@kya-os/mcp-i 1.6.13 → 1.6.15

package/dist/runtime/auth-handshake.d.ts

@@ -16,9 +16,9 @@
  *
  * Related: PHASE_1_XMCP_I_SERVER.md Epic 2 (Runtime Interceptor)
  */
-import { NeedsAuthorizationError } from '@kya-os/contracts/runtime';
-import { DelegationVerifier } from './delegation-verifier';
-import { DelegationRecord } from '@kya-os/contracts/delegation';
+import { NeedsAuthorizationError } from "@kya-os/contracts/runtime";
+import { DelegationVerifier } from "./delegation-verifier";
+import { DelegationRecord } from "@kya-os/contracts/delegation";
 /**
  * Agent reputation data from KTA
  */
@@ -32,7 +32,7 @@ export interface AgentReputation {
     /** Success rate (0-1) */
     successRate: number;
     /** Risk level assessment */
-    riskLevel: 'low' | 'medium' | 'high' | 'unknown';
+    riskLevel: "low" | "medium" | "high" | "unknown";
     /** Last updated timestamp */
     updatedAt: number;
 }
@@ -77,7 +77,7 @@ export interface VerifyOrHintsResult {
         user_did: string;
         scopes: string[];
         authorization: {
-            type: 'oauth' | 'credential' | 'none';
+            type: "oauth" | "credential" | "none";
             provider?: string;
             credentialType?: string;
         };

package/dist/runtime/auth-handshake.js

@@ -84,7 +84,7 @@ exports.MemoryResumeTokenStore = MemoryResumeTokenStore;
 async function verifyOrHints(agentDid, scopes, config, _resumeToken) {
     const startTime = Date.now();
     if (config.debug) {
-        console.log(`[AuthHandshake] Verifying ${agentDid} for scopes: ${scopes.join(', ')}`);
+        console.error(`[AuthHandshake] Verifying ${agentDid} for scopes: ${scopes.join(", ")}`);
     }
     // Step 1: Check reputation (optional, if KTA configured)
     let reputation;
@@ -92,25 +92,25 @@ async function verifyOrHints(agentDid, scopes, config, _resumeToken) {
         try {
             reputation = await fetchAgentReputation(agentDid, config.kta);
             if (config.debug) {
-                console.log(`[AuthHandshake] Reputation score: ${reputation.score}`);
+                console.error(`[AuthHandshake] Reputation score: ${reputation.score}`);
             }
             // If reputation is too low, require authorization
             if (reputation.score < config.bouncer.minReputationScore) {
                 if (config.debug) {
-                    console.log(`[AuthHandshake] Reputation ${reputation.score} < ${config.bouncer.minReputationScore}, requiring authorization`);
+                    console.error(`[AuthHandshake] Reputation ${reputation.score} < ${config.bouncer.minReputationScore}, requiring authorization`);
                 }
-                const authError = await buildNeedsAuthorizationError(agentDid, scopes, config, 'Agent reputation score below threshold');
+                const authError = await buildNeedsAuthorizationError(agentDid, scopes, config, "Agent reputation score below threshold");
                 return {
                     authorized: false,
                     authError,
                     reputation,
-                    reason: 'Low reputation score',
+                    reason: "Low reputation score",
                 };
             }
         }
         catch (error) {
             // Don't fail hard on reputation check failure
-            console.warn('[AuthHandshake] Failed to check reputation:', error);
+            console.warn("[AuthHandshake] Failed to check reputation:", error);
         }
     }
     // Step 2: Check for existing delegation
@@ -119,8 +119,8 @@ async function verifyOrHints(agentDid, scopes, config, _resumeToken) {
         delegationResult = await config.delegationVerifier.verify(agentDid, scopes);
     }
     catch (error) {
-        console.error('[AuthHandshake] Delegation verification failed:', error);
-        const errorMessage = `Delegation verification error: ${error instanceof Error ? error.message : 'Unknown error'}`;
+        console.error("[AuthHandshake] Delegation verification failed:", error);
+        const errorMessage = `Delegation verification error: ${error instanceof Error ? error.message : "Unknown error"}`;
         const authError = await buildNeedsAuthorizationError(agentDid, scopes, config, errorMessage);
         return {
             authorized: false,
@@ -131,26 +131,26 @@ async function verifyOrHints(agentDid, scopes, config, _resumeToken) {
     // Step 3: If delegation exists and valid, authorize immediately
     if (delegationResult.valid && delegationResult.delegation) {
         if (config.debug) {
-            console.log(`[AuthHandshake] Delegation valid, authorized (${Date.now() - startTime}ms)`);
+            console.error(`[AuthHandshake] Delegation valid, authorized (${Date.now() - startTime}ms)`);
         }
         return {
             authorized: true,
             delegation: delegationResult.delegation,
             credential: delegationResult.credential, // Include credential for auth method validation
             reputation,
-            reason: 'Valid delegation found',
+            reason: "Valid delegation found",
         };
     }
     // Step 4: No delegation found - return needs_authorization error
     if (config.debug) {
-        console.log(`[AuthHandshake] No delegation found, returning needs_authorization (${Date.now() - startTime}ms)`);
+        console.error(`[AuthHandshake] No delegation found, returning needs_authorization (${Date.now() - startTime}ms)`);
     }
-    const authError = await buildNeedsAuthorizationError(agentDid, scopes, config, delegationResult.reason || 'No valid delegation found');
+    const authError = await buildNeedsAuthorizationError(agentDid, scopes, config, delegationResult.reason || "No valid delegation found");
     return {
         authorized: false,
         authError,
         reputation,
-        reason: delegationResult.reason || 'No delegation',
+        reason: delegationResult.reason || "No delegation",
     };
 }
 /**
@@ -161,15 +161,15 @@ async function verifyOrHints(agentDid, scopes, config, _resumeToken) {
  * @returns Agent reputation data
  */
 async function fetchAgentReputation(agentDid, ktaConfig) {
-    const apiUrl = ktaConfig.apiUrl.replace(/\/$/, '');
+    const apiUrl = ktaConfig.apiUrl.replace(/\/$/, "");
     const headers = {
-        'Content-Type': 'application/json',
+        "Content-Type": "application/json",
     };
     if (ktaConfig.apiKey) {
-        headers['X-API-Key'] = ktaConfig.apiKey;
+        headers["X-API-Key"] = ktaConfig.apiKey;
     }
     const response = await fetch(`${apiUrl}/api/v1/reputation/${encodeURIComponent(agentDid)}`, {
-        method: 'GET',
+        method: "GET",
         headers,
     });
     if (!response.ok) {
@@ -180,7 +180,7 @@ async function fetchAgentReputation(agentDid, ktaConfig) {
                 score: 50, // Neutral score
                 totalInteractions: 0,
                 successRate: 0,
-                riskLevel: 'unknown',
+                riskLevel: "unknown",
                 updatedAt: Date.now(),
             };
         }
@@ -192,7 +192,7 @@ async function fetchAgentReputation(agentDid, ktaConfig) {
         score: data.score || 50,
         totalInteractions: data.totalInteractions || 0,
         successRate: data.successRate || 0,
-        riskLevel: data.riskLevel || 'unknown',
+        riskLevel: data.riskLevel || "unknown",
         updatedAt: data.updatedAt || Date.now(),
     };
 }
@@ -213,15 +213,15 @@ async function buildNeedsAuthorizationError(agentDid, scopes, config, message) {
     const expiresAt = Date.now() + (config.bouncer.resumeTokenTtl || 600_000);
     // Build authorization URL
     const authUrl = new URL(config.bouncer.authorizationUrl);
-    authUrl.searchParams.set('agent_did', agentDid);
-    authUrl.searchParams.set('scopes', scopes.join(','));
-    authUrl.searchParams.set('resume_token', resumeToken);
+    authUrl.searchParams.set("agent_did", agentDid);
+    authUrl.searchParams.set("scopes", scopes.join(","));
+    authUrl.searchParams.set("resume_token", resumeToken);
     // Generate short authorization code (for display)
     const authCode = resumeToken.substring(0, 8).toUpperCase();
     // Build display hints
     const display = {
-        title: 'Authorization Required',
-        hint: ['link', 'qr'],
+        title: "Authorization Required",
+        hint: ["link", "qr"],
         authorizationCode: authCode,
         qrUrl: `https://chart.googleapis.com/chart?cht=qr&chs=300x300&chl=${encodeURIComponent(authUrl.toString())}`,
     };
@@ -242,13 +242,13 @@ async function buildNeedsAuthorizationError(agentDid, scopes, config, message) {
  */
 function hasSensitiveScopes(scopes) {
     const sensitivePatterns = [
-        'write',
-        'delete',
-        'admin',
-        'payment',
-        'transfer',
-        'execute',
-        'modify',
+        "write",
+        "delete",
+        "admin",
+        "payment",
+        "transfer",
+        "execute",
+        "modify",
     ];
     return scopes.some((scope) => sensitivePatterns.some((pattern) => scope.toLowerCase().includes(pattern)));
 }

package/dist/runtime/delegation-hooks.d.ts

@@ -33,7 +33,7 @@ export declare class DefaultDelegationHooks implements DelegationHooks {
     constructor(delegationManager: DelegationManager, options?: DelegationHookOptions);
     beforeProof(meta: Partial<ProofMeta>): Promise<Partial<ProofMeta>>;
     afterProof(meta: ProofMeta): Promise<void>;
-    resolveDelegation(_context: RequestContext): Promise<string | undefined>;
+    resolveDelegation(context: RequestContext): Promise<string | undefined>;
 }
 export interface DelegationHookOptions {
     /**

package/dist/runtime/delegation-hooks.js

@@ -52,14 +52,42 @@ class DefaultDelegationHooks {
             }
         }
     }
-    async resolveDelegation(_context) {
-        // TODO: Implement delegation resolution logic
-        // This could involve:
-        // 1. Looking up active delegations for the DID
-        // 2. Matching scopes and audience
-        // 3. Selecting the most appropriate delegation
-        // For now, return undefined (no delegation)
-        return undefined;
+    async resolveDelegation(context) {
+        // Implement delegation resolution logic to reuse existing chains
+        try {
+            // 1. Look up active delegations for the DID (subject)
+            const delegations = await this.delegationManager.listBySubject(context.did);
+            if (!delegations || delegations.length === 0) {
+                return undefined;
+            }
+            // 2. Filter by audience and scopes
+            // We want to find a delegation that satisfies ALL required scopes and matches the audience
+            const validDelegation = delegations.find((d) => {
+                // Check audience if context specifies one
+                if (context.audience && d.aud && d.aud !== context.audience) {
+                    return false;
+                }
+                // Check scopes if context specifies them
+                if (context.scopes && context.scopes.length > 0) {
+                    const hasAllScopes = context.scopes.every((scope) => d.scopes.includes(scope));
+                    if (!hasAllScopes)
+                        return false;
+                }
+                // Check expiry (redundant with isActive check but good for safety)
+                const now = Math.floor(Date.now() / 1000);
+                if (d.exp < now)
+                    return false;
+                if (d.nbf && d.nbf > now)
+                    return false;
+                return true;
+            });
+            // 3. Return the best match
+            return validDelegation?.delegationRef;
+        }
+        catch (error) {
+            console.warn("Failed to resolve delegation:", error);
+            return undefined;
+        }
     }
 }
 exports.DefaultDelegationHooks = DefaultDelegationHooks;

package/dist/runtime/delegation-verifier-agentshield.js

@@ -93,7 +93,9 @@ class AgentShieldAPIDelegationVerifier {
             baseUrl: this.apiUrl,
             apiKey: this.apiKey,
             fetchProvider,
-            logger: this.debug ? (msg, data) => console.log(`[AgentShield] ${msg}`, data) : undefined,
+            logger: this.debug
+                ? (msg, data) => console.error(`[AgentShield] ${msg}`, data)
+                : undefined,
         });
     }
     /**
@@ -121,14 +123,14 @@ class AgentShieldAPIDelegationVerifier {
             const cached = this.cache.get(cacheKey);
             if (cached) {
                 if (this.debug) {
-                    console.log(`[AgentShield] Cache HIT for ${agentDid} (${Date.now() - startTime}ms)`);
+                    console.error(`[AgentShield] Cache HIT for ${agentDid} (${Date.now() - startTime}ms)`);
                 }
                 return { ...cached, cached: true };
             }
         }
         // Slow path: API call
         if (this.debug) {
-            console.log(`[AgentShield] Cache MISS for ${agentDid}, calling API...`);
+            console.error(`[AgentShield] Cache MISS for ${agentDid}, calling API...`);
         }
         try {
             // Validate request input using contracts schema
@@ -153,7 +155,7 @@ class AgentShieldAPIDelegationVerifier {
             const ttl = data.valid ? this.cacheTtl : this.cacheTtl / 2;
             this.cache.set(cacheKey, result, ttl);
             if (this.debug) {
-                console.log(`[AgentShield] Delegation ${data.valid ? "verified" : "rejected"} (${Date.now() - startTime}ms)`);
+                console.error(`[AgentShield] Delegation ${data.valid ? "verified" : "rejected"} (${Date.now() - startTime}ms)`);
             }
             return result;
         }
@@ -240,7 +242,7 @@ class AgentShieldAPIDelegationVerifier {
             this.cache.delete(`delegation:${delegation.id}`);
             this.cache.delete(`verify:${delegation.subjectDid}:${scopesKey}`);
             if (this.debug) {
-                console.log(`[AgentShield] Stored delegation ${delegation.id}`);
+                console.error(`[AgentShield] Stored delegation ${delegation.id}`);
             }
         }
         catch (error) {
@@ -267,7 +269,7 @@ class AgentShieldAPIDelegationVerifier {
             // Invalidate cache
             this.cache.delete(`delegation:${delegationId}`);
             if (this.debug) {
-                console.log(`[AgentShield] Revoked delegation ${delegationId}`);
+                console.error(`[AgentShield] Revoked delegation ${delegationId}`);
             }
         }
         catch (error) {

package/dist/runtime/delegation-verifier-kv.d.ts

@@ -15,8 +15,8 @@
  *
  * Related: PHASE_1_XMCP_I_SERVER.md Ticket 1.2
  */
-import { DelegationRecord } from '@kya-os/contracts/delegation';
-import { DelegationVerifier, DelegationVerifierConfig, VerifyDelegationResult, VerifyDelegationOptions } from './delegation-verifier';
+import { DelegationRecord } from "@kya-os/contracts/delegation";
+import { DelegationVerifier, DelegationVerifierConfig, VerifyDelegationResult, VerifyDelegationOptions } from "./delegation-verifier";
 /**
  * Cloudflare KV Delegation Verifier
  *

package/dist/runtime/delegation-verifier-kv.js

@@ -72,7 +72,7 @@ class CloudflareKVDelegationVerifier {
     debug;
     constructor(config) {
         if (!config.kvNamespace) {
-            throw new Error('CloudflareKVDelegationVerifier requires kvNamespace in config');
+            throw new Error("CloudflareKVDelegationVerifier requires kvNamespace in config");
         }
         this.kv = config.kvNamespace;
         this.cache = new DelegationCache();
@@ -84,11 +84,15 @@ class CloudflareKVDelegationVerifier {
      */
     async verify(agentDid, scopes, options) {
         // Validate inputs
-        const validation = delegation_verifier_2.VerifyDelegationInputSchema.safeParse({ agentDid, scopes, options });
+        const validation = delegation_verifier_2.VerifyDelegationInputSchema.safeParse({
+            agentDid,
+            scopes,
+            options,
+        });
         if (!validation.success) {
             return {
                 valid: false,
-                reason: `Invalid request: ${validation.error.errors.map(e => `${e.path.join('.')}: ${e.message}`).join(', ')}`,
+                reason: `Invalid request: ${validation.error.errors.map((e) => `${e.path.join(".")}: ${e.message}`).join(", ")}`,
             };
         }
         const startTime = Date.now();
@@ -100,27 +104,29 @@ class CloudflareKVDelegationVerifier {
             const cached = this.cache.get(cacheKey);
             if (cached) {
                 if (this.debug) {
-                    console.log(`[KV] Cache HIT for ${agentDid} (${Date.now() - startTime}ms)`);
+                    console.error(`[KV] Cache HIT for ${agentDid} (${Date.now() - startTime}ms)`);
                 }
                 return { ...cached, cached: true };
             }
         }
         // Slow path: Lookup in KV
         if (this.debug) {
-            console.log(`[KV] Cache MISS for ${agentDid}, querying KV...`);
+            console.error(`[KV] Cache MISS for ${agentDid}, querying KV...`);
         }
         // List all delegations for this agent (to support subset scope matching)
-        const listResult = await this.kv.list({ prefix: `agent:${agentDid}:scopes:` });
+        const listResult = await this.kv.list({
+            prefix: `agent:${agentDid}:scopes:`,
+        });
         if (!listResult.keys || listResult.keys.length === 0) {
             const result = {
                 valid: false,
-                reason: 'No delegation found for agent',
+                reason: "No delegation found for agent",
                 cached: false,
             };
             // Cache negative result (shorter TTL)
             this.cache.set(cacheKey, result, this.cacheTtl / 2);
             if (this.debug) {
-                console.log(`[KV] No delegation found (${Date.now() - startTime}ms)`);
+                console.error(`[KV] No delegation found (${Date.now() - startTime}ms)`);
             }
             return result;
         }
@@ -145,12 +151,12 @@ class CloudflareKVDelegationVerifier {
         if (!matchingDelegation) {
             const result = {
                 valid: false,
-                reason: 'No delegation found with required scopes',
+                reason: "No delegation found with required scopes",
                 cached: false,
             };
             this.cache.set(cacheKey, result, this.cacheTtl / 2);
             if (this.debug) {
-                console.log(`[KV] No matching delegation found (${Date.now() - startTime}ms)`);
+                console.error(`[KV] No matching delegation found (${Date.now() - startTime}ms)`);
             }
             return result;
         }
@@ -174,7 +180,7 @@ class CloudflareKVDelegationVerifier {
             const result = {
                 valid: false,
                 delegation,
-                reason: 'Insufficient scopes',
+                reason: "Insufficient scopes",
                 cached: false,
             };
             this.cache.set(cacheKey, result, this.cacheTtl / 2);
@@ -189,7 +195,7 @@ class CloudflareKVDelegationVerifier {
         // Cache positive result
         this.cache.set(cacheKey, result, this.cacheTtl);
         if (this.debug) {
-            console.log(`[KV] Delegation verified (${Date.now() - startTime}ms)`);
+            console.error(`[KV] Delegation verified (${Date.now() - startTime}ms)`);
         }
         return result;
     }
@@ -206,13 +212,13 @@ class CloudflareKVDelegationVerifier {
             const data = JSON.parse(raw);
             const parsed = delegation_1.DelegationRecordSchema.safeParse(data);
             if (!parsed.success) {
-                console.error('[KV] Invalid delegation record:', parsed.error);
+                console.error("[KV] Invalid delegation record:", parsed.error);
                 return null;
             }
             return parsed.data;
         }
         catch (error) {
-            console.error('[KV] Failed to parse delegation:', error);
+            console.error("[KV] Failed to parse delegation:", error);
             return null;
         }
     }
@@ -238,7 +244,7 @@ class CloudflareKVDelegationVerifier {
         this.cache.delete(`delegation:${validated.id}`);
         this.cache.delete(`verify:${validated.subjectDid}:${scopesKey}`);
         if (this.debug) {
-            console.log(`[KV] Stored delegation ${validated.id}`);
+            console.error(`[KV] Stored delegation ${validated.id}`);
         }
     }
     /**
@@ -250,7 +256,7 @@ class CloudflareKVDelegationVerifier {
             throw new Error(`Delegation not found: ${delegationId}`);
         }
         // Update status
-        delegation.status = 'revoked';
+        delegation.status = "revoked";
         delegation.revokedAt = Date.now();
         if (reason) {
             delegation.revokedReason = reason;
@@ -258,7 +264,7 @@ class CloudflareKVDelegationVerifier {
         // Store updated record
         await this.put(delegation);
         if (this.debug) {
-            console.log(`[KV] Revoked delegation ${delegationId}`);
+            console.error(`[KV] Revoked delegation ${delegationId}`);
         }
     }
     /**
@@ -268,7 +274,7 @@ class CloudflareKVDelegationVerifier {
         // Sort scopes for deterministic key
         const sorted = [...scopes].sort();
         // Simple hash (for production, consider crypto.subtle.digest)
-        const str = sorted.join(',');
+        const str = sorted.join(",");
         let hash = 0;
         for (let i = 0; i < str.length; i++) {
             const char = str.charCodeAt(i);

package/dist/runtime/delegation-verifier-memory.d.ts

@@ -11,8 +11,8 @@
  *
  * Related: PHASE_1_XMCP_I_SERVER.md Testing section
  */
-import { DelegationRecord } from '@kya-os/contracts/delegation';
-import { DelegationVerifier, DelegationVerifierConfig, VerifyDelegationResult, VerifyDelegationOptions } from './delegation-verifier';
+import { DelegationRecord } from "@kya-os/contracts/delegation";
+import { DelegationVerifier, DelegationVerifierConfig, VerifyDelegationResult, VerifyDelegationOptions } from "./delegation-verifier";
 /**
  * Memory Delegation Verifier
  *

package/dist/runtime/delegation-verifier-memory.js

@@ -33,11 +33,15 @@ class MemoryDelegationVerifier {
      */
     async verify(agentDid, scopes, _options) {
         // Validate inputs
-        const validation = delegation_verifier_1.VerifyDelegationInputSchema.safeParse({ agentDid, scopes, options: _options });
+        const validation = delegation_verifier_1.VerifyDelegationInputSchema.safeParse({
+            agentDid,
+            scopes,
+            options: _options,
+        });
         if (!validation.success) {
             return {
                 valid: false,
-                reason: `Invalid request: ${validation.error.errors.map(e => `${e.path.join('.')}: ${e.message}`).join(', ')}`,
+                reason: `Invalid request: ${validation.error.errors.map((e) => `${e.path.join(".")}: ${e.message}`).join(", ")}`,
             };
         }
         // Find all delegations for this agent
@@ -45,7 +49,7 @@ class MemoryDelegationVerifier {
         if (!delegationIds || delegationIds.size === 0) {
             return {
                 valid: false,
-                reason: 'No delegation found for agent',
+                reason: "No delegation found for agent",
                 cached: false,
             };
         }
@@ -71,7 +75,7 @@ class MemoryDelegationVerifier {
         // No matching delegation found
         return {
             valid: false,
-            reason: 'No delegation with required scopes',
+            reason: "No delegation with required scopes",
             cached: false,
         };
     }
@@ -99,7 +103,7 @@ class MemoryDelegationVerifier {
         }
         this.agentIndex.get(validated.subjectDid).add(validated.id);
         if (this.debug) {
-            console.log(`[Memory] Stored delegation ${validated.id}`);
+            console.error(`[Memory] Stored delegation ${validated.id}`);
         }
     }
     /**
@@ -110,13 +114,13 @@ class MemoryDelegationVerifier {
         if (!delegation) {
             throw new Error(`Delegation not found: ${delegationId}`);
         }
-        delegation.status = 'revoked';
+        delegation.status = "revoked";
         delegation.revokedAt = Date.now();
         if (reason) {
             delegation.revokedReason = reason;
         }
         if (this.debug) {
-            console.log(`[Memory] Revoked delegation ${delegationId}`);
+            console.error(`[Memory] Revoked delegation ${delegationId}`);
         }
     }
     /**