@atlasauth/pca-mcp-rs 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Atlas Authorization
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,63 @@
-# Temporary Holding Version
+# @atlasauth/pca-mcp-rs
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+MCP authorization resource server for the 2026-07-28 MCP authorization revision, backed by Proof-Carrying Authority (PCA). Where `@atlasauth/pca-mcp` wraps tool handlers on the client so each call carries a PCActn, this package makes the server that receives those calls a correct OAuth 2.1 resource server: it serves RFC 9728 Protected Resource Metadata, validates Client-ID Metadata Documents, enforces RFC 8707 resource binding and RFC 9207 issuer validation, accumulates scopes down the delegation chain, and issues RFC 9470 step-up challenges. The authority is the PCActn, not a bearer token: its signed `aud` is the resource binding.
+
+## Install
+
+```sh
+npm i @atlasauth/pca-mcp-rs @atlasauth/pca
+```
+
+Everything is pure and runtime-neutral (no Node builtins, no framework), so it mounts on Express, Fastify, Hono, Next.js, Fetch handlers or any router.
+
+## Usage
+
+```ts
+import { prmHandler, authorizeRequest } from '@atlasauth/pca-mcp-rs';
+
+const resource = 'https://mcp.example.com';
+const authorizationServers = ['https://as.example.com'];
+
+// 1. Serve the Protected Resource Metadata (RFC 9728) at the returned path.
+const prm = prmHandler({ resource, authorizationServers, scopesSupported: ['refund:write'] });
+// GET prm.path  ->  JSON prm.body
+
+// 2. Admit each tool call.
+const result = await authorizeRequest(req /* { headers, body? } */, {
+  resource,                                   // must equal the PCActn's signed `aud`
+  authorizationServers,                       // allowed grant issuers (RFC 9207)
+  resolveGrant: async (ref) => grants.get(ref) ?? null,
+  prmUrl: `${resource}${prm.path}`,
+  tool: 'refund',
+  toolScopes: { refund: 'refund:write' },
+  toolStepUp: { refund: 2 },                  // optional: require a guardian (2) or principal (3) co-sign
+});
+
+if (!result.ok) {
+  // result.status is 401 or 403; send the challenge header with the response.
+  return new Response(JSON.stringify({ error: result.error }), {
+    status: result.status,
+    headers: { 'WWW-Authenticate': result.wwwAuthenticate },
+  });
+}
+result.pcactn; result.grantedScopes; result.checks;
+```
+
+`authorizeRequest` reads the PCActn from the `PCA-Action` header (base64url) or a JSON body `{ pcactn }`, and fails closed: any missing, mismatched or unverifiable element is denied with the correct status and `WWW-Authenticate` challenge, and unexpected errors deny with 403.
+
+## API
+
+- `protectedResourceMetadata(opts)`, `prmHandler(opts)`, `WELL_KNOWN_OAUTH_PRM` - RFC 9728 metadata.
+- `authorizeRequest(req, opts)`, `extractPCActn(req)` - the admission check.
+- `wwwAuthenticateChallenge(opts)` - build a `WWW-Authenticate: Bearer ...` value.
+- `clientIdMetadataDocument(opts)`, `verifyCimd(input, opts?)` - Client-ID Metadata Documents (https `client_id`, redirect URI checks).
+- `accumulateScopes(caveats, base?)`, `isScopeCaveat` - scope narrowing from `scope` caveats.
+- `requiredRolesForTier`, `defaultStepUpSatisfied`, `StepUpChallenge` - step-up helpers.
+
+## Status
+
+Step-up satisfaction defaults to a presence check: `defaultStepUpSatisfied` only tests that the PCActn carries a threshold share from a qualifying role. It does not cryptographically verify the shares. Pass `stepUpSatisfied` to `authorizeRequest` to plug in a real threshold verifier. `authorizeRequest` calls the PCA core verifier with the grant and audience only; it takes no replay store or revocation list, so add those around it if you need them. PCA cryptography has not been independently audited.
+
+## License
+
+MIT - see LICENSE

package/dist/index.d.ts

@@ -0,0 +1,384 @@
+/**
+ * MCP authorization RESOURCE SERVER for the 2026-07-28 revision, backed by Proof-Carrying Authority.
+ *
+ * This is the RS SIDE of the de-facto agent↔tool wire. Where `@atlasauth/pca-mcp` wraps a tool handler on
+ * the CLIENT so each call carries a PCActn, THIS package makes the server that RECEIVES those calls a
+ * correct OAuth-2.1 resource server per the MCP authorization revision of 2026-07-28 — the revision that
+ *
+ *   • keeps RFC 9728 Protected Resource Metadata discovery and the `WWW-Authenticate: Bearer
+ *     resource_metadata="…"` 401 challenge (unchanged since 2025-11-25),
+ *   • REPLACES Dynamic Client Registration with Client-ID Metadata Documents (CIMD): a client's
+ *     `client_id` IS an https URL that dereferences to its own RFC-7591-shaped metadata document, so a
+ *     resource/authorization server never has to register a client out of band,
+ *   • REQUIRES RFC 8707 resource-indicator enforcement (a credential is bound to exactly one resource
+ *     server, so a token minted for RS-A cannot be replayed to RS-B), and
+ *   • REQUIRES RFC 9207 `iss` authorization-server validation (a token whose issuer is not an expected
+ *     AS is rejected — the authorization-server mix-up defense),
+ *   • layers OAuth step-up (RFC 9470, `insufficient_user_authentication`) for actions that need a human.
+ *
+ * The AUTHORITY here is the PCActn, not a bearer token: a PCActn's SIGNED `aud` is the RFC 8707 resource
+ * binding (it cannot be spoofed the way a `resource` indicator can), its capability chain roots at a
+ * pinned issuer (the RFC 9207 anchor), and its signed caveats carry the scope grant that NARROWS down the
+ * delegation chain. `authorizeRequest` is the admission check that verifies all of this through the PCA
+ * core (`verifyPCActnCore`) and FAILS CLOSED: any missing / mismatched / unverifiable element denies with
+ * the correct 401/403 + `WWW-Authenticate` challenge. Step-up is wired to PCA's FROST/CIBA threshold
+ * surface: a tool that needs escalation returns a 401 the MCP client drives to collect a guardian /
+ * principal co-sign, then re-presents a PCActn carrying the threshold.
+ *
+ * Specs implemented (cited per export):
+ *  - RFC 9728  — OAuth 2.0 Protected Resource Metadata       (https://www.rfc-editor.org/rfc/rfc9728)
+ *  - RFC 8707  — Resource Indicators for OAuth 2.0            (https://www.rfc-editor.org/rfc/rfc8707)
+ *  - RFC 9207  — OAuth 2.0 Authorization Server Issuer Id     (https://www.rfc-editor.org/rfc/rfc9207)
+ *  - RFC 6750  — OAuth 2.0 Bearer Token Usage (the challenge shape)
+ *  - RFC 7235  — HTTP/1.1 Authentication (multiple comma-separated challenges in one header)
+ *  - RFC 9470  — OAuth 2.0 Step Up Authentication Challenge   (https://www.rfc-editor.org/rfc/rfc9470)
+ *  - Client-ID Metadata Documents (CIMD) — the DCR replacement adopted by MCP authorization 2026-07-28.
+ *  - MCP Authorization, protocol revision 2026-07-28.
+ *
+ * Pure: every export is I/O-free and runtime-neutral (no Node builtins, no framework) so the same code
+ * mounts on Express / Fastify / Hono / Next / Fetch or any router. The PRM + CIMD documents are PUBLIC,
+ * non-secret configuration. This package does NOT import or modify `@atlasauth/pca-oauth` or
+ * `@atlasauth/pca-mcp`; it mirrors their conventions and verifies through the shared `@atlasauth/pca` core.
+ */
+import { type Capability, type CapabilityChain, type Caveat, type CheckStatus, type PcaDiscoveryDocument, type PCActn, type SignerRole } from '@atlasauth/pca';
+/**
+ * RFC 9728 §3: the Protected Resource Metadata is published at the well-known URI formed by inserting
+ * `/.well-known/oauth-protected-resource` into the resource identifier's path. The MCP 2026-07-28 client
+ * fetches it after a 401 to discover this RS's authorization servers and scopes.
+ */
+export declare const WELL_KNOWN_OAUTH_PRM = "/.well-known/oauth-protected-resource";
+/** RFC 6750 §2 token-presentation methods an RFC 9728 `bearer_methods_supported` may advertise. */
+export type BearerMethod = 'header' | 'body' | 'query';
+/**
+ * The PCA extension block embedded in the PRM (RFC 9728 §3.1 permits collision-resistant extra params):
+ * a generic OAuth/MCP client ignores it, while a PCA-aware client learns this RS verifies a PCActn, which
+ * header it rides, and where the sibling `.well-known/pca-configuration` lives — one-fetch auto-config.
+ */
+export interface PcaResourceExtension {
+    /** The HTTP header the PCActn is read from (base64url value). Mirrors the discovery doc `action_header`. */
+    pca_action_header: string;
+    /** Accepted PCActn signature suites (e.g. ["ed25519","hybrid-ed25519-ml-dsa-65"]). */
+    pca_signature_suites: string[];
+    /** PCActn wire version(s) this RS accepts. */
+    pca_versions: number[];
+    /** Absolute URL of this RS's `.well-known/pca-configuration`. */
+    pca_configuration_endpoint: string;
+    /** The embedded PCA discovery document (from `buildDiscoveryDocument`), for one-fetch auto-config. */
+    pca: PcaDiscoveryDocument;
+}
+/** RFC 9728 §3 Protected Resource Metadata, as required by MCP authorization 2026-07-28, + the PCA block. */
+export interface ProtectedResourceMetadata extends PcaResourceExtension {
+    /**
+     * RFC 9728 §3.1 `resource` (REQUIRED): this protected resource's identifier. For a PCA RS this IS the
+     * value a PCActn's signed `aud` must equal (RFC 8707), so the OAuth advertisement and the cryptographic
+     * audience are one string and cannot drift.
+     */
+    resource: string;
+    /**
+     * RFC 9728 §3.1 `authorization_servers`: the issuer identifiers of the ASs that may issue credentials
+     * for this RS. This is the SAME allowlist `authorizeRequest` enforces as the RFC 9207 mix-up defense —
+     * discovery advertises exactly what admission enforces.
+     */
+    authorization_servers: string[];
+    /** RFC 9728 §3.1 `bearer_methods_supported`: how a bearer credential may be presented. */
+    bearer_methods_supported: BearerMethod[];
+    /** RFC 9728 §3.1 `scopes_supported`: the full scope vocabulary this RS recognizes. */
+    scopes_supported: string[];
+    /** RFC 9728 §3.1 `resource_name` (OPTIONAL). */
+    resource_name?: string;
+    /** RFC 9728 §3.1 `resource_documentation` (OPTIONAL). */
+    resource_documentation?: string;
+    /** RFC 9728 §3.1 `resource_signing_alg_values_supported` (OPTIONAL). */
+    resource_signing_alg_values_supported?: string[];
+    /**
+     * CIMD advertisement (MCP 2026-07-28): this RS/AS accepts Client-ID Metadata Documents in place of
+     * Dynamic Client Registration. Always `true` for a 2026-07-28 PCA RS.
+     */
+    client_id_metadata_document_supported: true;
+}
+export interface ProtectedResourceMetadataOptions {
+    /** REQUIRED: the resource identifier — the SAME string a PCActn's signed `aud` must equal. */
+    resource: string;
+    /** REQUIRED (RFC 9207 anchor): issuer identifiers of the ASs this RS trusts. */
+    authorizationServers: string[];
+    /** REQUIRED: the full scope vocabulary this RS recognizes. */
+    scopesSupported: string[];
+    /** Token-presentation methods. Default `['header']` (a PCActn rides the `PCA-Action` header). */
+    bearerMethodsSupported?: BearerMethod[];
+    resourceName?: string;
+    resourceDocumentation?: string;
+    resourceSigningAlgValuesSupported?: string[];
+    /** Absolute URL of this RS's `.well-known/pca-configuration` (defaults to `<resource>/.well-known/pca-configuration`). */
+    pcaConfigurationEndpoint?: string;
+    signatureSuites?: string[];
+    pcaVersions?: number[];
+    actionHeader?: string;
+    requiredChecks?: string[];
+    endpoints?: PcaDiscoveryDocument['endpoints'];
+    trustedRoots?: string[];
+    metadata?: Record<string, unknown>;
+}
+/**
+ * RFC 9728 — build the Protected Resource Metadata served at {@link WELL_KNOWN_OAUTH_PRM}. The `resource`
+ * is this RS's identifier (= the PCActn audience), `authorization_servers` is the RFC 9207 trusted-issuer
+ * allowlist, and `scopes_supported` is the scope vocabulary. The embedded PCA discovery doc + the
+ * `.well-known/pca-configuration` pointer auto-configure a PCA-aware client. Throws on an empty `resource`
+ * or an absent/empty `authorization_servers`.
+ */
+export declare function protectedResourceMetadata(opts: ProtectedResourceMetadataOptions): ProtectedResourceMetadata;
+/** Framework-agnostic glue — the body + path to serve the RFC 9728 PRM document. */
+export declare function prmHandler(opts: ProtectedResourceMetadataOptions): {
+    path: string;
+    body: ProtectedResourceMetadata;
+};
+export interface WwwAuthenticateChallengeOptions {
+    /** REQUIRED: the absolute URL where {@link protectedResourceMetadata} is served (RFC 9728 pointer). */
+    resourceMetadataUrl: string;
+    /** RFC 6750 §3 `error` (e.g. "invalid_token", "insufficient_scope", "insufficient_user_authentication"). */
+    error?: string;
+    /** RFC 6750 §3 `error_description`. */
+    errorDescription?: string;
+    /** RFC 6750 §3 `scope` the client would need (used with `insufficient_scope`). */
+    scope?: string;
+    /** RFC 9470 `acr_values` — the authentication-context the client must reach (step-up). */
+    acrValues?: string;
+    /** RFC 9470 `max_age` — freshness the client must satisfy (step-up). */
+    maxAge?: number;
+    /** Bearer realm (optional). */
+    realm?: string;
+    /**
+     * Append a PCA step-up challenge as a second RFC-7235 challenge so a PCA-aware client gets the FROST/CIBA
+     * requirement in the same header. Ignored unless set. The structured {@link StepUpChallenge} carries the
+     * same information for the MCP client to drive.
+     */
+    pcaStepUp?: StepUpChallenge;
+}
+/**
+ * MCP 2026-07-28 + RFC 6750 — build the `WWW-Authenticate` value a PCA resource server returns on a 401.
+ * The MCP spec requires `Bearer resource_metadata="<PRM URL>"` pointing at the RFC 9728 document so a
+ * generic MCP/OAuth client can discover the RS. `error`/`error_description`/`scope` follow RFC 6750;
+ * `acr_values`/`max_age` follow RFC 9470 for a step-up challenge. When `pcaStepUp` is given, a second
+ * `PCA-StepUp` challenge is appended (RFC 7235 allows multiple comma-separated challenges) carrying the
+ * tier, required co-signer roles and the FROST/CIBA step-up endpoint. Throws on an empty metadata URL or
+ * any header-injecting parameter value.
+ */
+export declare function wwwAuthenticateChallenge(opts: WwwAuthenticateChallengeOptions): string;
+/**
+ * A Client-ID Metadata Document (MCP 2026-07-28). The client's `client_id` IS an https URL that
+ * dereferences to this document; its fields mirror the OAuth 2.0 Dynamic Client Registration metadata
+ * (RFC 7591). Because the document lives at the `client_id` URL, a resource/authorization server learns
+ * the client's redirect URIs and metadata WITHOUT an out-of-band registration — DCR is not needed.
+ */
+export interface ClientIdMetadataDocument {
+    /** MUST be the https URL this document is served from (self-referential — the CIMD integrity rule). */
+    client_id: string;
+    /** REQUIRED: the client's redirect URIs. Must be non-empty and each a valid, safe redirect URI. */
+    redirect_uris: string[];
+    client_name?: string;
+    client_uri?: string;
+    logo_uri?: string;
+    scope?: string;
+    contacts?: string[];
+    tos_uri?: string;
+    policy_uri?: string;
+    grant_types?: string[];
+    response_types?: string[];
+    token_endpoint_auth_method?: string;
+}
+export interface ClientIdMetadataDocumentOptions {
+    /** The https URL that is the `client_id` (and where this document is published). */
+    clientId: string;
+    /** The client's redirect URIs (non-empty). */
+    redirectUris: string[];
+    clientName?: string;
+    clientUri?: string;
+    logoUri?: string;
+    scope?: string;
+    contacts?: string[];
+    tosUri?: string;
+    policyUri?: string;
+    grantTypes?: string[];
+    responseTypes?: string[];
+    tokenEndpointAuthMethod?: string;
+}
+/**
+ * Build a well-formed Client-ID Metadata Document a client can publish at its `client_id` URL. Validates
+ * the `client_id` is https and every redirect URI is safe; throws otherwise (fail closed at construction).
+ */
+export declare function clientIdMetadataDocument(opts: ClientIdMetadataDocumentOptions): ClientIdMetadataDocument;
+export type VerifyCimdResult = {
+    ok: true;
+    clientId: string;
+    doc?: ClientIdMetadataDocument;
+} | {
+    ok: false;
+    reason: string;
+};
+export interface VerifyCimdOptions {
+    /**
+     * The `client_id` URL the document was dereferenced from. When set, the document's own `client_id` MUST
+     * equal it (the CIMD self-reference / integrity rule): a document that claims a different id is rejected.
+     */
+    expectedClientId?: string;
+}
+/**
+ * CIMD validation (MCP 2026-07-28), the DCR replacement. Two input forms:
+ *
+ *  - a STRING: the `client_id` URL itself. Validates it is a well-formed https URL (http / malformed →
+ *    rejected). The document behind it must still be fetched and validated separately.
+ *  - an OBJECT: a dereferenced {@link ClientIdMetadataDocument}. Validates `client_id` is https, matches
+ *    `expectedClientId` when supplied, and `redirect_uris` is a non-empty array of safe redirect URIs.
+ *
+ * Fails closed: anything missing / http / malformed → `{ ok: false, reason }`. The object form accepts an
+ * untrusted `Record<string, unknown>` (e.g. freshly parsed JSON) as well as a typed document.
+ */
+export declare function verifyCimd(input: string | ClientIdMetadataDocument | Record<string, unknown>, opts?: VerifyCimdOptions): VerifyCimdResult;
+/** The scope caveat convention: a capability hop may carry `{ type: 'scope', scopes: [...] }`. */
+export declare const SCOPE_CAVEAT = "scope";
+export interface ScopeCaveat extends Caveat {
+    type: typeof SCOPE_CAVEAT;
+    scopes: string[];
+}
+export declare function isScopeCaveat(cv: unknown): cv is ScopeCaveat;
+/**
+ * Scope accumulation: the EFFECTIVE granted scopes NARROW monotonically down the chain. Because the
+ * capability chain's caveats are append-only and conjunctive, each `scope` caveat INTERSECTS the running
+ * set — a child can grant a subset of its parent's scopes but never widen. The leaf holds the full
+ * append-only caveat list, so scanning it covers every hop.
+ *
+ *  - `base` given  → start from it and intersect each `scope` caveat (a delegation can only shrink it).
+ *  - `base` absent → the FIRST `scope` caveat seeds the set; later ones intersect it.
+ *  - no `base` and NO `scope` caveat → `[]` (fail closed: nothing is granted to a scoped tool).
+ *
+ * Returns a sorted, de-duplicated array.
+ */
+export declare function accumulateScopes(caveats: Caveat[], base?: string[]): string[];
+/**
+ * The structured step-up requirement an MCP client drives. A tool that needs escalation makes the RS
+ * return a 401 carrying this: the client collects the named co-signer shares via PCA's FROST (threshold)
+ * round or a CIBA push, then re-presents a PCActn carrying the `threshold`. Tier 2 = a guardian co-sign,
+ * tier 3 = a principal (human) co-sign.
+ */
+export interface StepUpChallenge {
+    /** The threshold tier the re-presented PCActn must satisfy (2 guardian / 3 principal). */
+    tier: 2 | 3;
+    /** The signer roles whose FROST/CIBA shares satisfy the tier. */
+    requiredRoles: SignerRole[];
+    /** The PCA step-up endpoint the MCP client drives (FROST round / CIBA push), if advertised. */
+    stepUpEndpoint?: string;
+    /** Human-readable reason. */
+    reason: string;
+    /** The RFC-9470 `acr`-like value echoed in the Bearer challenge (e.g. "pca:tier2"). */
+    acr: string;
+}
+/** The roles that satisfy a tier: tier 3 needs a principal; tier 2 a guardian OR a principal. */
+export declare function requiredRolesForTier(tier: 2 | 3): SignerRole[];
+/**
+ * Default step-up satisfaction: the PCActn already carries a `threshold` share from a role that meets the
+ * tier. This is the ADMISSION-layer presence check (does the proof claim the co-sign?); the cryptographic
+ * verification of each share against the signer set is the threshold verifier's / adjudicator's job — the
+ * PCA core reports `threshold` as 'not-enforced' without a hook, and this mirrors that honesty. Supply
+ * `AuthorizeRequestOptions.stepUpSatisfied` to plug a real verifier in.
+ */
+export declare function defaultStepUpSatisfied(p: PCActn, tier: 2 | 3): boolean;
+/** Framework-agnostic request shape: headers (record or Headers-like) + an optional parsed/raw body. */
+export interface McpRequestLike {
+    headers: Record<string, string | string[] | undefined> | {
+        get(name: string): string | null;
+    };
+    body?: unknown;
+}
+/**
+ * Extract a PCActn from a request: the `PCA-Action` header (base64url-encoded PCActn JSON), else a JSON
+ * body `{ pcactn }` (string or object). Returns the decoded `PCActn`, or `null` when none is present.
+ * Throws only on an unreadable / undecodable encoding (the caller maps that to a 401).
+ */
+export declare function extractPCActn(req: McpRequestLike): PCActn | null;
+export interface AuthorizeRequestOptions {
+    /** REQUIRED (RFC 8707): this RS's id. A PCActn whose signed `aud` differs is rejected (no cross-RS replay). */
+    resource: string;
+    /**
+     * REQUIRED (RFC 9207 mix-up defense): the trusted authorization-server / issuer allowlist. The resolved
+     * grant's issuer (see `resolveIssuer`, default the grant's root issuer) MUST be a member, else the
+     * credential is rejected as coming from an unexpected AS. Same value as the PRM `authorization_servers`.
+     */
+    authorizationServers: string[];
+    /** Resolve the Root Intent Grant from the PCActn's `grant_ref`. `null` = unknown grant (→ 401). */
+    resolveGrant: (grantRef: string, pcactn: PCActn) => Capability | null | Promise<Capability | null>;
+    /** The absolute PRM URL for the `WWW-Authenticate` challenge. */
+    prmUrl: string;
+    /** The MCP tool being invoked (used to look up required scope + step-up tier). */
+    tool?: string;
+    /** Tool → required scope(s) map. The invoked tool's scopes must all be in the effective granted set. */
+    toolScopes?: Record<string, string | string[]>;
+    /** Explicit required scopes for this call (overrides `toolScopes[tool]`). */
+    requiredScopes?: string[];
+    /** Base granted scopes when the grant does not express them as `scope` caveats. Intersected with caveats. */
+    baseScopes?: string[];
+    /** Fully override how the effective granted scopes are computed (else `accumulateScopes(leaf.caveats, baseScopes)`). */
+    resolveGrantedScopes?: (grant: Capability, chain: CapabilityChain, pcactn: PCActn) => string[];
+    /** Tool → minimum threshold tier (2 guardian / 3 principal). A tool needing escalation returns a step-up 401. */
+    toolStepUp?: Record<string, 2 | 3>;
+    /** Explicit minimum tier for this call (overrides `toolStepUp[tool]`). */
+    requiredTier?: 2 | 3;
+    /**
+     * Derive the required tier from the PCActn's own risk claim via the risk policy (RFC-9470 step-up by
+     * risk). When set and no explicit tier applies, `requiredThreshold(pcactn.risk_claim.r, riskTiers).t` is
+     * used. A caller passes the grant's `risk_policy` θ thresholds here.
+     */
+    riskTiers?: {
+        theta1: number;
+        theta2: number;
+    };
+    /** The FROST/CIBA step-up endpoint advertised in the step-up challenge. */
+    stepUpEndpoint?: string;
+    /** Resolve the credential's issuer for RFC 9207 (default: the grant's root `issuer`). */
+    resolveIssuer?: (grant: Capability, pcactn: PCActn) => string;
+    /** Plug a real step-up verifier (default {@link defaultStepUpSatisfied} — a presence check). */
+    stepUpSatisfied?: (pcactn: PCActn, tier: 2 | 3) => boolean;
+    /** Verifier clock (epoch ms). Default `Date.now()`. */
+    now?: number;
+    /** Bearer realm on the challenge (default "pca"). */
+    realm?: string;
+}
+export interface AuthorizeAllow {
+    ok: true;
+    status: 200;
+    pcactn: PCActn;
+    grant: Capability;
+    /** The effective (narrowed) granted scopes for this credential. */
+    grantedScopes: string[];
+    /** The PCA core verdict's per-check status. */
+    checks: Record<string, CheckStatus>;
+}
+export interface AuthorizeDeny {
+    ok: false;
+    status: 401 | 403;
+    error: string;
+    errorDescription: string;
+    /** The ready-to-send `WWW-Authenticate` header value. */
+    wwwAuthenticate: string;
+    /** Present when the denial is a step-up requirement the MCP client must drive. */
+    stepUp?: StepUpChallenge;
+    /** The PCA core verdict's per-check status, when verification ran. */
+    checks?: Record<string, CheckStatus>;
+}
+export type AuthorizeResult = AuthorizeAllow | AuthorizeDeny;
+/**
+ * The resource-server admission check for an MCP 2026-07-28 tool call, with a PCActn as the authority.
+ * It FAILS CLOSED and runs the checks in this order, each with the correct 401/403 + `WWW-Authenticate`:
+ *
+ *   1. extract the PCActn (missing / unreadable → 401 `invalid_request`);
+ *   2. resolve the grant from `grant_ref` (unknown → 401 `invalid_token`);
+ *   3. RFC 8707 — the PCActn's signed `aud` MUST equal this RS's `resource` (mismatch → 401 `invalid_token`);
+ *   4. RFC 9207 — the credential's issuer MUST be in `authorizationServers` (mix-up → 401 `invalid_token`);
+ *   5. the PCA core verification (`verifyPCActnCore`: wire, version, audience, validity, cap_chain,
+ *      plan inclusion, leaf signature, counter). A crypto/binding failure → 401; a policy failure → 403;
+ *   6. scope accumulation — the tool's required scope(s) MUST be in the effective (narrowed) granted set
+ *      (insufficient → 403 `insufficient_scope`, with `scope` in the challenge);
+ *   7. step-up — if the tool needs a tier ≥ 2 co-sign the PCActn does not yet carry, return a 401
+ *      `insufficient_user_authentication` (RFC 9470) carrying the {@link StepUpChallenge}.
+ *
+ * On success it returns the verified PCActn, the grant, the effective granted scopes and the core checks.
+ */
+export declare function authorizeRequest(req: McpRequestLike, opts: AuthorizeRequestOptions): Promise<AuthorizeResult>;

package/dist/index.js

@@ -0,0 +1,542 @@
+"use strict";
+/**
+ * MCP authorization RESOURCE SERVER for the 2026-07-28 revision, backed by Proof-Carrying Authority.
+ *
+ * This is the RS SIDE of the de-facto agent↔tool wire. Where `@atlasauth/pca-mcp` wraps a tool handler on
+ * the CLIENT so each call carries a PCActn, THIS package makes the server that RECEIVES those calls a
+ * correct OAuth-2.1 resource server per the MCP authorization revision of 2026-07-28 — the revision that
+ *
+ *   • keeps RFC 9728 Protected Resource Metadata discovery and the `WWW-Authenticate: Bearer
+ *     resource_metadata="…"` 401 challenge (unchanged since 2025-11-25),
+ *   • REPLACES Dynamic Client Registration with Client-ID Metadata Documents (CIMD): a client's
+ *     `client_id` IS an https URL that dereferences to its own RFC-7591-shaped metadata document, so a
+ *     resource/authorization server never has to register a client out of band,
+ *   • REQUIRES RFC 8707 resource-indicator enforcement (a credential is bound to exactly one resource
+ *     server, so a token minted for RS-A cannot be replayed to RS-B), and
+ *   • REQUIRES RFC 9207 `iss` authorization-server validation (a token whose issuer is not an expected
+ *     AS is rejected — the authorization-server mix-up defense),
+ *   • layers OAuth step-up (RFC 9470, `insufficient_user_authentication`) for actions that need a human.
+ *
+ * The AUTHORITY here is the PCActn, not a bearer token: a PCActn's SIGNED `aud` is the RFC 8707 resource
+ * binding (it cannot be spoofed the way a `resource` indicator can), its capability chain roots at a
+ * pinned issuer (the RFC 9207 anchor), and its signed caveats carry the scope grant that NARROWS down the
+ * delegation chain. `authorizeRequest` is the admission check that verifies all of this through the PCA
+ * core (`verifyPCActnCore`) and FAILS CLOSED: any missing / mismatched / unverifiable element denies with
+ * the correct 401/403 + `WWW-Authenticate` challenge. Step-up is wired to PCA's FROST/CIBA threshold
+ * surface: a tool that needs escalation returns a 401 the MCP client drives to collect a guardian /
+ * principal co-sign, then re-presents a PCActn carrying the threshold.
+ *
+ * Specs implemented (cited per export):
+ *  - RFC 9728  — OAuth 2.0 Protected Resource Metadata       (https://www.rfc-editor.org/rfc/rfc9728)
+ *  - RFC 8707  — Resource Indicators for OAuth 2.0            (https://www.rfc-editor.org/rfc/rfc8707)
+ *  - RFC 9207  — OAuth 2.0 Authorization Server Issuer Id     (https://www.rfc-editor.org/rfc/rfc9207)
+ *  - RFC 6750  — OAuth 2.0 Bearer Token Usage (the challenge shape)
+ *  - RFC 7235  — HTTP/1.1 Authentication (multiple comma-separated challenges in one header)
+ *  - RFC 9470  — OAuth 2.0 Step Up Authentication Challenge   (https://www.rfc-editor.org/rfc/rfc9470)
+ *  - Client-ID Metadata Documents (CIMD) — the DCR replacement adopted by MCP authorization 2026-07-28.
+ *  - MCP Authorization, protocol revision 2026-07-28.
+ *
+ * Pure: every export is I/O-free and runtime-neutral (no Node builtins, no framework) so the same code
+ * mounts on Express / Fastify / Hono / Next / Fetch or any router. The PRM + CIMD documents are PUBLIC,
+ * non-secret configuration. This package does NOT import or modify `@atlasauth/pca-oauth` or
+ * `@atlasauth/pca-mcp`; it mirrors their conventions and verifies through the shared `@atlasauth/pca` core.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SCOPE_CAVEAT = exports.WELL_KNOWN_OAUTH_PRM = void 0;
+exports.protectedResourceMetadata = protectedResourceMetadata;
+exports.prmHandler = prmHandler;
+exports.wwwAuthenticateChallenge = wwwAuthenticateChallenge;
+exports.clientIdMetadataDocument = clientIdMetadataDocument;
+exports.verifyCimd = verifyCimd;
+exports.isScopeCaveat = isScopeCaveat;
+exports.accumulateScopes = accumulateScopes;
+exports.requiredRolesForTier = requiredRolesForTier;
+exports.defaultStepUpSatisfied = defaultStepUpSatisfied;
+exports.extractPCActn = extractPCActn;
+exports.authorizeRequest = authorizeRequest;
+const pca_1 = require("@atlasauth/pca");
+/**
+ * RFC 9728 §3: the Protected Resource Metadata is published at the well-known URI formed by inserting
+ * `/.well-known/oauth-protected-resource` into the resource identifier's path. The MCP 2026-07-28 client
+ * fetches it after a 401 to discover this RS's authorization servers and scopes.
+ */
+exports.WELL_KNOWN_OAUTH_PRM = '/.well-known/oauth-protected-resource';
+// ---------------------------------------------------------------------------------------------------
+// Header-value hygiene (RFC 7235 quoted auth-params): reject control / quote chars to stop injection.
+// ---------------------------------------------------------------------------------------------------
+function quotedParam(value) {
+    if (/["\r\n]/.test(value)) {
+        throw new Error('pca-mcp-rs: a WWW-Authenticate parameter value may not contain a quote or newline');
+    }
+    return value;
+}
+/**
+ * RFC 9728 — build the Protected Resource Metadata served at {@link WELL_KNOWN_OAUTH_PRM}. The `resource`
+ * is this RS's identifier (= the PCActn audience), `authorization_servers` is the RFC 9207 trusted-issuer
+ * allowlist, and `scopes_supported` is the scope vocabulary. The embedded PCA discovery doc + the
+ * `.well-known/pca-configuration` pointer auto-configure a PCA-aware client. Throws on an empty `resource`
+ * or an absent/empty `authorization_servers`.
+ */
+function protectedResourceMetadata(opts) {
+    if (typeof opts.resource !== 'string' || opts.resource.length === 0) {
+        throw new Error('protectedResourceMetadata: `resource` (the RS id = PCActn audience) is required');
+    }
+    if (!Array.isArray(opts.authorizationServers) || opts.authorizationServers.length === 0) {
+        throw new Error('protectedResourceMetadata: `authorizationServers` is required (RFC 9207 mix-up defense anchor)');
+    }
+    if (!Array.isArray(opts.scopesSupported)) {
+        throw new Error('protectedResourceMetadata: `scopesSupported` must be an array');
+    }
+    // One source of truth: the discovery doc's `audience` IS the OAuth `resource`.
+    const discovery = (0, pca_1.buildDiscoveryDocument)({
+        audience: opts.resource,
+        ...(opts.signatureSuites ? { signatureSuites: opts.signatureSuites } : {}),
+        ...(opts.pcaVersions ? { pcaVersions: opts.pcaVersions } : {}),
+        ...(opts.actionHeader ? { actionHeader: opts.actionHeader } : {}),
+        ...(opts.requiredChecks ? { requiredChecks: opts.requiredChecks } : {}),
+        ...(opts.endpoints ? { endpoints: opts.endpoints } : {}),
+        ...(opts.trustedRoots ? { trustedRoots: opts.trustedRoots } : {}),
+        ...(opts.metadata ? { metadata: opts.metadata } : {}),
+    });
+    const pcaConfigurationEndpoint = opts.pcaConfigurationEndpoint ?? opts.resource.replace(/\/+$/, '') + pca_1.WELL_KNOWN_PCA_PATH;
+    const doc = {
+        resource: opts.resource,
+        authorization_servers: [...opts.authorizationServers],
+        bearer_methods_supported: opts.bearerMethodsSupported ? [...opts.bearerMethodsSupported] : ['header'],
+        scopes_supported: [...opts.scopesSupported],
+        client_id_metadata_document_supported: true,
+        pca_action_header: discovery.action_header,
+        pca_signature_suites: [...discovery.signature_suites],
+        pca_versions: [...discovery.pca_versions],
+        pca_configuration_endpoint: pcaConfigurationEndpoint,
+        pca: discovery,
+        ...(opts.resourceName ? { resource_name: opts.resourceName } : {}),
+        ...(opts.resourceDocumentation ? { resource_documentation: opts.resourceDocumentation } : {}),
+        ...(opts.resourceSigningAlgValuesSupported
+            ? { resource_signing_alg_values_supported: [...opts.resourceSigningAlgValuesSupported] }
+            : {}),
+    };
+    return doc;
+}
+/** Framework-agnostic glue — the body + path to serve the RFC 9728 PRM document. */
+function prmHandler(opts) {
+    return { path: exports.WELL_KNOWN_OAUTH_PRM, body: protectedResourceMetadata(opts) };
+}
+/**
+ * MCP 2026-07-28 + RFC 6750 — build the `WWW-Authenticate` value a PCA resource server returns on a 401.
+ * The MCP spec requires `Bearer resource_metadata="<PRM URL>"` pointing at the RFC 9728 document so a
+ * generic MCP/OAuth client can discover the RS. `error`/`error_description`/`scope` follow RFC 6750;
+ * `acr_values`/`max_age` follow RFC 9470 for a step-up challenge. When `pcaStepUp` is given, a second
+ * `PCA-StepUp` challenge is appended (RFC 7235 allows multiple comma-separated challenges) carrying the
+ * tier, required co-signer roles and the FROST/CIBA step-up endpoint. Throws on an empty metadata URL or
+ * any header-injecting parameter value.
+ */
+function wwwAuthenticateChallenge(opts) {
+    if (typeof opts.resourceMetadataUrl !== 'string' || opts.resourceMetadataUrl.length === 0) {
+        throw new Error('wwwAuthenticateChallenge: resourceMetadataUrl is required');
+    }
+    const params = [];
+    if (opts.realm)
+        params.push(`realm="${quotedParam(opts.realm)}"`);
+    params.push(`resource_metadata="${quotedParam(opts.resourceMetadataUrl)}"`);
+    if (opts.error)
+        params.push(`error="${quotedParam(opts.error)}"`);
+    if (opts.errorDescription)
+        params.push(`error_description="${quotedParam(opts.errorDescription)}"`);
+    if (opts.scope)
+        params.push(`scope="${quotedParam(opts.scope)}"`);
+    if (opts.acrValues)
+        params.push(`acr_values="${quotedParam(opts.acrValues)}"`);
+    if (typeof opts.maxAge === 'number' && Number.isFinite(opts.maxAge))
+        params.push(`max_age=${Math.max(0, Math.trunc(opts.maxAge))}`);
+    const challenges = [`Bearer ${params.join(', ')}`];
+    if (opts.pcaStepUp) {
+        const su = opts.pcaStepUp;
+        const suParams = [
+            `realm="${quotedParam(opts.realm ?? 'pca')}"`,
+            `tier="${quotedParam(String(su.tier))}"`,
+            `roles="${quotedParam(su.requiredRoles.join(' '))}"`,
+        ];
+        if (su.stepUpEndpoint)
+            suParams.push(`stepup_uri="${quotedParam(su.stepUpEndpoint)}"`);
+        if (su.acr)
+            suParams.push(`acr="${quotedParam(su.acr)}"`);
+        challenges.push(`PCA-StepUp ${suParams.join(', ')}`);
+    }
+    return challenges.join(', ');
+}
+function isHttpsUrl(s) {
+    if (typeof s !== 'string' || s.length === 0)
+        return false;
+    try {
+        return new URL(s).protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Is `uri` a safe OAuth redirect target? https is always allowed; plain http is allowed ONLY for loopback
+ * (localhost / 127.0.0.1 / [::1]) per the native-app BCP (RFC 8252); a non-http custom scheme (e.g.
+ * `myapp://cb`) is allowed for native apps. Anything else (a non-loopback http URL, an unparseable value)
+ * is rejected.
+ */
+function isAllowedRedirectUri(uri) {
+    if (typeof uri !== 'string' || uri.length === 0)
+        return false;
+    let u;
+    try {
+        u = new URL(uri);
+    }
+    catch {
+        return false;
+    }
+    if (u.protocol === 'https:')
+        return true;
+    if (u.protocol === 'http:') {
+        const h = u.hostname;
+        return h === 'localhost' || h === '127.0.0.1' || h === '[::1]' || h === '::1';
+    }
+    // A non-http(s) custom scheme (native app redirect) — allowed.
+    return u.protocol !== 'http:' && u.protocol.length > 0;
+}
+/**
+ * Build a well-formed Client-ID Metadata Document a client can publish at its `client_id` URL. Validates
+ * the `client_id` is https and every redirect URI is safe; throws otherwise (fail closed at construction).
+ */
+function clientIdMetadataDocument(opts) {
+    if (!isHttpsUrl(opts.clientId)) {
+        throw new Error('clientIdMetadataDocument: `clientId` must be an https URL (CIMD requires https)');
+    }
+    if (!Array.isArray(opts.redirectUris) || opts.redirectUris.length === 0) {
+        throw new Error('clientIdMetadataDocument: at least one redirect URI is required');
+    }
+    for (const r of opts.redirectUris) {
+        if (!isAllowedRedirectUri(r))
+            throw new Error(`clientIdMetadataDocument: unsafe redirect URI ${JSON.stringify(r)}`);
+    }
+    const doc = {
+        client_id: opts.clientId,
+        redirect_uris: [...opts.redirectUris],
+        ...(opts.clientName !== undefined ? { client_name: opts.clientName } : {}),
+        ...(opts.clientUri !== undefined ? { client_uri: opts.clientUri } : {}),
+        ...(opts.logoUri !== undefined ? { logo_uri: opts.logoUri } : {}),
+        ...(opts.scope !== undefined ? { scope: opts.scope } : {}),
+        ...(opts.contacts !== undefined ? { contacts: [...opts.contacts] } : {}),
+        ...(opts.tosUri !== undefined ? { tos_uri: opts.tosUri } : {}),
+        ...(opts.policyUri !== undefined ? { policy_uri: opts.policyUri } : {}),
+        ...(opts.grantTypes !== undefined ? { grant_types: [...opts.grantTypes] } : {}),
+        ...(opts.responseTypes !== undefined ? { response_types: [...opts.responseTypes] } : {}),
+        ...(opts.tokenEndpointAuthMethod !== undefined ? { token_endpoint_auth_method: opts.tokenEndpointAuthMethod } : {}),
+    };
+    return doc;
+}
+/**
+ * CIMD validation (MCP 2026-07-28), the DCR replacement. Two input forms:
+ *
+ *  - a STRING: the `client_id` URL itself. Validates it is a well-formed https URL (http / malformed →
+ *    rejected). The document behind it must still be fetched and validated separately.
+ *  - an OBJECT: a dereferenced {@link ClientIdMetadataDocument}. Validates `client_id` is https, matches
+ *    `expectedClientId` when supplied, and `redirect_uris` is a non-empty array of safe redirect URIs.
+ *
+ * Fails closed: anything missing / http / malformed → `{ ok: false, reason }`. The object form accepts an
+ * untrusted `Record<string, unknown>` (e.g. freshly parsed JSON) as well as a typed document.
+ */
+function verifyCimd(input, opts = {}) {
+    if (typeof input === 'string') {
+        if (!isHttpsUrl(input))
+            return { ok: false, reason: 'client_id must be an https URL (CIMD requires https; http/malformed rejected)' };
+        if (opts.expectedClientId !== undefined && input !== opts.expectedClientId) {
+            return { ok: false, reason: 'client_id URL does not match the expected client_id' };
+        }
+        return { ok: true, clientId: input };
+    }
+    if (input === null || typeof input !== 'object')
+        return { ok: false, reason: 'CIMD must be a string URL or a metadata object' };
+    // The declared type is a hint only — the document is UNTRUSTED (often parsed JSON), so every field is
+    // re-validated at runtime below; no cast is used to bypass that.
+    const v = { ...input };
+    if (!isHttpsUrl(v.client_id))
+        return { ok: false, reason: 'client_id must be an https URL (CIMD requires https)' };
+    if (opts.expectedClientId !== undefined && v.client_id !== opts.expectedClientId) {
+        return { ok: false, reason: 'document client_id does not match the URL it was fetched from (CIMD integrity)' };
+    }
+    const redirectUris = v.redirect_uris;
+    if (!Array.isArray(redirectUris) || redirectUris.length === 0) {
+        return { ok: false, reason: 'redirect_uris is required and must be a non-empty array' };
+    }
+    for (const r of redirectUris) {
+        if (!isAllowedRedirectUri(r))
+            return { ok: false, reason: `unsafe or malformed redirect URI ${JSON.stringify(r)}` };
+    }
+    // Narrow to the typed document (we validated client_id + redirect_uris above).
+    const doc = { client_id: v.client_id, redirect_uris: redirectUris.filter((r) => typeof r === 'string') };
+    if (typeof v.client_name === 'string')
+        doc.client_name = v.client_name;
+    if (typeof v.client_uri === 'string')
+        doc.client_uri = v.client_uri;
+    if (typeof v.logo_uri === 'string')
+        doc.logo_uri = v.logo_uri;
+    if (typeof v.scope === 'string')
+        doc.scope = v.scope;
+    if (Array.isArray(v.contacts) && v.contacts.every((c) => typeof c === 'string'))
+        doc.contacts = v.contacts;
+    if (typeof v.tos_uri === 'string')
+        doc.tos_uri = v.tos_uri;
+    if (typeof v.policy_uri === 'string')
+        doc.policy_uri = v.policy_uri;
+    if (Array.isArray(v.grant_types) && v.grant_types.every((g) => typeof g === 'string'))
+        doc.grant_types = v.grant_types;
+    if (Array.isArray(v.response_types) && v.response_types.every((g) => typeof g === 'string'))
+        doc.response_types = v.response_types;
+    if (typeof v.token_endpoint_auth_method === 'string')
+        doc.token_endpoint_auth_method = v.token_endpoint_auth_method;
+    return { ok: true, clientId: v.client_id, doc };
+}
+// ===================================================================================================
+// 4. Scope accumulation — scopes NARROW down the delegation chain
+// ===================================================================================================
+/** The scope caveat convention: a capability hop may carry `{ type: 'scope', scopes: [...] }`. */
+exports.SCOPE_CAVEAT = 'scope';
+function isScopeCaveat(cv) {
+    return (cv !== null &&
+        typeof cv === 'object' &&
+        cv.type === exports.SCOPE_CAVEAT &&
+        Array.isArray(cv.scopes) &&
+        cv.scopes.every((s) => typeof s === 'string'));
+}
+/**
+ * Scope accumulation: the EFFECTIVE granted scopes NARROW monotonically down the chain. Because the
+ * capability chain's caveats are append-only and conjunctive, each `scope` caveat INTERSECTS the running
+ * set — a child can grant a subset of its parent's scopes but never widen. The leaf holds the full
+ * append-only caveat list, so scanning it covers every hop.
+ *
+ *  - `base` given  → start from it and intersect each `scope` caveat (a delegation can only shrink it).
+ *  - `base` absent → the FIRST `scope` caveat seeds the set; later ones intersect it.
+ *  - no `base` and NO `scope` caveat → `[]` (fail closed: nothing is granted to a scoped tool).
+ *
+ * Returns a sorted, de-duplicated array.
+ */
+function accumulateScopes(caveats, base) {
+    let set = base ? new Set(base) : null;
+    if (Array.isArray(caveats)) {
+        for (const cv of caveats) {
+            if (!isScopeCaveat(cv))
+                continue;
+            const next = new Set(cv.scopes);
+            set = set === null ? next : new Set([...set].filter((s) => next.has(s)));
+        }
+    }
+    if (set === null)
+        return base ? [...new Set(base)].sort() : [];
+    return [...set].sort();
+}
+/** The roles that satisfy a tier: tier 3 needs a principal; tier 2 a guardian OR a principal. */
+function requiredRolesForTier(tier) {
+    return tier === 3 ? ['principal'] : ['guardian', 'principal'];
+}
+/**
+ * Default step-up satisfaction: the PCActn already carries a `threshold` share from a role that meets the
+ * tier. This is the ADMISSION-layer presence check (does the proof claim the co-sign?); the cryptographic
+ * verification of each share against the signer set is the threshold verifier's / adjudicator's job — the
+ * PCA core reports `threshold` as 'not-enforced' without a hook, and this mirrors that honesty. Supply
+ * `AuthorizeRequestOptions.stepUpSatisfied` to plug a real verifier in.
+ */
+function defaultStepUpSatisfied(p, tier) {
+    const shares = p.threshold?.shares;
+    if (!Array.isArray(shares))
+        return false;
+    const roles = requiredRolesForTier(tier);
+    return shares.some((s) => roles.includes(s.role));
+}
+function headerValue(req, name) {
+    const h = req.headers;
+    if (typeof h.get === 'function')
+        return h.get(name) ?? h.get(name.toLowerCase()) ?? undefined;
+    // Record form: HTTP header names are case-insensitive, but a plain object is not — scan case-insensitively.
+    const lower = name.toLowerCase();
+    let v = h[name] ?? h[lower];
+    if (v === undefined) {
+        for (const [k, val] of Object.entries(h)) {
+            if (k.toLowerCase() === lower && (typeof val === 'string' || Array.isArray(val))) {
+                v = val;
+                break;
+            }
+        }
+    }
+    if (Array.isArray(v))
+        return v[0];
+    return v;
+}
+/**
+ * Extract a PCActn from a request: the `PCA-Action` header (base64url-encoded PCActn JSON), else a JSON
+ * body `{ pcactn }` (string or object). Returns the decoded `PCActn`, or `null` when none is present.
+ * Throws only on an unreadable / undecodable encoding (the caller maps that to a 401).
+ */
+function extractPCActn(req) {
+    const h = headerValue(req, 'pca-action');
+    if (typeof h === 'string' && h.length > 0) {
+        const json = new TextDecoder().decode((0, pca_1.unb64u)(h.trim()));
+        return (0, pca_1.decodePCActn)(json);
+    }
+    let b = req.body;
+    if (typeof b === 'string' && b.length > 0) {
+        b = JSON.parse(b);
+    }
+    if (b !== null && typeof b === 'object') {
+        const x = b.pcactn;
+        if (typeof x === 'string')
+            return (0, pca_1.decodePCActn)(x);
+        if (x !== null && typeof x === 'object')
+            return x;
+    }
+    return null;
+}
+function requiredScopesFor(opts) {
+    if (opts.requiredScopes)
+        return opts.requiredScopes;
+    if (opts.tool !== undefined && opts.toolScopes) {
+        const req = opts.toolScopes[opts.tool];
+        if (req === undefined)
+            return [];
+        return Array.isArray(req) ? req : [req];
+    }
+    return [];
+}
+function requiredTierFor(opts, pcactn) {
+    if (opts.requiredTier !== undefined)
+        return opts.requiredTier;
+    if (opts.tool !== undefined && opts.toolStepUp) {
+        const t = opts.toolStepUp[opts.tool];
+        if (t !== undefined)
+            return t;
+    }
+    if (opts.riskTiers) {
+        const rt = (0, pca_1.requiredThreshold)(pcactn.risk_claim?.r ?? 1, opts.riskTiers);
+        return rt.t === 1 ? undefined : rt.t;
+    }
+    return undefined;
+}
+/**
+ * The resource-server admission check for an MCP 2026-07-28 tool call, with a PCActn as the authority.
+ * It FAILS CLOSED and runs the checks in this order, each with the correct 401/403 + `WWW-Authenticate`:
+ *
+ *   1. extract the PCActn (missing / unreadable → 401 `invalid_request`);
+ *   2. resolve the grant from `grant_ref` (unknown → 401 `invalid_token`);
+ *   3. RFC 8707 — the PCActn's signed `aud` MUST equal this RS's `resource` (mismatch → 401 `invalid_token`);
+ *   4. RFC 9207 — the credential's issuer MUST be in `authorizationServers` (mix-up → 401 `invalid_token`);
+ *   5. the PCA core verification (`verifyPCActnCore`: wire, version, audience, validity, cap_chain,
+ *      plan inclusion, leaf signature, counter). A crypto/binding failure → 401; a policy failure → 403;
+ *   6. scope accumulation — the tool's required scope(s) MUST be in the effective (narrowed) granted set
+ *      (insufficient → 403 `insufficient_scope`, with `scope` in the challenge);
+ *   7. step-up — if the tool needs a tier ≥ 2 co-sign the PCActn does not yet carry, return a 401
+ *      `insufficient_user_authentication` (RFC 9470) carrying the {@link StepUpChallenge}.
+ *
+ * On success it returns the verified PCActn, the grant, the effective granted scopes and the core checks.
+ */
+async function authorizeRequest(req, opts) {
+    const realm = opts.realm ?? 'pca';
+    const now = opts.now ?? Date.now();
+    const deny = (status, error, errorDescription, extra = {}) => {
+        const header = wwwAuthenticateChallenge({
+            resourceMetadataUrl: opts.prmUrl,
+            error,
+            errorDescription,
+            realm,
+            ...(extra.scope !== undefined ? { scope: extra.scope } : {}),
+            ...(extra.stepUp
+                ? { acrValues: extra.stepUp.acr, maxAge: 0, pcaStepUp: extra.stepUp }
+                : {}),
+        });
+        return {
+            ok: false,
+            status,
+            error,
+            errorDescription,
+            wwwAuthenticate: header,
+            ...(extra.stepUp ? { stepUp: extra.stepUp } : {}),
+            ...(extra.checks ? { checks: extra.checks } : {}),
+        };
+    };
+    try {
+        if (typeof opts.resource !== 'string' || opts.resource.length === 0) {
+            throw new Error('authorizeRequest: `resource` is required');
+        }
+        if (!Array.isArray(opts.authorizationServers) || opts.authorizationServers.length === 0) {
+            throw new Error('authorizeRequest: `authorizationServers` is required (RFC 9207)');
+        }
+        // 1. extract
+        let pcactn;
+        try {
+            pcactn = extractPCActn(req);
+        }
+        catch (e) {
+            return deny(401, 'invalid_request', `unreadable PCActn: ${e.message}`);
+        }
+        if (pcactn === null)
+            return deny(401, 'invalid_request', 'no PCActn presented (PCA-Action header or {pcactn} body)');
+        if (typeof pcactn !== 'object' || typeof pcactn.grant_ref !== 'string') {
+            return deny(401, 'invalid_token', 'malformed PCActn');
+        }
+        // 2. resolve grant
+        const grant = await opts.resolveGrant(pcactn.grant_ref, pcactn);
+        if (!grant)
+            return deny(401, 'invalid_token', 'unknown grant_ref');
+        // 3. RFC 8707 — resource-indicator / audience binding. The signed `aud` is the real binding (a
+        // `resource` indicator can be dropped or spoofed in transit; the signature cannot).
+        if (typeof pcactn.aud !== 'string' || pcactn.aud !== opts.resource) {
+            return deny(401, 'invalid_token', `RFC 8707: PCActn audience (${String(pcactn.aud)}) is not this resource server (${opts.resource})`);
+        }
+        // 4. RFC 9207 — authorization-server issuer validation (mix-up defense).
+        const issuer = opts.resolveIssuer ? opts.resolveIssuer(grant, pcactn) : grant.issuer;
+        if (!opts.authorizationServers.includes(issuer)) {
+            return deny(401, 'invalid_token', `RFC 9207: credential issuer (${issuer}) is not an expected authorization server`);
+        }
+        // 5. PCA core verification (crypto + binding). Pass THIS RS's audience so the core re-binds too.
+        const verdict = await (0, pca_1.verifyPCActnCore)(pcactn, { grant, audience: opts.resource, nowEpoch: now });
+        if (!verdict.allow) {
+            const reason = verdict.reason ?? 'PCActn verification failed';
+            // Authentication-class failures are 401 (bad proof); everything else is a 403 (policy).
+            const authnChecks = ['wire', 'version', 'audience', 'validity', 'cap_chain', 'leaf_signature', 'malformed', 'counter'];
+            const authnFailed = authnChecks.some((c) => verdict.checks[c] === 'fail');
+            return authnFailed
+                ? deny(401, 'invalid_token', reason, { checks: verdict.checks })
+                : deny(403, 'forbidden', reason, { checks: verdict.checks });
+        }
+        // 6. scope accumulation — the narrowed granted scopes must cover the tool's required scope(s).
+        const leaf = pcactn.cap_chain.at(-1);
+        const leafCaveats = leaf && Array.isArray(leaf.caveats) ? leaf.caveats : [];
+        const grantedScopes = opts.resolveGrantedScopes
+            ? opts.resolveGrantedScopes(grant, pcactn.cap_chain, pcactn)
+            : accumulateScopes(leafCaveats, opts.baseScopes);
+        const need = requiredScopesFor(opts);
+        const missing = need.filter((s) => !grantedScopes.includes(s));
+        if (missing.length > 0) {
+            return deny(403, 'insufficient_scope', `missing required scope(s): ${missing.join(' ')}`, {
+                scope: need.join(' '),
+                checks: verdict.checks,
+            });
+        }
+        // 7. step-up — a tool needing a tier ≥ 2 co-sign the PCActn does not yet carry.
+        const tier = requiredTierFor(opts, pcactn);
+        if (tier !== undefined) {
+            const satisfied = (opts.stepUpSatisfied ?? defaultStepUpSatisfied)(pcactn, tier);
+            if (!satisfied) {
+                const stepUp = {
+                    tier,
+                    requiredRoles: requiredRolesForTier(tier),
+                    reason: `this action requires a tier-${tier} ${tier === 3 ? 'principal (human)' : 'guardian'} co-sign; drive the step-up and re-present a PCActn carrying the threshold`,
+                    acr: `pca:tier${tier}`,
+                    ...(opts.stepUpEndpoint !== undefined ? { stepUpEndpoint: opts.stepUpEndpoint } : {}),
+                };
+                return deny(401, 'insufficient_user_authentication', stepUp.reason, { stepUp, checks: verdict.checks });
+            }
+        }
+        return { ok: true, status: 200, pcactn, grant, grantedScopes, checks: verdict.checks };
+    }
+    catch (e) {
+        // Fail closed: any unexpected error is a 403 deny, never an accidental admit.
+        return deny(403, 'forbidden', `admission error (fail closed): ${e instanceof Error ? e.message : 'unknown'}`);
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;;;AA6HH,8DA0CC;AAGD,gCAEC;AAsCD,4DA0BC;AAkFD,4DAyBC;AAyBD,gCAuCC;AAcD,sCAQC;AAcD,4CAWC;AA0BD,oDAEC;AASD,wDAKC;AAmCD,sCAgBC;AAiHD,4CAkHC;AApwBD,wCAewB;AAExB;;;;GAIG;AACU,QAAA,oBAAoB,GAAG,uCAAuC,CAAC;AAK5E,sGAAsG;AACtG,sGAAsG;AACtG,sGAAsG;AAEtG,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAgFD;;;;;;GAMG;AACH,SAAgB,yBAAyB,CAAC,IAAsC;IAC9E,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAC;IACpH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,+EAA+E;IAC/E,MAAM,SAAS,GAAG,IAAA,4BAAsB,EAAC;QACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;IACH,MAAM,wBAAwB,GAC5B,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,yBAAmB,CAAC;IAE3F,MAAM,GAAG,GAA8B;QACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,qBAAqB,EAAE,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC;QACrD,wBAAwB,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACrG,gBAAgB,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC;QAC3C,qCAAqC,EAAE,IAAI;QAC3C,iBAAiB,EAAE,SAAS,CAAC,aAAa;QAC1C,oBAAoB,EAAE,CAAC,GAAG,SAAS,CAAC,gBAAgB,CAAC;QACrD,YAAY,EAAE,CAAC,GAAG,SAAS,CAAC,YAAY,CAAC;QACzC,0BAA0B,EAAE,wBAAwB;QACpD,GAAG,EAAE,SAAS;QACd,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,GAAG,CAAC,IAAI,CAAC,iCAAiC;YACxC,CAAC,CAAC,EAAE,qCAAqC,EAAE,CAAC,GAAG,IAAI,CAAC,iCAAiC,CAAC,EAAE;YACxF,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oFAAoF;AACpF,SAAgB,UAAU,CAAC,IAAsC;IAC/D,OAAO,EAAE,IAAI,EAAE,4BAAoB,EAAE,IAAI,EAAE,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/E,CAAC;AA6BD;;;;;;;;GAQG;AACH,SAAgB,wBAAwB,CAAC,IAAqC;IAC5E,IAAI,OAAO,IAAI,CAAC,mBAAmB,KAAK,QAAQ,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,UAAU,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClE,MAAM,CAAC,IAAI,CAAC,sBAAsB,WAAW,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,UAAU,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,IAAI,CAAC,gBAAgB;QAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACpG,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,UAAU,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,IAAI,CAAC,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,eAAe,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/E,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IACpI,MAAM,UAAU,GAAa,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE7D,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,MAAM,QAAQ,GAAa;YACzB,UAAU,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG;YAC7C,SAAS,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG;YACxC,UAAU,WAAW,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG;SACrD,CAAC;QACF,IAAI,EAAE,CAAC,cAAc;YAAE,QAAQ,CAAC,IAAI,CAAC,eAAe,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACvF,IAAI,EAAE,CAAC,GAAG;YAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1D,UAAU,CAAC,IAAI,CAAC,cAAc,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AA8CD,SAAS,UAAU,CAAC,CAAU;IAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,GAAY;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACrB,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,KAAK,CAAC;IAChF,CAAC;IACD,+DAA+D;IAC/D,OAAO,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,SAAgB,wBAAwB,CAAC,IAAqC;IAC5E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtH,CAAC;IACD,MAAM,GAAG,GAA6B;QACpC,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,IAAI,CAAC,uBAAuB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,0BAA0B,EAAE,IAAI,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpH,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAcD;;;;;;;;;;GAUG;AACH,SAAgB,UAAU,CACxB,KAAkE,EAClE,OAA0B,EAAE;IAE5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+EAA+E,EAAE,CAAC;QACtI,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC;QACtF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC;IAChI,sGAAsG;IACtG,iEAAiE;IACjE,MAAM,CAAC,GAA4B,EAAE,GAAG,KAAK,EAAE,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;IACnH,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACjF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gFAAgF,EAAE,CAAC;IACjH,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,CAAC,aAAa,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yDAAyD,EAAE,CAAC;IAC1F,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACtH,CAAC;IACD,+EAA+E;IAC/E,MAAM,GAAG,GAA6B,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;IAChJ,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QAAE,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;IACvE,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAAE,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IACpE,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC9D,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAAE,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAoB,CAAC;IACvH,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAAE,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;IAC3D,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAAE,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IACpE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAAE,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,WAAuB,CAAC;IACnI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAAE,GAAG,CAAC,cAAc,GAAG,CAAC,CAAC,cAA0B,CAAC;IAC/I,IAAI,OAAO,CAAC,CAAC,0BAA0B,KAAK,QAAQ;QAAE,GAAG,CAAC,0BAA0B,GAAG,CAAC,CAAC,0BAA0B,CAAC;IACpH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC;AAClD,CAAC;AAED,sGAAsG;AACtG,kEAAkE;AAClE,sGAAsG;AAEtG,kGAAkG;AACrF,QAAA,YAAY,GAAG,OAAO,CAAC;AAOpC,SAAgB,aAAa,CAAC,EAAW;IACvC,OAAO,CACL,EAAE,KAAK,IAAI;QACX,OAAO,EAAE,KAAK,QAAQ;QACrB,EAAa,CAAC,IAAI,KAAK,oBAAY;QACpC,KAAK,CAAC,OAAO,CAAE,EAA2B,CAAC,MAAM,CAAC;QACjD,EAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,gBAAgB,CAAC,OAAiB,EAAE,IAAe;IACjE,IAAI,GAAG,GAAuB,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;gBAAE,SAAS;YACjC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;YAChC,GAAG,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAyBD,iGAAiG;AACjG,SAAgB,oBAAoB,CAAC,IAAW;IAC9C,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,sBAAsB,CAAC,CAAS,EAAE,IAAW;IAC3D,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACpD,CAAC;AAYD,SAAS,WAAW,CAAC,GAAmB,EAAE,IAAY;IACpD,MAAM,CAAC,GAAG,GAAG,CAAC,OAAiG,CAAC;IAChH,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,SAAS,CAAC;IAC9F,4GAA4G;IAC5G,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,CAAC,GAAkC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACjF,CAAC,GAAG,GAAG,CAAC;gBACR,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,GAAmB;IAC/C,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAA,YAAM,EAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,IAAA,kBAAY,EAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,GAAY,GAAG,CAAC,IAAI,CAAC;IAC1B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,CAAC,GAAI,CAA0B,CAAC,MAAM,CAAC;QAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAA,kBAAY,EAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAW,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAyED,SAAS,iBAAiB,CAAC,IAA6B;IACtD,IAAI,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC,cAAc,CAAC;IACpD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,eAAe,CAAC,IAA6B,EAAE,MAAc;IACpE,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,YAAY,CAAC;IAC9D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/C,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,EAAE,GAAsB,IAAA,uBAAiB,EAAC,MAAM,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3F,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACI,KAAK,UAAU,gBAAgB,CAAC,GAAmB,EAAE,IAA6B;IACvF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,CACX,MAAiB,EACjB,KAAa,EACb,gBAAwB,EACxB,QAA4F,EAAE,EAC/E,EAAE;QACjB,MAAM,MAAM,GAAG,wBAAwB,CAAC;YACtC,mBAAmB,EAAE,IAAI,CAAC,MAAM;YAChC,KAAK;YACL,gBAAgB;YAChB,KAAK;YACL,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,KAAK,CAAC,MAAM;gBACd,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE;gBACrE,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM;YACN,KAAK;YACL,gBAAgB;YAChB,eAAe,EAAE,MAAM;YACvB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACrF,CAAC;QAED,aAAa;QACb,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,sBAAuB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,0DAA0D,CAAC,CAAC;QACrH,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACvE,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC;QACxD,CAAC;QAED,mBAAmB;QACnB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;QAEnE,+FAA+F;QAC/F,oFAAoF;QACpF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,8BAA8B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,kCAAkC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QACxI,CAAC;QAED,yEAAyE;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;QACrF,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,gCAAgC,MAAM,2CAA2C,CAAC,CAAC;QACvH,CAAC;QAED,iGAAiG;QACjG,MAAM,OAAO,GAAG,MAAM,IAAA,sBAAgB,EAAC,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QAClG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,4BAA4B,CAAC;YAC9D,wFAAwF;YACxF,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;YACvH,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC;YAC1E,OAAO,WAAW;gBAChB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;gBAChE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,+FAA+F;QAC/F,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,WAAW,GAAa,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB;YAC7C,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;YAC5D,CAAC,CAAC,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE,8BAA8B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE;gBACxF,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBACrB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;QAED,gFAAgF;QAChF,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,sBAAsB,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACjF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,MAAM,GAAoB;oBAC9B,IAAI;oBACJ,aAAa,EAAE,oBAAoB,CAAC,IAAI,CAAC;oBACzC,MAAM,EAAE,+BAA+B,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,UAAU,4EAA4E;oBACxK,GAAG,EAAE,WAAW,IAAI,EAAE;oBACtB,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtF,CAAC;gBACF,OAAO,IAAI,CAAC,GAAG,EAAE,kCAAkC,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACzF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,8EAA8E;QAC9E,OAAO,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,kCAAkC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAChH,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,58 @@
 {
   "name": "@atlasauth/pca-mcp-rs",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "description": "MCP authorization resource-server for the 2026-07-28 spec: serve RFC 9728 PRM + Client-ID Metadata Documents, enforce RFC 8707 resource indicators + RFC 9207 issuer validation + scope accumulation, and wire PCA FROST step-up into the MCP step-up challenge.",
+  "keywords": [
+    "mcp",
+    "resource server",
+    "rfc 9728",
+    "rfc 8707",
+    "oauth",
+    "agent authorization",
+    "proof-carrying authority",
+    "pca",
+    "ai agents"
+  ],
+  "license": "MIT",
+  "homepage": "https://github.com/Atlas-Authorization/pca#readme",
+  "bugs": {
+    "url": "https://github.com/Atlas-Authorization/pca/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Atlas-Authorization/pca.git",
+    "directory": "packages/pca-mcp-rs"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@atlasauth/pca": "0.2.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.4"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
 }