@kya-os/mcp-i 1.5.6-canary.2 → 1.5.8-canary.0

package/dist/cache/cloudflare-kv-nonce-cache.d.ts

@@ -1,4 +1,20 @@
 import { NonceCache } from "@kya-os/contracts/handshake";
+/**
+ * Cloudflare KV namespace interface
+ */
+interface KVNamespace {
+    get(key: string, options?: {
+        type?: string;
+    }): Promise<string | null>;
+    getWithMetadata?(key: string): Promise<{
+        value: string | null;
+        metadata?: unknown;
+    }>;
+    put(key: string, value: string, options?: {
+        expirationTtl?: number;
+    }): Promise<void>;
+    delete(key: string): Promise<void>;
+}
 /**
  * Cloudflare KV-based nonce cache implementation
  * Suitable for Cloudflare Workers deployments
@@ -6,9 +22,10 @@ import { NonceCache } from "@kya-os/contracts/handshake";
 export declare class CloudflareKVNonceCache implements NonceCache {
     private kv;
     private keyPrefix;
-    constructor(kv: any, keyPrefix?: string);
+    constructor(kv: KVNamespace, keyPrefix?: string);
     private getKey;
-    has(nonce: string): Promise<boolean>;
-    add(nonce: string, ttl: number): Promise<void>;
+    has(nonce: string, agentDid?: string): Promise<boolean>;
+    add(nonce: string, ttl: number, agentDid?: string): Promise<void>;
     cleanup(): Promise<void>;
 }
+export {};

package/dist/cache/cloudflare-kv-nonce-cache.js

@@ -6,17 +6,20 @@ exports.CloudflareKVNonceCache = void 0;
  * Suitable for Cloudflare Workers deployments
  */
 class CloudflareKVNonceCache {
-    kv; // KV namespace - type depends on Cloudflare Workers runtime
+    kv;
     keyPrefix;
     constructor(kv, keyPrefix = "nonce:") {
         this.kv = kv;
         this.keyPrefix = keyPrefix;
     }
-    getKey(nonce) {
+    getKey(nonce, agentDid) {
+        if (agentDid) {
+            return `${this.keyPrefix}${agentDid}:${nonce}`;
+        }
         return `${this.keyPrefix}${nonce}`;
     }
-    async has(nonce) {
-        const key = this.getKey(nonce);
+    async has(nonce, agentDid) {
+        const key = this.getKey(nonce, agentDid);
         const value = await this.kv.get(key);
         if (!value) {
             return false;
@@ -37,8 +40,8 @@ class CloudflareKVNonceCache {
             return false;
         }
     }
-    async add(nonce, ttl) {
-        const key = this.getKey(nonce);
+    async add(nonce, ttl, agentDid) {
+        const key = this.getKey(nonce, agentDid);
         const expiresAt = Date.now() + ttl * 1000;
         const data = {
             nonce,
@@ -48,8 +51,10 @@ class CloudflareKVNonceCache {
         // Cloudflare KV doesn't have native atomic add-if-absent
         // We implement a best-effort approach with metadata checking
         try {
-            // First, try to get the existing value with metadata
-            const existingWithMetadata = await this.kv.getWithMetadata(key);
+            // First, try to get the existing value with metadata (if available)
+            const existingWithMetadata = this.kv.getWithMetadata
+                ? await this.kv.getWithMetadata(key)
+                : null;
             if (existingWithMetadata && existingWithMetadata.value !== null) {
                 // Key exists, check if it's still valid
                 const existingData = JSON.parse(existingWithMetadata.value);
@@ -65,13 +70,13 @@ class CloudflareKVNonceCache {
         }
         catch (error) {
             // If this is a replay attack error, always rethrow it
-            if (error.message?.includes("potential replay attack")) {
+            if (error instanceof Error && error.message?.includes("potential replay attack")) {
                 throw error;
             }
             // If getWithMetadata is not available, fall back to basic approach
-            if (error.message?.includes("getWithMetadata")) {
+            if (error instanceof Error && error.message?.includes("getWithMetadata")) {
                 // Check if already exists first (less atomic but still functional)
-                if (await this.has(nonce)) {
+                if (await this.has(nonce, agentDid)) {
                     throw new Error(`Nonce ${nonce} already exists - potential replay attack`);
                 }
                 // Store with KV TTL as backup (convert to seconds)

package/dist/cache/cloudflare-kv.d.ts

@@ -11,7 +11,7 @@ import type { NonceCache } from "@kya-os/contracts/handshake";
 export interface KVNamespace {
     get(key: string, options?: {
         type?: "text" | "json" | "arrayBuffer" | "stream";
-    }): Promise<any>;
+    }): Promise<string | null>;
     put(key: string, value: string | ArrayBuffer | ReadableStream, options?: {
         expiration?: number;
         expirationTtl?: number;
@@ -71,17 +71,19 @@ export declare class CloudflareKVNonceCache implements NonceCache {
      * Check if a nonce exists in the cache
      *
      * @param nonce - The nonce to check
+     * @param agentDid - Optional agent DID for agent-scoped nonces (prevents cross-agent replay attacks)
      * @returns Promise<boolean> - true if exists, false if not
      */
-    has(nonce: string): Promise<boolean>;
+    has(nonce: string, agentDid?: string): Promise<boolean>;
     /**
      * Add a nonce to the cache with TTL
      * Implements atomic add-if-absent semantics for replay prevention
      *
      * @param nonce - The nonce to add
      * @param ttl - Time-to-live in seconds
+     * @param agentDid - Optional agent DID for agent-scoped nonces (prevents cross-agent replay attacks)
      */
-    add(nonce: string, ttl: number): Promise<void>;
+    add(nonce: string, ttl: number, agentDid?: string): Promise<void>;
     /**
      * Cleanup expired nonces
      * Note: Cloudflare KV handles expiration automatically via TTL

package/dist/cache/cloudflare-kv.js

@@ -44,10 +44,11 @@ class CloudflareKVNonceCache {
      * Check if a nonce exists in the cache
      *
      * @param nonce - The nonce to check
+     * @param agentDid - Optional agent DID for agent-scoped nonces (prevents cross-agent replay attacks)
      * @returns Promise<boolean> - true if exists, false if not
      */
-    async has(nonce) {
-        const key = this.keyPrefix + nonce;
+    async has(nonce, agentDid) {
+        const key = agentDid ? `${this.keyPrefix}${agentDid}:${nonce}` : this.keyPrefix + nonce;
         try {
             const existing = await this.kv.get(key, { type: "text" });
             return existing !== null;
@@ -64,9 +65,10 @@ class CloudflareKVNonceCache {
      *
      * @param nonce - The nonce to add
      * @param ttl - Time-to-live in seconds
+     * @param agentDid - Optional agent DID for agent-scoped nonces (prevents cross-agent replay attacks)
      */
-    async add(nonce, ttl) {
-        const key = this.keyPrefix + nonce;
+    async add(nonce, ttl, agentDid) {
+        const key = agentDid ? `${this.keyPrefix}${agentDid}:${nonce}` : this.keyPrefix + nonce;
         try {
             // Check if nonce already exists
             const existing = await this.kv.get(key, { type: "text" });

package/dist/cache/dynamodb-nonce-cache.d.ts

@@ -1,4 +1,9 @@
 import { NonceCache } from "@kya-os/contracts/handshake";
+/**
+ * DynamoDB client interface for SDK v3
+ * Using 'unknown' for the client type to work with any AWS SDK version
+ */
+type DynamoDBClient = any;
 /**
  * DynamoDB-based nonce cache implementation
  * Suitable for AWS Lambda deployments
@@ -8,8 +13,10 @@ export declare class DynamoNonceCache implements NonceCache {
     private tableName;
     private keyAttribute;
     private ttlAttribute;
-    constructor(dynamodb: any, tableName: string, keyAttribute?: string, ttlAttribute?: string);
-    has(nonce: string): Promise<boolean>;
-    add(nonce: string, ttl: number): Promise<void>;
+    constructor(dynamodb: DynamoDBClient, tableName: string, keyAttribute?: string, ttlAttribute?: string);
+    private getKey;
+    has(nonce: string, agentDid?: string): Promise<boolean>;
+    add(nonce: string, ttl: number, agentDid?: string): Promise<void>;
     cleanup(): Promise<void>;
 }
+export {};

package/dist/cache/dynamodb-nonce-cache.js

@@ -6,7 +6,7 @@ exports.DynamoNonceCache = void 0;
  * Suitable for AWS Lambda deployments
  */
 class DynamoNonceCache {
-    dynamodb; // DynamoDB client - type depends on AWS SDK version
+    dynamodb;
     tableName;
     keyAttribute;
     ttlAttribute;
@@ -16,13 +16,20 @@ class DynamoNonceCache {
         this.keyAttribute = keyAttribute;
         this.ttlAttribute = ttlAttribute;
     }
-    async has(nonce) {
+    getKey(nonce, agentDid) {
+        if (agentDid) {
+            return `nonce:${agentDid}:${nonce}`;
+        }
+        return nonce;
+    }
+    async has(nonce, agentDid) {
         try {
+            const key = this.getKey(nonce, agentDid);
             const result = await this.dynamodb
                 .getItem({
                 TableName: this.tableName,
                 Key: {
-                    [this.keyAttribute]: { S: nonce },
+                    [this.keyAttribute]: { S: key },
                 },
                 ConsistentRead: true, // Ensure we get the latest data
             })
@@ -31,7 +38,11 @@ class DynamoNonceCache {
                 return false;
             }
             // Check if expired (DynamoDB TTL might not have cleaned up yet)
-            const expiresAt = parseInt(result.Item[this.ttlAttribute].N);
+            const ttlValue = result.Item[this.ttlAttribute]?.N;
+            if (!ttlValue) {
+                return false;
+            }
+            const expiresAt = parseInt(ttlValue);
             if (Date.now() / 1000 > expiresAt) {
                 return false;
             }
@@ -40,17 +51,20 @@ class DynamoNonceCache {
         catch (error) {
             // Log error but don't expose internal details
             console.error("DynamoDB has() operation failed:", error);
+            // Type guard for AWS SDK errors
+            const awsError = error;
             // For certain errors, we can safely return false
-            if (error.code === "ResourceNotFoundException" ||
-                error.code === "ItemCollectionSizeLimitExceededException") {
+            if (awsError.code === "ResourceNotFoundException" ||
+                awsError.code === "ItemCollectionSizeLimitExceededException") {
                 return false;
             }
             // For other errors, we should throw to avoid security issues
-            throw new Error(`Failed to check nonce existence: ${error.code || error.message}`);
+            throw new Error(`Failed to check nonce existence: ${awsError.code || awsError.message || "Unknown error"}`);
         }
     }
-    async add(nonce, ttl) {
+    async add(nonce, ttl, agentDid) {
         const expiresAt = Math.floor(Date.now() / 1000) + ttl;
+        const key = this.getKey(nonce, agentDid);
         try {
             // Use conditional write to ensure atomic add-if-absent
             // This is truly atomic in DynamoDB
@@ -58,7 +72,7 @@ class DynamoNonceCache {
                 .putItem({
                 TableName: this.tableName,
                 Item: {
-                    [this.keyAttribute]: { S: nonce },
+                    [this.keyAttribute]: { S: key },
                     [this.ttlAttribute]: { N: expiresAt.toString() },
                     createdAt: { N: Math.floor(Date.now() / 1000).toString() },
                 },
@@ -67,21 +81,23 @@ class DynamoNonceCache {
                 .promise();
         }
         catch (error) {
-            if (error.code === "ConditionalCheckFailedException") {
+            // Type guard for AWS SDK errors
+            const awsError = error;
+            if (awsError.code === "ConditionalCheckFailedException") {
                 throw new Error(`Nonce ${nonce} already exists - potential replay attack`);
             }
             console.error("DynamoDB add() operation failed:", error);
             // Provide more specific error messages for common issues
-            if (error.code === "ResourceNotFoundException") {
+            if (awsError.code === "ResourceNotFoundException") {
                 throw new Error(`DynamoDB table ${this.tableName} not found`);
             }
-            else if (error.code === "ValidationException") {
-                throw new Error(`Invalid DynamoDB operation: ${error.message}`);
+            else if (awsError.code === "ValidationException") {
+                throw new Error(`Invalid DynamoDB operation: ${awsError.message || "Unknown validation error"}`);
             }
-            else if (error.code === "ProvisionedThroughputExceededException") {
+            else if (awsError.code === "ProvisionedThroughputExceededException") {
                 throw new Error("DynamoDB throughput exceeded - consider increasing capacity");
             }
-            throw new Error(`Failed to add nonce to cache: ${error.code || error.message}`);
+            throw new Error(`Failed to add nonce to cache: ${awsError.code || awsError.message || "Unknown error"}`);
         }
     }
     async cleanup() {

package/dist/cache/memory-nonce-cache.d.ts

@@ -15,12 +15,12 @@ export declare class MemoryNonceCache implements NonceCache {
     /**
      * Check if a nonce exists in the cache
      */
-    has(nonce: string): Promise<boolean>;
+    has(nonce: string, agentDid?: string): Promise<boolean>;
     /**
      * Add a nonce to the cache with TTL
      * MUST ensure atomic add-if-absent semantics for replay prevention
      */
-    add(nonce: string, ttlSeconds: number): Promise<void>;
+    add(nonce: string, ttlSeconds: number, agentDid?: string): Promise<void>;
     /**
      * Clean up expired entries
      * Safe to call frequently and should be no-op for backends that auto-expire

package/dist/cache/memory-nonce-cache.js

@@ -25,14 +25,15 @@ class MemoryNonceCache {
     /**
      * Check if a nonce exists in the cache
      */
-    async has(nonce) {
-        const entry = this.cache.get(nonce);
+    async has(nonce, agentDid) {
+        const key = agentDid ? `nonce:${agentDid}:${nonce}` : nonce;
+        const entry = this.cache.get(key);
         if (!entry) {
             return false;
         }
         // Check if expired
         if (Date.now() > entry.expiresAt) {
-            this.cache.delete(nonce);
+            this.cache.delete(key);
             return false;
         }
         return true;
@@ -41,9 +42,10 @@ class MemoryNonceCache {
      * Add a nonce to the cache with TTL
      * MUST ensure atomic add-if-absent semantics for replay prevention
      */
-    async add(nonce, ttlSeconds) {
+    async add(nonce, ttlSeconds, agentDid) {
+        const key = agentDid ? `nonce:${agentDid}:${nonce}` : nonce;
         // Check if nonce already exists (atomic check-and-set)
-        const existing = this.cache.get(nonce);
+        const existing = this.cache.get(key);
         if (existing && Date.now() <= existing.expiresAt) {
             throw new Error(`Nonce ${nonce} already exists - potential replay attack`);
         }
@@ -53,7 +55,7 @@ class MemoryNonceCache {
             sessionId: `mem_${Date.now()}_${Math.random().toString(36).substring(2)}`,
             expiresAt,
         };
-        this.cache.set(nonce, entry);
+        this.cache.set(key, entry);
     }
     /**
      * Clean up expired entries

package/dist/cache/nonce-cache-factory.js

@@ -123,11 +123,13 @@ async function createNonceCache(config, options) {
             try {
                 // Dynamic import to avoid bundling AWS SDK in environments that don't need it
                 const awsSdk = await import("@aws-sdk/client-dynamodb");
-                // Extract types from dynamic import - handle both ESM and CJS exports
-                const DynamoDBClient = awsSdk.DynamoDBClient ||
-                    awsSdk.default?.DynamoDBClient;
-                const DescribeTableCommand = awsSdk.DescribeTableCommand ||
-                    awsSdk.default?.DescribeTableCommand;
+                const sdkModule = awsSdk;
+                const DynamoDBClient = "DynamoDBClient" in sdkModule
+                    ? sdkModule.DynamoDBClient
+                    : sdkModule.default.DynamoDBClient;
+                const DescribeTableCommand = "DescribeTableCommand" in sdkModule
+                    ? sdkModule.DescribeTableCommand
+                    : sdkModule.default.DescribeTableCommand;
                 const region = config?.dynamodb?.region ||
                     process.env.AWS_REGION ||
                     process.env.AWS_DEFAULT_REGION ||
@@ -179,13 +181,14 @@ async function createNonceCache(config, options) {
                 // Verify KV namespace has required methods
                 const kvInterface = kv;
                 if (typeof kvInterface.get !== "function" ||
-                    typeof kvInterface.put !== "function") {
+                    typeof kvInterface.put !== "function" ||
+                    typeof kvInterface.delete !== "function") {
                     throw new Error(`KV namespace '${namespace}' does not have required methods`);
                 }
                 // Test basic KV operation (this will be very fast in Workers)
                 try {
-                    const kvInterface = kv;
-                    await kvInterface.get("__mcpi_test_key__");
+                    const kvTest = kv;
+                    await kvTest.get("__mcpi_test_key__");
                 }
                 catch (kvError) {
                     const error = kvError;

package/dist/cache/redis-nonce-cache.d.ts

@@ -8,7 +8,7 @@ export declare class RedisNonceCache implements NonceCache {
     private keyPrefix;
     constructor(redis: any, keyPrefix?: string);
     private getKey;
-    has(nonce: string): Promise<boolean>;
-    add(nonce: string, ttl: number): Promise<void>;
+    has(nonce: string, agentDid?: string): Promise<boolean>;
+    add(nonce: string, ttl: number, agentDid?: string): Promise<void>;
     cleanup(): Promise<void>;
 }

package/dist/cache/redis-nonce-cache.js

@@ -12,12 +12,15 @@ class RedisNonceCache {
         this.redis = redis;
         this.keyPrefix = keyPrefix;
     }
-    getKey(nonce) {
+    getKey(nonce, agentDid) {
+        if (agentDid) {
+            return `${this.keyPrefix}${agentDid}:${nonce}`;
+        }
         return `${this.keyPrefix}${nonce}`;
     }
-    async has(nonce) {
+    async has(nonce, agentDid) {
         try {
-            const key = this.getKey(nonce);
+            const key = this.getKey(nonce, agentDid);
             const exists = await this.redis.exists(key);
             return exists === 1;
         }
@@ -26,9 +29,9 @@ class RedisNonceCache {
             throw new Error(`Failed to check nonce existence: ${error}`);
         }
     }
-    async add(nonce, ttl) {
+    async add(nonce, ttl, agentDid) {
         try {
-            const key = this.getKey(nonce);
+            const key = this.getKey(nonce, agentDid);
             // Use SET with NX (not exists) and EX (expiry) for atomic add-if-absent
             // This is truly atomic in Redis
             const result = await this.redis.set(key, "1", "EX", ttl, "NX");