @@ export interface DelegationVerifierConfig {
             }>;
         }>;
     };
-    /** AgentShield API configuration (for agentshield-api type) */
+    /** Checkpoint API configuration (for checkpoint-api type) */
+    checkpoint?: {
+        apiUrl: string;
+        apiKey: string;
+    };
+    /** @deprecated Use `checkpoint`; read only when `checkpoint` is absent. */
     agentshield?: {
         apiUrl: string;
         apiKey: string;
@@ -186,10 +194,10 @@ export interface DelegationVerifierConfig {
  * Note: We import all adapters statically for better compatibility.
  * Tree-shaking will remove unused adapters in production builds.
  *
- * Note: AgentShield API responses use standard wrapper format
+ * Note: Checkpoint API responses use standard wrapper format
  * { success: boolean, data: {...}, metadata?: {...} } as defined in
- * @kya-os/contracts/agentshield-api. This is handled in the
- * AgentShieldAPIDelegationVerifier implementation.
+ * @kya-os/contracts/checkpoint-api. This is handled in the
+ * CheckpointAPIDelegationVerifier implementation.
  *
  * @param config - Verifier configuration
  * @returns DelegationVerifier instance

package/dist/runtime/delegation-verifier.js

@@ -7,7 +7,7 @@
  *
  * Architecture:
  * - DelegationVerifier: Abstract interface (Dependency Inversion Principle)
- * - Concrete adapters: CloudflareKVVerifier, AgentShieldAPIVerifier
+ * - Concrete adapters: CloudflareKVVerifier, CheckpointAPIVerifier
  * - Factory: createDelegationVerifier() selects adapter based on config
  *
  * Related: PHASE_1_XMCP_I_SERVER.md Epic 1 (Delegation Storage Layer)
@@ -95,10 +95,10 @@ exports.VerifyDelegationInputSchema = zod_1.z.object({
  * Note: We import all adapters statically for better compatibility.
  * Tree-shaking will remove unused adapters in production builds.
  *
- * Note: AgentShield API responses use standard wrapper format
+ * Note: Checkpoint API responses use standard wrapper format
  * { success: boolean, data: {...}, metadata?: {...} } as defined in
- * @kya-os/contracts/agentshield-api. This is handled in the
- * AgentShieldAPIDelegationVerifier implementation.
+ * @kya-os/contracts/checkpoint-api. This is handled in the
+ * CheckpointAPIDelegationVerifier implementation.
  *
  * @param config - Verifier configuration
  * @returns DelegationVerifier instance
@@ -109,9 +109,10 @@ function createDelegationVerifier(config) {
             const CloudflareKVDelegationVerifier = require('./delegation-verifier-kv').CloudflareKVDelegationVerifier;
             return new CloudflareKVDelegationVerifier(config);
         }
+        case 'checkpoint-api':
         case 'agentshield-api': {
-            const AgentShieldAPIDelegationVerifier = require('./delegation-verifier-agentshield').AgentShieldAPIDelegationVerifier;
-            return new AgentShieldAPIDelegationVerifier(config);
+            const CheckpointAPIDelegationVerifier = require('./delegation-verifier-checkpoint').CheckpointAPIDelegationVerifier;
+            return new CheckpointAPIDelegationVerifier(config);
         }
         case 'memory': {
             const MemoryDelegationVerifier = require('./delegation-verifier-memory').MemoryDelegationVerifier;

package/dist/runtime/former-names.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The AgentShield-named exports from before these classes took the Checkpoint
+ * name. Each is the Checkpoint class itself, so existing imports, `instanceof`
+ * checks and type annotations keep working unchanged.
+ */
+import { CheckpointAPIDelegationVerifier } from "./delegation-verifier-checkpoint";
+import { CheckpointProofDestination } from "./proof-batch-queue";
+import { CheckpointToolProtectionSource } from "./tool-protection";
+/** @deprecated Use `CheckpointAPIDelegationVerifier`. */
+export declare const AgentShieldAPIDelegationVerifier: typeof CheckpointAPIDelegationVerifier;
+/** @deprecated Use `CheckpointAPIDelegationVerifier`. */
+export type AgentShieldAPIDelegationVerifier = CheckpointAPIDelegationVerifier;
+/** @deprecated Use `CheckpointProofDestination`. */
+export declare const AgentShieldProofDestination: typeof CheckpointProofDestination;
+/** @deprecated Use `CheckpointProofDestination`. */
+export type AgentShieldProofDestination = CheckpointProofDestination;
+/** @deprecated Use `CheckpointToolProtectionSource`. */
+export declare const AgentShieldToolProtectionSource: typeof CheckpointToolProtectionSource;
+/** @deprecated Use `CheckpointToolProtectionSource`. */
+export type AgentShieldToolProtectionSource = CheckpointToolProtectionSource;

package/dist/runtime/former-names.js

@@ -0,0 +1,17 @@
+"use strict";
+/**
+ * The AgentShield-named exports from before these classes took the Checkpoint
+ * name. Each is the Checkpoint class itself, so existing imports, `instanceof`
+ * checks and type annotations keep working unchanged.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentShieldToolProtectionSource = exports.AgentShieldProofDestination = exports.AgentShieldAPIDelegationVerifier = void 0;
+const delegation_verifier_checkpoint_1 = require("./delegation-verifier-checkpoint");
+const proof_batch_queue_1 = require("./proof-batch-queue");
+const tool_protection_1 = require("./tool-protection");
+/** @deprecated Use `CheckpointAPIDelegationVerifier`. */
+exports.AgentShieldAPIDelegationVerifier = delegation_verifier_checkpoint_1.CheckpointAPIDelegationVerifier;
+/** @deprecated Use `CheckpointProofDestination`. */
+exports.AgentShieldProofDestination = proof_batch_queue_1.CheckpointProofDestination;
+/** @deprecated Use `CheckpointToolProtectionSource`. */
+exports.AgentShieldToolProtectionSource = tool_protection_1.CheckpointToolProtectionSource;