@atlasauth/pca-fetch 0.1.0 → 0.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Atlas Authorization
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,8 +1,6 @@
 # @atlasauth/pca-fetch
 
-Runtime-neutral Web **Fetch** guard for Proof-Carrying Authority — verify an inbound PCActn in any
-`Request → Response` runtime: Cloudflare Workers, Deno, Bun, Vercel Edge, Netlify, a Lambda Function
-URL. Web platform only, no Node APIs.
+Runtime-neutral Web Fetch guard for Proof-Carrying Authority. It verifies an inbound PCActn in any `Request -> Response` runtime (Cloudflare Workers, Deno, Bun, Vercel Edge, Netlify, a Lambda Function URL) using only the web platform, with no Node APIs. It wraps the `requirePCA` guard from `@atlasauth/pca`, which is default-deny: a required check that is not enforced denies.
 
 ## Install
 
@@ -10,28 +8,44 @@ URL. Web platform only, no Node APIs.
 npm i @atlasauth/pca-fetch
 ```
 
+Depends on `@atlasauth/pca`.
+
 ## Usage
 
 ```ts
 import { withPCA } from '@atlasauth/pca-fetch';
+import { memoryPcaStore } from '@atlasauth/pca';
 
 export default {
   fetch: withPCA(
     {
-      audience: 'ins_acme',
-      resolveGrant: async (grantRef) => grants.get(grantRef),   // your grant store
-      context: async () => ({ params: { amount: 20, currency: 'usd' }, budget: { B: 500, tau: 0 }, planAuthorized: true }),
+      audience: 'ins_acme',                       // the audience a PCActn must name
+      resolveGrant: async (grantRef) => grants.get(grantRef) ?? null, // your root-grant store
+      budgetStore: memoryPcaStore(),              // replay counter + budget; use a shared store in production
+      hooks: { revocation: myRevocationChecker }, // e.g. built with createRevocationChecker from @atlasauth/pca
+      context: async (req, pcactn) => ({
+        plan: knownPlan(pcactn),                  // the plan your server knows for this action
+        planAuthorized: true,                     // only if the principal authorized that plan root
+        params: { amount: 20, currency: 'usd' },
+        risk: { reversibility: 1, blastRadius: 0, confidence: 1, semanticDistance: 0, taint: 0 },
+        budget: { B: 500, tau: 0, asOf: Date.now() },
+      }),
     },
-    async (req, { pca }) => Response.json({ ok: true, verdict: pca.verdict }),
+    async (req, { pca }) => Response.json({ ok: true, verb: pca.pcactn.action.verb }),
   ),
 };
 ```
 
-On success your handler runs with `{ pca: { verdict, pcactn } }`; otherwise a `401/403` `Response`
-with a `WWW-Authenticate` challenge is returned. `createPcaFetchGuard(opts)` returns the raw guard
-result if you want to compose it into your own router. The client sends the PCActn as
-`PCA-Action: <base64url>` or a JSON body `{ pcactn }`.
+On success your handler runs with `{ pca: { verdict, pcactn } }`. Otherwise a `401` or `403` `Response` is returned with a `WWW-Authenticate: PCA realm=...` challenge and a JSON body (shape it with `denyBody`). `createPcaFetchGuard(opts)` returns the raw guard result if you want to compose it into your own router.
+
+The client sends the PCActn as a `PCA-Action: <base64url>` header (see `pcaHeaders` in `@atlasauth/pca`) or a JSON body `{ pcactn }`. By default the following checks must pass or the request is denied: `counter` (needs a `budgetStore`), `revocation` (needs `hooks.revocation`), `plan_root_authorized` (needs `context()` returning `planAuthorized: true`), plus audience, validity and grant binding. Options are those of `requirePCA`; see `@atlasauth/pca`. `insecureAllowUnenforced: true` disables the default-deny profile and is for local development only.
+
+Nothing here authorizes on its own: the verifier decides, not the client's proof.
+
+## Status
+
+Experimental. Part of Proof-Carrying Authority; the cryptography is unaudited.
 
-Nothing here authorizes on its own — the resource server's verifier (default-deny) decides.
+## License
 
-Part of Proof-Carrying Authority — see [`@atlasauth/pca`](../pca).
+MIT - see LICENSE

package/dist/index.d.ts

@@ -10,13 +10,13 @@
  *   }) };
  *
  * It verifies the inbound PCActn with the framework-agnostic `requirePCA` guard from
- * `@atlasauth/backend` (default-deny) and, on success, calls your handler with the verdict + PCActn;
+ * `@atlasauth/pca` (default-deny) and, on success, calls your handler with the verdict + PCActn;
  * otherwise it returns a 401/403 `Response` with a WWW-Authenticate challenge. The client sends the
  * PCActn as `PCA-Action: <base64url>` (see `@atlasauth/pca` `pcaHeaders`) or a JSON body `{ pcactn }`.
  * Nothing here authorizes on its own — the resource server's verifier decides.
  */
-import { requirePCA, defaultExtract, memoryPcaStore } from '@atlasauth/backend';
-import type { PcaGuardResult, RequirePcaOptions, PcaStateStore } from '@atlasauth/backend';
+import { requirePCA, defaultExtract, memoryPcaStore } from '@atlasauth/pca';
+import type { PcaGuardResult, RequirePcaOptions, PcaStateStore } from '@atlasauth/pca';
 import type { PCActn } from '@atlasauth/pca';
 /** The verdict + PCActn handed to a guarded handler on success. */
 export interface PcaContextValue {

package/dist/index.js

@@ -11,7 +11,7 @@
  *   }) };
  *
  * It verifies the inbound PCActn with the framework-agnostic `requirePCA` guard from
- * `@atlasauth/backend` (default-deny) and, on success, calls your handler with the verdict + PCActn;
+ * `@atlasauth/pca` (default-deny) and, on success, calls your handler with the verdict + PCActn;
  * otherwise it returns a 401/403 `Response` with a WWW-Authenticate challenge. The client sends the
  * PCActn as `PCA-Action: <base64url>` (see `@atlasauth/pca` `pcaHeaders`) or a JSON body `{ pcactn }`.
  * Nothing here authorizes on its own — the resource server's verifier decides.
@@ -20,10 +20,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = void 0;
 exports.createPcaFetchGuard = createPcaFetchGuard;
 exports.withPCA = withPCA;
-const backend_1 = require("@atlasauth/backend");
-Object.defineProperty(exports, "requirePCA", { enumerable: true, get: function () { return backend_1.requirePCA; } });
-Object.defineProperty(exports, "defaultExtract", { enumerable: true, get: function () { return backend_1.defaultExtract; } });
-Object.defineProperty(exports, "memoryPcaStore", { enumerable: true, get: function () { return backend_1.memoryPcaStore; } });
+const pca_1 = require("@atlasauth/pca");
+Object.defineProperty(exports, "requirePCA", { enumerable: true, get: function () { return pca_1.requirePCA; } });
+Object.defineProperty(exports, "defaultExtract", { enumerable: true, get: function () { return pca_1.defaultExtract; } });
+Object.defineProperty(exports, "memoryPcaStore", { enumerable: true, get: function () { return pca_1.memoryPcaStore; } });
 /** Adapt a web `Request` to the framework-agnostic `PcaRequestLike` (headers getter + parsed JSON body). */
 async function toPcaRequest(req) {
     let body;
@@ -48,7 +48,7 @@ function denyResponse(result, denyBody) {
  * (e.g. inside an existing router). Use `withPCA` for the common wrap-a-handler case.
  */
 function createPcaFetchGuard(options) {
-    const guard = (0, backend_1.requirePCA)(options);
+    const guard = (0, pca_1.requirePCA)(options);
     return async (req) => guard(await toPcaRequest(req));
 }
 /** Wrap a Fetch handler so the inbound PCActn is verified first; on success your handler runs with the verdict. */

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;AAwCH,kDAGC;AAKD,0BAOC;AArDD,gDAAgF;AAuDvE,2FAvDA,oBAAU,OAuDA;AAAE,+FAvDA,wBAAc,OAuDA;AAAE,+FAvDA,wBAAc,OAuDA;AAxCnD,4GAA4G;AAC5G,KAAK,UAAU,YAAY,CAAC,GAAY;IACtC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,wEAAwE;QACxE,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED,SAAS,YAAY,CAAC,MAA8C,EAAE,QAAsC;IAC1G,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC1H,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC/E,IAAI,MAAM,CAAC,eAAe;QAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC;IACjF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,OAAwB;IAC1D,MAAM,KAAK,GAAG,IAAA,oBAAU,EAAC,OAAO,CAAC,CAAC;IAClC,OAAO,KAAK,EAAE,GAAY,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAID,mHAAmH;AACnH,SAAgB,OAAO,CAAC,OAAwB,EAAE,OAAwB;IACxE,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,KAAK,EAAE,GAAY,EAAqB,EAAE;QAC/C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChG,OAAO,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;AAwCH,kDAGC;AAKD,0BAOC;AArDD,wCAA4E;AAuDnE,2FAvDA,gBAAU,OAuDA;AAAE,+FAvDA,oBAAc,OAuDA;AAAE,+FAvDA,oBAAc,OAuDA;AAxCnD,4GAA4G;AAC5G,KAAK,UAAU,YAAY,CAAC,GAAY;IACtC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,wEAAwE;QACxE,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED,SAAS,YAAY,CAAC,MAA8C,EAAE,QAAsC;IAC1G,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC1H,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC/E,IAAI,MAAM,CAAC,eAAe;QAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC;IACjF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,OAAwB;IAC1D,MAAM,KAAK,GAAG,IAAA,gBAAU,EAAC,OAAO,CAAC,CAAC;IAClC,OAAO,KAAK,EAAE,GAAY,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAID,mHAAmH;AACnH,SAAgB,OAAO,CAAC,OAAwB,EAAE,OAAwB;IACxE,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,KAAK,EAAE,GAAY,EAAqB,EAAE;QAC/C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChG,OAAO,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,7 +1,28 @@
 {
   "name": "@atlasauth/pca-fetch",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Runtime-neutral Web Fetch guard for Proof-Carrying Authority: verify an inbound PCActn in any Request→Response runtime (Cloudflare Workers, Deno, Bun, Vercel Edge, Lambda).",
+  "keywords": [
+    "web fetch",
+    "cloudflare workers",
+    "deno",
+    "bun",
+    "edge",
+    "agent authorization",
+    "proof-carrying authority",
+    "pca",
+    "ai agents"
+  ],
+  "license": "MIT",
+  "homepage": "https://github.com/Atlas-Authorization/pca#readme",
+  "bugs": {
+    "url": "https://github.com/Atlas-Authorization/pca/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Atlas-Authorization/pca.git",
+    "directory": "packages/pca-fetch"
+  },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -12,8 +33,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@atlasauth/pca": "0.1.0",
-    "@atlasauth/backend": "0.3.0"
+    "@atlasauth/pca": "0.3.0"
   },
   "devDependencies": {
     "typescript": "^5.6.3",
@@ -21,8 +41,12 @@
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
+  "engines": {
+    "node": ">=20"
+  },
   "publishConfig": {
     "access": "public"
   },