@kya-os/mcp-i 1.12.4 → 1.13.0

package/dist/runtime/{delegation-verifier-agentshield.d.ts → delegation-verifier-checkpoint.d.ts}

@@ -2,12 +2,13 @@
  * Checkpoint API Delegation Verifier
  *
  * Queries delegations from Checkpoint managed service API.
- * Includes local caching to minimize network calls and maximize performance.
+ * No verdict is cached: every verification asks Checkpoint, so a revocation
+ * refuses the very next call and a delegation granted (or replaced) after a
+ * refusal is accepted on the next call. `cacheTtl`, `skipCache` and
+ * `maxCacheAge` therefore have no effect on this verifier.
  *
  * Performance:
- * - Fast path (cached): < 5ms
- * - Slow path (API call): < 100ms
- * - Cache TTL: 1 minute (configurable)
+ * - API call: < 100ms
  *
  * API Endpoints:
  * - POST /api/v1/delegations/verify - Verify delegation by agent DID + scopes
@@ -18,7 +19,7 @@
  * Authentication: Bearer token via X-API-Key header
  *
  * Related: PHASE_1_XMCP_I_SERVER.md Ticket 1.3
- * Related: AGENTSHIELD_DASHBOARD_PLAN.md Epic 2 (Public API)
+ * Related: CHECKPOINT_DASHBOARD_PLAN.md Epic 2 (Public API)
  */
 import { DelegationRecord } from "@kya-os/contracts/delegation";
 import { DelegationVerifier, DelegationVerifierConfig, VerifyDelegationResult, VerifyDelegationOptions } from "./delegation-verifier";
@@ -27,11 +28,9 @@ import { DelegationVerifier, DelegationVerifierConfig, VerifyDelegationResult, V
  *
  * Managed mode: Queries delegations from Checkpoint dashboard API
  */
-export declare class AgentShieldAPIDelegationVerifier implements DelegationVerifier {
+export declare class CheckpointAPIDelegationVerifier implements DelegationVerifier {
     private apiUrl;
     private apiKey;
-    private cache;
-    private cacheTtl;
     private debug;
     private accessControlService;
     constructor(config: DelegationVerifierConfig);
@@ -55,11 +54,7 @@ export declare class AgentShieldAPIDelegationVerifier implements DelegationVerif
      */
     revoke(delegationId: string, reason?: string): Promise<void>;
     /**
-     * Close connections (cleanup)
+     * Close connections (cleanup). The verifier holds no cache or connection.
      */
     close(): Promise<void>;
-    /**
-     * Build deterministic scopes key for caching
-     */
-    private buildScopesKey;
 }

package/dist/runtime/{delegation-verifier-agentshield.js → delegation-verifier-checkpoint.js}

@@ -3,12 +3,13 @@
  * Checkpoint API Delegation Verifier
  *
  * Queries delegations from Checkpoint managed service API.
- * Includes local caching to minimize network calls and maximize performance.
+ * No verdict is cached: every verification asks Checkpoint, so a revocation
+ * refuses the very next call and a delegation granted (or replaced) after a
+ * refusal is accepted on the next call. `cacheTtl`, `skipCache` and
+ * `maxCacheAge` therefore have no effect on this verifier.
  *
  * Performance:
- * - Fast path (cached): < 5ms
- * - Slow path (API call): < 100ms
- * - Cache TTL: 1 minute (configurable)
+ * - API call: < 100ms
  *
  * API Endpoints:
  * - POST /api/v1/delegations/verify - Verify delegation by agent DID + scopes
@@ -19,74 +20,38 @@
  * Authentication: Bearer token via X-API-Key header
  *
  * Related: PHASE_1_XMCP_I_SERVER.md Ticket 1.3
- * Related: AGENTSHIELD_DASHBOARD_PLAN.md Epic 2 (Public API)
+ * Related: CHECKPOINT_DASHBOARD_PLAN.md Epic 2 (Public API)
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AgentShieldAPIDelegationVerifier = void 0;
+exports.CheckpointAPIDelegationVerifier = void 0;
 const delegation_1 = require("@kya-os/contracts/delegation");
+// The former subpath on purpose: it is in every contracts release mcp-i's range
+// allows (^1.12.4), while "@kya-os/contracts/checkpoint-api" is only in releases
+// from this rename on. Its AgentShieldAPIError is CheckpointAPIError there. Move
+// to "@kya-os/contracts/checkpoint-api" once mcp-i requires such a release.
 const agentshield_api_1 = require("@kya-os/contracts/agentshield-api");
 const delegation_verifier_1 = require("./delegation-verifier");
 // C4 drain: stays on @kya-os/mcp-i-core - the test vi.mocks that specifier; source import + mock must drain together in L-Node-tests.
 const mcp_i_core_1 = require("@kya-os/mcp-i-core");
 const node_providers_1 = require("../providers/node-providers");
-/**
- * Simple in-memory cache (same as KV verifier)
- */
-class DelegationCache {
-    cache = new Map();
-    maxSize;
-    constructor(maxSize = 1000) {
-        this.maxSize = maxSize;
-    }
-    get(key) {
-        const entry = this.cache.get(key);
-        if (!entry)
-            return null;
-        if (Date.now() > entry.expiresAt) {
-            this.cache.delete(key);
-            return null;
-        }
-        return entry.data;
-    }
-    set(key, data, ttlMs) {
-        if (this.cache.size >= this.maxSize) {
-            const firstKey = this.cache.keys().next().value;
-            if (firstKey)
-                this.cache.delete(firstKey);
-        }
-        this.cache.set(key, {
-            data,
-            expiresAt: Date.now() + ttlMs,
-        });
-    }
-    delete(key) {
-        this.cache.delete(key);
-    }
-    clear() {
-        this.cache.clear();
-    }
-}
 // Use standard Checkpoint API response types from contracts
 /**
  * Checkpoint API Delegation Verifier
  *
  * Managed mode: Queries delegations from Checkpoint dashboard API
  */
-class AgentShieldAPIDelegationVerifier {
+class CheckpointAPIDelegationVerifier {
     apiUrl;
     apiKey;
-    cache;
-    cacheTtl;
     debug;
     accessControlService;
     constructor(config) {
-        if (!config.agentshield?.apiUrl || !config.agentshield?.apiKey) {
-            throw new Error("AgentShieldAPIDelegationVerifier requires agentshield.apiUrl and agentshield.apiKey in config");
+        const checkpoint = config.checkpoint ?? config.agentshield;
+        if (!checkpoint?.apiUrl || !checkpoint?.apiKey) {
+            throw new Error("CheckpointAPIDelegationVerifier requires checkpoint.apiUrl and checkpoint.apiKey in config");
         }
-        this.apiUrl = config.agentshield.apiUrl.replace(/\/$/, ""); // Remove trailing slash
-        this.apiKey = config.agentshield.apiKey;
-        this.cache = new DelegationCache();
-        this.cacheTtl = config.cacheTtl || 60_000; // Default 1 minute
+        this.apiUrl = checkpoint.apiUrl.replace(/\/$/, ""); // Remove trailing slash
+        this.apiKey = checkpoint.apiKey;
         this.debug = config.debug || false;
         // Create AccessControlApiService instance
         const fetchProvider = new node_providers_1.NodeFetchProvider();
@@ -116,26 +81,10 @@ class AgentShieldAPIDelegationVerifier {
             };
         }
         const startTime = Date.now();
-        // Build cache key
-        const scopesKey = this.buildScopesKey(scopes);
-        const cacheKey = `verify:${agentDid}:${scopesKey}`;
-        // Fast path: Check cache
-        if (!options?.skipCache) {
-            const cached = this.cache.get(cacheKey);
-            if (cached) {
-                if (this.debug) {
-                    console.error(`[Checkpoint] Cache HIT for ${agentDid} (${Date.now() - startTime}ms)`);
-                }
-                // Return cached result with cached flag set to true
-                return {
-                    ...cached,
-                    cached: true,
-                };
-            }
-        }
-        // Slow path: API call
+        // Every verification asks Checkpoint: a cached acceptance would outlive a
+        // revocation, and a cached refusal would hide a delegation granted since.
         if (this.debug) {
-            console.error(`[Checkpoint] Cache MISS for ${agentDid}, calling API...`);
+            console.error(`[Checkpoint] Verifying ${agentDid}, calling API...`);
         }
         try {
             // Validate request input using contracts schema
@@ -148,8 +97,6 @@ class AgentShieldAPIDelegationVerifier {
             // Extract data from wrapped response
             const data = response.data;
             // Build result from validated response
-            // Note: Don't include 'cached' property in the result that gets cached
-            // We'll add it when returning (false for API calls, true for cache hits)
             const result = {
                 valid: data.valid,
                 delegation: data.delegation,
@@ -157,13 +104,9 @@ class AgentShieldAPIDelegationVerifier {
                 credential: data.credential,
                 reason: data.error ? data.error.message : data.reason,
             };
-            // Cache result (without cached property)
-            const ttl = data.valid ? this.cacheTtl : this.cacheTtl / 2;
-            this.cache.set(cacheKey, result, ttl);
             if (this.debug) {
                 console.error(`[Checkpoint] Delegation ${data.valid ? "verified" : "rejected"} (${Date.now() - startTime}ms)`);
             }
-            // Return result with cached: false for API calls
             return { ...result, cached: false };
         }
         catch (error) {
@@ -243,11 +186,6 @@ class AgentShieldAPIDelegationVerifier {
             if (!response.ok) {
                 throw new Error(`Checkpoint API error: ${response.status} ${response.statusText}`);
             }
-            // Invalidate cache
-            const delegationScopes = (0, delegation_verifier_1.extractScopes)(delegation);
-            const scopesKey = this.buildScopesKey(delegationScopes);
-            this.cache.delete(`delegation:${delegation.id}`);
-            this.cache.delete(`verify:${delegation.subjectDid}:${scopesKey}`);
             if (this.debug) {
                 console.error(`[Checkpoint] Stored delegation ${delegation.id}`);
             }
@@ -273,8 +211,6 @@ class AgentShieldAPIDelegationVerifier {
             if (!response.ok) {
                 throw new Error(`Checkpoint API error: ${response.status} ${response.statusText}`);
             }
-            // Invalidate cache
-            this.cache.delete(`delegation:${delegationId}`);
             if (this.debug) {
                 console.error(`[Checkpoint] Revoked delegation ${delegationId}`);
             }
@@ -285,24 +221,8 @@ class AgentShieldAPIDelegationVerifier {
         }
     }
     /**
-     * Close connections (cleanup)
+     * Close connections (cleanup). The verifier holds no cache or connection.
      */
-    async close() {
-        this.cache.clear();
-    }
-    /**
-     * Build deterministic scopes key for caching
-     */
-    buildScopesKey(scopes) {
-        const sorted = [...scopes].sort();
-        const str = sorted.join(",");
-        let hash = 0;
-        for (let i = 0; i < str.length; i++) {
-            const char = str.charCodeAt(i);
-            hash = (hash << 5) - hash + char;
-            hash = hash & hash;
-        }
-        return Math.abs(hash).toString(36);
-    }
+    async close() { }
 }
-exports.AgentShieldAPIDelegationVerifier = AgentShieldAPIDelegationVerifier;
+exports.CheckpointAPIDelegationVerifier = CheckpointAPIDelegationVerifier;

package/dist/runtime/delegation-verifier.d.ts

@@ -6,7 +6,7 @@
  *
  * Architecture:
  * - DelegationVerifier: Abstract interface (Dependency Inversion Principle)
- * - Concrete adapters: CloudflareKVVerifier, AgentShieldAPIVerifier
+ * - Concrete adapters: CloudflareKVVerifier, CheckpointAPIVerifier
  * - Factory: createDelegationVerifier() selects adapter based on config
  *
  * Related: PHASE_1_XMCP_I_SERVER.md Epic 1 (Delegation Storage Layer)
@@ -56,7 +56,7 @@ export interface VerifyDelegationOptions {
  *
  * Implementations:
  * - CloudflareKVDelegationVerifier (local storage)
- * - AgentShieldAPIDelegationVerifier (remote managed service)
+ * - CheckpointAPIDelegationVerifier (remote managed service)
  *
  * Follows Interface Segregation Principle (SOLID) - minimal required methods
  */
@@ -155,8 +155,11 @@ export declare const VerifyDelegationInputSchema: z.ZodObject<{
  * Configuration for delegation verifiers
  */
 export interface DelegationVerifierConfig {
-    /** Verifier type */
-    type: 'cloudflare-kv' | 'agentshield-api' | 'memory';
+    /**
+     * Verifier type. `'agentshield-api'` is the former name of `'checkpoint-api'`
+     * and selects the same verifier.
+     */
+    type: 'cloudflare-kv' | 'checkpoint-api' | 'agentshield-api' | 'memory';
     /** Cloudflare KV namespace (for cloudflare-kv type) */
     kvNamespace?: {
         get(key: string): Promise<string | null>;
@@ -170,7 +173,12 @@ export interface DelegationVerifierConfig {
             }>;
         }>;
     };
-    /** Checkpoint API configuration (for agentshield-api type) */
+    /** Checkpoint API configuration (for checkpoint-api type) */
+    checkpoint?: {
+        apiUrl: string;
+        apiKey: string;
+    };
+    /** @deprecated Use `checkpoint`; read only when `checkpoint` is absent. */
     agentshield?: {
         apiUrl: string;
         apiKey: string;
@@ -188,8 +196,8 @@ export interface DelegationVerifierConfig {
  *
  * Note: Checkpoint API responses use standard wrapper format
  * { success: boolean, data: {...}, metadata?: {...} } as defined in
- * @kya-os/contracts/agentshield-api. This is handled in the
- * AgentShieldAPIDelegationVerifier implementation.
+ * @kya-os/contracts/checkpoint-api. This is handled in the
+ * CheckpointAPIDelegationVerifier implementation.
  *
  * @param config - Verifier configuration
  * @returns DelegationVerifier instance

package/dist/runtime/delegation-verifier.js

@@ -7,7 +7,7 @@
  *
  * Architecture:
  * - DelegationVerifier: Abstract interface (Dependency Inversion Principle)
- * - Concrete adapters: CloudflareKVVerifier, AgentShieldAPIVerifier
+ * - Concrete adapters: CloudflareKVVerifier, CheckpointAPIVerifier
  * - Factory: createDelegationVerifier() selects adapter based on config
  *
  * Related: PHASE_1_XMCP_I_SERVER.md Epic 1 (Delegation Storage Layer)
@@ -97,8 +97,8 @@ exports.VerifyDelegationInputSchema = zod_1.z.object({
  *
  * Note: Checkpoint API responses use standard wrapper format
  * { success: boolean, data: {...}, metadata?: {...} } as defined in
- * @kya-os/contracts/agentshield-api. This is handled in the
- * AgentShieldAPIDelegationVerifier implementation.
+ * @kya-os/contracts/checkpoint-api. This is handled in the
+ * CheckpointAPIDelegationVerifier implementation.
  *
  * @param config - Verifier configuration
  * @returns DelegationVerifier instance
@@ -109,9 +109,10 @@ function createDelegationVerifier(config) {
             const CloudflareKVDelegationVerifier = require('./delegation-verifier-kv').CloudflareKVDelegationVerifier;
             return new CloudflareKVDelegationVerifier(config);
         }
+        case 'checkpoint-api':
         case 'agentshield-api': {
-            const AgentShieldAPIDelegationVerifier = require('./delegation-verifier-agentshield').AgentShieldAPIDelegationVerifier;
-            return new AgentShieldAPIDelegationVerifier(config);
+            const CheckpointAPIDelegationVerifier = require('./delegation-verifier-checkpoint').CheckpointAPIDelegationVerifier;
+            return new CheckpointAPIDelegationVerifier(config);
         }
         case 'memory': {
             const MemoryDelegationVerifier = require('./delegation-verifier-memory').MemoryDelegationVerifier;

package/dist/runtime/former-names.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The AgentShield-named exports from before these classes took the Checkpoint
+ * name. Each is the Checkpoint class itself, so existing imports, `instanceof`
+ * checks and type annotations keep working unchanged.
+ */
+import { CheckpointAPIDelegationVerifier } from "./delegation-verifier-checkpoint";
+import { CheckpointProofDestination } from "./proof-batch-queue";
+import { CheckpointToolProtectionSource } from "./tool-protection";
+/** @deprecated Use `CheckpointAPIDelegationVerifier`. */
+export declare const AgentShieldAPIDelegationVerifier: typeof CheckpointAPIDelegationVerifier;
+/** @deprecated Use `CheckpointAPIDelegationVerifier`. */
+export type AgentShieldAPIDelegationVerifier = CheckpointAPIDelegationVerifier;
+/** @deprecated Use `CheckpointProofDestination`. */
+export declare const AgentShieldProofDestination: typeof CheckpointProofDestination;
+/** @deprecated Use `CheckpointProofDestination`. */
+export type AgentShieldProofDestination = CheckpointProofDestination;
+/** @deprecated Use `CheckpointToolProtectionSource`. */
+export declare const AgentShieldToolProtectionSource: typeof CheckpointToolProtectionSource;
+/** @deprecated Use `CheckpointToolProtectionSource`. */
+export type AgentShieldToolProtectionSource = CheckpointToolProtectionSource;

package/dist/runtime/former-names.js

@@ -0,0 +1,17 @@
+"use strict";
+/**
+ * The AgentShield-named exports from before these classes took the Checkpoint
+ * name. Each is the Checkpoint class itself, so existing imports, `instanceof`
+ * checks and type annotations keep working unchanged.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentShieldToolProtectionSource = exports.AgentShieldProofDestination = exports.AgentShieldAPIDelegationVerifier = void 0;
+const delegation_verifier_checkpoint_1 = require("./delegation-verifier-checkpoint");
+const proof_batch_queue_1 = require("./proof-batch-queue");
+const tool_protection_1 = require("./tool-protection");
+/** @deprecated Use `CheckpointAPIDelegationVerifier`. */
+exports.AgentShieldAPIDelegationVerifier = delegation_verifier_checkpoint_1.CheckpointAPIDelegationVerifier;
+/** @deprecated Use `CheckpointProofDestination`. */
+exports.AgentShieldProofDestination = proof_batch_queue_1.CheckpointProofDestination;
+/** @deprecated Use `CheckpointToolProtectionSource`. */
+exports.AgentShieldToolProtectionSource = tool_protection_1.CheckpointToolProtectionSource;