@atlasauth/pca-express 0.1.0 → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Atlas Authorization
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,6 +1,6 @@
 # @atlasauth/pca-express
 
-Express middleware for Proof-Carrying Authority: requirePCA() verifies the inbound PCActn and attaches the verdict, or answers 401/403 with a WWW-Authenticate challenge.
+Express middleware for Proof-Carrying Authority. `pcaExpress()` verifies the inbound PCActn with the `requirePCA` guard from `@atlasauth/pca`, attaches `{ verdict, pcactn }` to the request on success, and otherwise answers `401` or `403` with a `WWW-Authenticate` challenge. It is default-deny: a required check that is not enforced denies.
 
 ## Install
 
@@ -10,27 +10,48 @@ npm i @atlasauth/pca-express
 npm i express
 ```
 
-`express` (v4 or v5) is an optional peer dependency.
+`express` (v4 or v5) is an optional peer dependency; it is never imported, so the middleware works with any compatible request/response shape. Depends on `@atlasauth/pca`.
 
 ## Usage
 
 ```ts
 import { pcaExpress } from '@atlasauth/pca-express';
+import { memoryPcaStore } from '@atlasauth/pca';
+
+app.use(express.json());
 
 app.post(
   '/refunds',
   pcaExpress({
-    audience: 'ins_acme',   // this resource server's / instance id the PCActn must name
-    resolveGrant,           // (ref) => Capability — look up the root grant
-    budgetStore,            // per-holder replay/budget store
+    audience: 'ins_acme',                       // the audience a PCActn must name
+    resolveGrant: async (ref) => grants.get(ref) ?? null, // your root-grant store
+    budgetStore: memoryPcaStore(),              // replay counter + budget; use a shared store in production
+    hooks: { revocation: myRevocationChecker }, // e.g. built with createRevocationChecker from @atlasauth/pca
+    context: async (req, pcactn) => ({
+      plan: knownPlan(pcactn),                  // the plan your server knows for this action
+      planAuthorized: true,                     // only if the principal authorized that plan root
+      params: req.body?.params,
+      risk: { reversibility: 1, blastRadius: 0, confidence: 1, semanticDistance: 0, taint: 0 },
+      budget: { B: 500, tau: 0, asOf: Date.now() },
+    }),
   }),
   (req, res) => {
-    const { verdict, pcactn } = req.pca!;  // attached on success
+    const { verdict, pcactn } = req.pca!;       // attached on success (rename with `attachAs`)
     res.json({ ok: true });
   },
 );
 ```
 
-The client sends the PCActn as `PCA-Action: <base64url>` (see `@atlasauth/pca` `pcaHeaders`) or a JSON body `{ pcactn }` — the default extractor reads both. The middleware verifies and is default-deny (an unenforced required check denies); it is the verifier that decides, not the client's proof.
+The client sends the PCActn as a `PCA-Action: <base64url>` header (see `pcaHeaders` in `@atlasauth/pca`) or a JSON body `{ pcactn }`; the default extractor reads both. Override the deny response with `onDeny(result, req, res)`. All other options are those of `requirePCA`; see `@atlasauth/pca`.
+
+By default the `counter`, `revocation` and `plan_root_authorized` checks (plus audience, validity and grant binding) must pass, which is why `budgetStore`, `hooks.revocation` and `context()` are supplied above. `insecureAllowUnenforced: true` turns that off and is for local development only.
+
+The verifier decides, not the client's proof.
+
+## Status
+
+Experimental. Part of Proof-Carrying Authority; the cryptography is unaudited.
+
+## License
 
-Part of Proof-Carrying Authority — see `@atlasauth/pca`.
+MIT - see LICENSE

package/dist/index.d.ts

@@ -5,7 +5,7 @@
  *     pcaExpress({ audience: 'ins_acme', resolveGrant, budgetStore, hooks, context }),
  *     (req, res) => { const { verdict, pcactn } = req.pca!; ... });
  *
- * It verifies the inbound PCActn with the framework-agnostic `requirePCA` guard from `@atlasauth/backend`
+ * It verifies the inbound PCActn with the framework-agnostic `requirePCA` guard from `@atlasauth/pca`
  * (default-deny: a required check that is unenforced DENIES) and, on success, attaches the verdict +
  * PCActn to `req[attachAs]` (default `req.pca`). On failure it answers 401/403 with a WWW-Authenticate
  * challenge. The client sends the PCActn as `PCA-Action: <base64url>` (see `@atlasauth/pca` `pcaHeaders`)
@@ -14,8 +14,8 @@
  * `express` is an OPTIONAL peer dependency and is never imported — the request/response/next shapes are
  * structural, so this stays compatible across Express 4 and 5.
  */
-import { requirePCA, defaultExtract, memoryPcaStore } from '@atlasauth/backend';
-import type { PcaGuardResult, RequirePcaOptions, PcaStateStore } from '@atlasauth/backend';
+import { requirePCA, defaultExtract, memoryPcaStore } from '@atlasauth/pca';
+import type { PcaGuardResult, RequirePcaOptions, PcaStateStore } from '@atlasauth/pca';
 import type { PCActn } from '@atlasauth/pca';
 /** Structural shim of an Express request (only `headers`/`body` are read; the rest passes through). */
 export interface ExpressRequestLike {

package/dist/index.js

@@ -6,7 +6,7 @@
  *     pcaExpress({ audience: 'ins_acme', resolveGrant, budgetStore, hooks, context }),
  *     (req, res) => { const { verdict, pcactn } = req.pca!; ... });
  *
- * It verifies the inbound PCActn with the framework-agnostic `requirePCA` guard from `@atlasauth/backend`
+ * It verifies the inbound PCActn with the framework-agnostic `requirePCA` guard from `@atlasauth/pca`
  * (default-deny: a required check that is unenforced DENIES) and, on success, attaches the verdict +
  * PCActn to `req[attachAs]` (default `req.pca`). On failure it answers 401/403 with a WWW-Authenticate
  * challenge. The client sends the PCActn as `PCA-Action: <base64url>` (see `@atlasauth/pca` `pcaHeaders`)
@@ -18,15 +18,15 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = void 0;
 exports.pcaExpress = pcaExpress;
-const backend_1 = require("@atlasauth/backend");
-Object.defineProperty(exports, "requirePCA", { enumerable: true, get: function () { return backend_1.requirePCA; } });
-Object.defineProperty(exports, "defaultExtract", { enumerable: true, get: function () { return backend_1.defaultExtract; } });
-Object.defineProperty(exports, "memoryPcaStore", { enumerable: true, get: function () { return backend_1.memoryPcaStore; } });
+const pca_1 = require("@atlasauth/pca");
+Object.defineProperty(exports, "requirePCA", { enumerable: true, get: function () { return pca_1.requirePCA; } });
+Object.defineProperty(exports, "defaultExtract", { enumerable: true, get: function () { return pca_1.defaultExtract; } });
+Object.defineProperty(exports, "memoryPcaStore", { enumerable: true, get: function () { return pca_1.memoryPcaStore; } });
 /** Build an Express middleware that requires a valid PCActn on the request. */
 function pcaExpress(options) {
     const attachAs = options.attachAs ?? 'pca';
     const onDeny = options.onDeny;
-    const guard = (0, backend_1.requirePCA)(options);
+    const guard = (0, pca_1.requirePCA)(options);
     return async (req, res, next) => {
         let result;
         try {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAoCH,gCAyBC;AA3DD,gDAAgF;AA6DvE,2FA7DA,oBAAU,OA6DA;AAAE,+FA7DA,wBAAc,OA6DA;AAAE,+FA7DA,wBAAc,OA6DA;AA5BnD,+EAA+E;AAC/E,SAAgB,UAAU,CAAC,OAA0B;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAA,oBAAU,EAAC,OAAO,CAAC,CAAC;IAClC,OAAO,KAAK,EAAE,GAAuB,EAAE,GAAwB,EAAE,IAAqB,EAAiB,EAAE;QACvG,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAoB,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,CAAC,CAAC;YACR,OAAO;QACT,CAAC;QACD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACb,GAA+B,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YAChG,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,eAAe;YAAE,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAoCH,gCAyBC;AA3DD,wCAA4E;AA6DnE,2FA7DA,gBAAU,OA6DA;AAAE,+FA7DA,oBAAc,OA6DA;AAAE,+FA7DA,oBAAc,OA6DA;AA5BnD,+EAA+E;AAC/E,SAAgB,UAAU,CAAC,OAA0B;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAA,gBAAU,EAAC,OAAO,CAAC,CAAC;IAClC,OAAO,KAAK,EAAE,GAAuB,EAAE,GAAwB,EAAE,IAAqB,EAAiB,EAAE;QACvG,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAoB,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,CAAC,CAAC;YACR,OAAO;QACT,CAAC;QACD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACb,GAA+B,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YAChG,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,eAAe;YAAE,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,7 +1,27 @@
 {
   "name": "@atlasauth/pca-express",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Express middleware for Proof-Carrying Authority: requirePCA() verifies the inbound PCActn and attaches the verdict, or answers 401/403 with a WWW-Authenticate challenge.",
+  "keywords": [
+    "express",
+    "middleware",
+    "401",
+    "403",
+    "agent authorization",
+    "proof-carrying authority",
+    "pca",
+    "ai agents"
+  ],
+  "license": "MIT",
+  "homepage": "https://github.com/Atlas-Authorization/pca#readme",
+  "bugs": {
+    "url": "https://github.com/Atlas-Authorization/pca/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Atlas-Authorization/pca.git",
+    "directory": "packages/pca-express"
+  },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -12,8 +32,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@atlasauth/pca": "0.1.0",
-    "@atlasauth/backend": "0.3.0"
+    "@atlasauth/pca": "0.2.0"
   },
   "peerDependencies": {
     "express": "^4 || ^5"
@@ -29,8 +48,12 @@
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
+  "engines": {
+    "node": ">=20"
+  },
   "publishConfig": {
     "access": "public"
   },