@kya-os/mcp-i 1.12.4 → 1.13.0

package/dist/runtime/index.d.ts

@@ -18,11 +18,12 @@ export { type AuthHandshakeConfig, type VerifyOrHintsResult, type AgentReputatio
 export { createResumeTokenStore, type ResumeTokenStoreConfig, } from "./resume-token-store";
 export { CloudflareKVResumeTokenStore, type ResumeTokenKVNamespace, } from "./resume-token-store-kv";
 export { ensureOutboundIdentityBridge } from "./outbound-identity-bridge";
-export { type ProofDestination, type ProofSubmission, type ProofBatchQueueConfig, ProofBatchQueue, KTAProofDestination, AgentShieldProofDestination, PartialProofSubmissionError, createProofBatchQueue, } from "./proof-batch-queue";
+export { type ProofDestination, type ProofSubmission, type ProofBatchQueueConfig, ProofBatchQueue, KTAProofDestination, CheckpointProofDestination, PartialProofSubmissionError, createProofBatchQueue, } from "./proof-batch-queue";
 export { CloudflareKVDelegationVerifier, } from "./delegation-verifier-kv";
-export { AgentShieldAPIDelegationVerifier, } from "./delegation-verifier-agentshield";
+export { CheckpointAPIDelegationVerifier, } from "./delegation-verifier-checkpoint";
 export { MemoryDelegationVerifier, } from "./delegation-verifier-memory";
-export { type ToolProtectionConfig, type ToolProtectionMap, type ToolProtectionConfigSource, ToolProtectionResolver, createToolProtectionResolver, InlineToolProtectionSource, FileToolProtectionSource, AgentShieldToolProtectionSource, } from "./tool-protection";
+export { type ToolProtectionConfig, type ToolProtectionMap, type ToolProtectionConfigSource, ToolProtectionResolver, createToolProtectionResolver, InlineToolProtectionSource, FileToolProtectionSource, CheckpointToolProtectionSource, } from "./tool-protection";
+export * from "./former-names";
 export { toolProtectionRegistry, isToolProtected, getToolProtection, } from "./tool-protection-registry";
 export type { HandshakeRequest, SessionContext, NonceCache, NonceCacheEntry, NonceCacheConfig, } from "@kya-os/contracts/handshake";
 export type { ProofMeta, DetachedProof, CanonicalHashes, AuditRecord, } from "@kya-os/mcp/types" with { "resolution-mode": "import" };

package/dist/runtime/index.js

@@ -5,8 +5,22 @@
  * Identity-aware MCP runtime with proof generation, session management,
  * canonical audit trails, and well-known endpoints.
  */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AgentShieldToolProtectionSource = exports.FileToolProtectionSource = exports.InlineToolProtectionSource = exports.createToolProtectionResolver = exports.ToolProtectionResolver = exports.MemoryDelegationVerifier = exports.AgentShieldAPIDelegationVerifier = exports.CloudflareKVDelegationVerifier = exports.createProofBatchQueue = exports.PartialProofSubmissionError = exports.AgentShieldProofDestination = exports.KTAProofDestination = exports.ProofBatchQueue = exports.ensureOutboundIdentityBridge = exports.CloudflareKVResumeTokenStore = exports.createResumeTokenStore = exports.MemoryResumeTokenStore = exports.hasSensitiveScopes = exports.verifyOrHints = exports.extractScopes = exports.validateDelegation = exports.checkScopes = exports.createDelegationVerifier = exports.formatVerifyLink = exports.DemoConsole = exports.createDemoManager = exports.DemoManager = exports.createDebugEndpoint = exports.DebugManager = exports.extractDIDFromPath = exports.validateAgentDocument = exports.validateDIDDocument = exports.createWellKnownHandler = exports.WellKnownManager = exports.extractCanonicalData = exports.createProofResponse = exports.ProofGenerator = exports.validateHandshakeFormat = exports.createHandshakeRequest = exports.defaultSessionManager = exports.SessionManager = exports.IDENTITY_ERRORS = exports.ensureIdentity = exports.defaultIdentityManager = exports.IdentityManager = exports.RUNTIME_ERRORS = exports.RuntimeFactory = exports.createMCPIRuntime = exports.MCPIRuntime = exports.MCPINodeRuntimeWrapper = void 0;
+exports.CheckpointToolProtectionSource = exports.FileToolProtectionSource = exports.InlineToolProtectionSource = exports.createToolProtectionResolver = exports.ToolProtectionResolver = exports.MemoryDelegationVerifier = exports.CheckpointAPIDelegationVerifier = exports.CloudflareKVDelegationVerifier = exports.createProofBatchQueue = exports.PartialProofSubmissionError = exports.CheckpointProofDestination = exports.KTAProofDestination = exports.ProofBatchQueue = exports.ensureOutboundIdentityBridge = exports.CloudflareKVResumeTokenStore = exports.createResumeTokenStore = exports.MemoryResumeTokenStore = exports.hasSensitiveScopes = exports.verifyOrHints = exports.extractScopes = exports.validateDelegation = exports.checkScopes = exports.createDelegationVerifier = exports.formatVerifyLink = exports.DemoConsole = exports.createDemoManager = exports.DemoManager = exports.createDebugEndpoint = exports.DebugManager = exports.extractDIDFromPath = exports.validateAgentDocument = exports.validateDIDDocument = exports.createWellKnownHandler = exports.WellKnownManager = exports.extractCanonicalData = exports.createProofResponse = exports.ProofGenerator = exports.validateHandshakeFormat = exports.createHandshakeRequest = exports.defaultSessionManager = exports.SessionManager = exports.IDENTITY_ERRORS = exports.ensureIdentity = exports.defaultIdentityManager = exports.IdentityManager = exports.RUNTIME_ERRORS = exports.RuntimeFactory = exports.createMCPIRuntime = exports.MCPIRuntime = exports.MCPINodeRuntimeWrapper = void 0;
 exports.getToolProtection = exports.isToolProtected = exports.toolProtectionRegistry = void 0;
 // Main runtime - Node.js implementation with providers
 var mcpi_runtime_wrapper_1 = require("./mcpi-runtime-wrapper");
@@ -74,13 +88,13 @@ Object.defineProperty(exports, "ensureOutboundIdentityBridge", { enumerable: tru
 var proof_batch_queue_1 = require("./proof-batch-queue");
 Object.defineProperty(exports, "ProofBatchQueue", { enumerable: true, get: function () { return proof_batch_queue_1.ProofBatchQueue; } });
 Object.defineProperty(exports, "KTAProofDestination", { enumerable: true, get: function () { return proof_batch_queue_1.KTAProofDestination; } });
-Object.defineProperty(exports, "AgentShieldProofDestination", { enumerable: true, get: function () { return proof_batch_queue_1.AgentShieldProofDestination; } });
+Object.defineProperty(exports, "CheckpointProofDestination", { enumerable: true, get: function () { return proof_batch_queue_1.CheckpointProofDestination; } });
 Object.defineProperty(exports, "PartialProofSubmissionError", { enumerable: true, get: function () { return proof_batch_queue_1.PartialProofSubmissionError; } });
 Object.defineProperty(exports, "createProofBatchQueue", { enumerable: true, get: function () { return proof_batch_queue_1.createProofBatchQueue; } });
 var delegation_verifier_kv_1 = require("./delegation-verifier-kv");
 Object.defineProperty(exports, "CloudflareKVDelegationVerifier", { enumerable: true, get: function () { return delegation_verifier_kv_1.CloudflareKVDelegationVerifier; } });
-var delegation_verifier_agentshield_1 = require("./delegation-verifier-agentshield");
-Object.defineProperty(exports, "AgentShieldAPIDelegationVerifier", { enumerable: true, get: function () { return delegation_verifier_agentshield_1.AgentShieldAPIDelegationVerifier; } });
+var delegation_verifier_checkpoint_1 = require("./delegation-verifier-checkpoint");
+Object.defineProperty(exports, "CheckpointAPIDelegationVerifier", { enumerable: true, get: function () { return delegation_verifier_checkpoint_1.CheckpointAPIDelegationVerifier; } });
 var delegation_verifier_memory_1 = require("./delegation-verifier-memory");
 Object.defineProperty(exports, "MemoryDelegationVerifier", { enumerable: true, get: function () { return delegation_verifier_memory_1.MemoryDelegationVerifier; } });
 // Tool protection (NEW - Phase 1.5)
@@ -89,7 +103,9 @@ Object.defineProperty(exports, "ToolProtectionResolver", { enumerable: true, get
 Object.defineProperty(exports, "createToolProtectionResolver", { enumerable: true, get: function () { return tool_protection_1.createToolProtectionResolver; } });
 Object.defineProperty(exports, "InlineToolProtectionSource", { enumerable: true, get: function () { return tool_protection_1.InlineToolProtectionSource; } });
 Object.defineProperty(exports, "FileToolProtectionSource", { enumerable: true, get: function () { return tool_protection_1.FileToolProtectionSource; } });
-Object.defineProperty(exports, "AgentShieldToolProtectionSource", { enumerable: true, get: function () { return tool_protection_1.AgentShieldToolProtectionSource; } });
+Object.defineProperty(exports, "CheckpointToolProtectionSource", { enumerable: true, get: function () { return tool_protection_1.CheckpointToolProtectionSource; } });
+// Former AgentShield names, kept as deprecated aliases.
+__exportStar(require("./former-names"), exports);
 var tool_protection_registry_1 = require("./tool-protection-registry");
 Object.defineProperty(exports, "toolProtectionRegistry", { enumerable: true, get: function () { return tool_protection_registry_1.toolProtectionRegistry; } });
 Object.defineProperty(exports, "isToolProtected", { enumerable: true, get: function () { return tool_protection_registry_1.isToolProtected; } });

package/dist/runtime/mcpi-runtime.d.ts

@@ -50,7 +50,8 @@ export interface MCPIRuntimeConfig {
             /** Proof submission destinations (Checkpoint, KTA, etc.) */
             destinations?: Array<{
                 /** Destination type */
-                type: "agentshield" | "kta";
+                /** `"agentshield"` is the former name of `"checkpoint"`. */
+                type: "checkpoint" | "agentshield" | "kta";
                 /** API base URL */
                 apiUrl: string;
                 /** API key for authentication */
@@ -102,6 +103,11 @@ export interface MCPIRuntimeConfig {
         /** Local tool protection file path (default: tool-protections.json) */
         toolProtectionsFile?: string | false;
         /** Checkpoint API configuration for fetching tool protections */
+        checkpoint?: {
+            apiUrl: string;
+            apiKey?: string;
+        };
+        /** @deprecated Use `checkpoint`; read only when `checkpoint` is absent. */
         agentShield?: {
             apiUrl: string;
             apiKey?: string;

package/dist/runtime/mcpi-runtime.js

@@ -80,14 +80,15 @@ class MCPIRuntime {
         this.sessionManager.setServerDid(this.cachedIdentity.did);
         // Create tool protection resolver NOW that we have the agent DID (NEW - Phase 1.5)
         if (this.config.delegation?.enabled) {
+            const checkpointApi = this.config.delegation.checkpoint ?? this.config.delegation.agentShield;
             this.toolProtectionResolver = (0, tool_protection_1.createToolProtectionResolver)({
                 inline: this.config.delegation.toolProtections,
                 localFile: this.config.delegation.toolProtectionsFile,
-                agentShield: this.config.delegation.agentShield
+                checkpoint: checkpointApi
                     ? {
-                        apiUrl: this.config.delegation.agentShield.apiUrl,
+                        apiUrl: checkpointApi.apiUrl,
                         agentDid: this.cachedIdentity.did, // ← FIX: Use actual DID!
-                        apiKey: this.config.delegation.agentShield.apiKey,
+                        apiKey: checkpointApi.apiKey,
                     }
                     : undefined,
                 debug: this.config.identity?.environment === 'development',
@@ -135,7 +136,7 @@ class MCPIRuntime {
                     kta: this.config.delegation?.authorization?.kta,
                     bouncer: {
                         authorizationUrl: this.config.delegation?.authorization?.authorizationUrl ||
-                            "https://agentshield.example.com/consent",
+                            "https://checkpoint.example.com/consent",
                         resumeTokenTtl: this.config.delegation?.authorization?.resumeTokenTtl,
                         minReputationScore: this.config.delegation?.authorization?.minReputationScore,
                         requireAuthForUnknown: this.config.delegation?.authorization?.requireAuthForUnknown,
@@ -196,7 +197,7 @@ class MCPIRuntime {
                     kta: this.config.delegation.authorization?.kta,
                     bouncer: {
                         authorizationUrl: this.config.delegation.authorization?.authorizationUrl ||
-                            "https://agentshield.example.com/consent",
+                            "https://checkpoint.example.com/consent",
                         resumeTokenTtl: this.config.delegation.authorization?.resumeTokenTtl,
                         minReputationScore: this.config.delegation.authorization?.minReputationScore,
                         requireAuthForUnknown: this.config.delegation.authorization?.requireAuthForUnknown,

package/dist/runtime/proof-batch-queue.d.ts

@@ -79,7 +79,7 @@ export declare class KTAProofDestination implements ProofDestination {
  * Submits proofs to Checkpoint's /api/v1/bouncer/proofs endpoint
  * with proper authentication and session grouping.
  */
-export declare class AgentShieldProofDestination implements ProofDestination {
+export declare class CheckpointProofDestination implements ProofDestination {
     name: string;
     private apiUrl;
     private apiKey;

package/dist/runtime/proof-batch-queue.js

@@ -18,7 +18,7 @@
  * Related: PHASE_1_XMCP_I_SERVER.md Epic 3 (Proof Batching)
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ProofBatchQueue = exports.AgentShieldProofDestination = exports.KTAProofDestination = exports.PartialProofSubmissionError = void 0;
+exports.ProofBatchQueue = exports.CheckpointProofDestination = exports.KTAProofDestination = exports.PartialProofSubmissionError = void 0;
 exports.createProofBatchQueue = createProofBatchQueue;
 /**
  * Thrown by a ProofDestination whose submit() made independent per-item
@@ -126,7 +126,7 @@ exports.KTAProofDestination = KTAProofDestination;
  * Submits proofs to Checkpoint's /api/v1/bouncer/proofs endpoint
  * with proper authentication and session grouping.
  */
-class AgentShieldProofDestination {
+class CheckpointProofDestination {
     name = "Checkpoint";
     apiUrl;
     apiKey;
@@ -165,7 +165,7 @@ class AgentShieldProofDestination {
         }
     }
 }
-exports.AgentShieldProofDestination = AgentShieldProofDestination;
+exports.CheckpointProofDestination = CheckpointProofDestination;
 /**
  * Proof Batch Queue
  *