@atlasauth/pca-next 0.1.0 → 0.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Atlas Authorization
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,36 +1,53 @@
 # @atlasauth/pca-next
 
-Next.js helper for Proof-Carrying Authority: wrap a Route Handler so the inbound PCActn is verified before your handler runs, with a 401/403 response otherwise.
+Next.js (App Router) helper for Proof-Carrying Authority (PCA). `withPCA` wraps a Route Handler so the inbound PCActn is verified with the resource-server guard from `@atlasauth/pca` before your handler runs; otherwise it returns a 401/403 JSON response with a `WWW-Authenticate` challenge. Verification is default-deny.
 
 ## Install
 
 ```sh
-npm i @atlasauth/pca-next
-# peer dependency, install alongside:
-npm i next
+npm i @atlasauth/pca-next @atlasauth/pca
+npm i next   # optional peer dependency (^14 || ^15)
 ```
 
-`next` (v14 or v15) is an optional peer dependency.
-
 ## Usage
 
 ```ts
 // app/refunds/route.ts
 import { withPCA } from '@atlasauth/pca-next';
+import { memoryPcaStore } from '@atlasauth/pca';
 
 export const POST = withPCA(
   {
-    audience: 'ins_acme',   // this resource server's / instance id the PCActn must name
-    resolveGrant,           // (ref) => Capability — look up the root grant
-    budgetStore,            // per-holder replay/budget store
+    audience: 'ins_acme',                       // this resource server's id; the PCActn's signed `aud` must match
+    resolveGrant: async (ref) => grants.get(ref) ?? null, // look up the Root Intent Grant by grant_ref
+    budgetStore: memoryPcaStore(),              // replay counter store (use a durable one in production)
+    hooks: { revocation: async () => ({ enforced: true, ok: !(await isRevoked()) }) }, // revocation checker
+    context: async (req, pcactn) => ({          // facts only the resource server can vouch for
+      params: { amount: 20, currency: 'usd' },
+      plan: authorizedPlanNodes,                // your copy of the principal-authorized plan
+      planAuthorized: true,
+      budget: { B: 500, tau: 0 },
+      risk: { blastRadius: 0.04 },              // risk inputs you can vouch for (missing ones fail closed to worst case)
+    }),
   },
   async (req, { pca }) => {
-    const { verdict, pcactn } = pca;   // handler only runs on a valid PCActn
+    const { verdict, pcactn } = pca;            // handler only runs for a valid PCActn
     return Response.json({ ok: true });
   },
 );
 ```
 
-The client sends the PCActn as `PCA-Action: <base64url>` (see `@atlasauth/pca` `pcaHeaders`) or a JSON body `{ pcactn }` — the default extractor reads both. The wrapper verifies and is default-deny; it is the verifier that decides, not the client's proof.
+The client sends the PCActn as a `PCA-Action: <base64url>` header (see `pcaHeaders` in `@atlasauth/pca`) or as a JSON body `{ pcactn }`; the default extractor reads both. The wrapper reads a clone of the request body, so your handler can still read it. By default a deployment must supply `budgetStore`, a `hooks.revocation` checker, and a `context()` returning the server's own `plan` and `planAuthorized: true`; otherwise requests are denied. `insecureAllowUnenforced: true` relaxes this for local development only.
+
+## API
+
+- `withPCA(options, handler)` - returns `(req: Request) => Promise<Response>`. Options extend `RequirePcaOptions` from `@atlasauth/pca`, plus `onDeny(result, req)` to customize the error response.
+- Re-exports `requirePCA`, `defaultExtract`, `memoryPcaStore`.
+
+## Status
+
+This package only wires the guard into Next.js route handlers; all verification logic lives in `@atlasauth/pca`. PCA cryptography has not been independently audited.
+
+## License
 
-Part of Proof-Carrying Authority — see `@atlasauth/pca`.
+MIT - see LICENSE

package/dist/index.d.ts

@@ -7,7 +7,7 @@
  *   );
  *
  * It wraps a Route Handler so the inbound PCActn is verified with the framework-agnostic `requirePCA` guard
- * from `@atlasauth/backend` (default-deny: a required check that is unenforced DENIES) before your handler
+ * from `@atlasauth/pca` (default-deny: a required check that is unenforced DENIES) before your handler
  * runs. On success it calls your handler with `{ pca: { verdict, pcactn } }`; on failure it returns a 401/403
  * JSON response with a WWW-Authenticate challenge. The client sends the PCActn as `PCA-Action: <base64url>`
  * (see `@atlasauth/pca` `pcaHeaders`) or a JSON body `{ pcactn }`; that is exactly what the default extractor
@@ -16,8 +16,8 @@
  * `next` is an OPTIONAL peer dependency and is never imported — the handler takes the web `Request` and returns
  * a web `Response`, which is exactly what an App-Router Route Handler is.
  */
-import { requirePCA, defaultExtract, memoryPcaStore } from '@atlasauth/backend';
-import type { PcaGuardResult, RequirePcaOptions, PcaStateStore } from '@atlasauth/backend';
+import { requirePCA, defaultExtract, memoryPcaStore } from '@atlasauth/pca';
+import type { PcaGuardResult, RequirePcaOptions, PcaStateStore } from '@atlasauth/pca';
 import type { PCActn } from '@atlasauth/pca';
 /** The verdict + PCActn handed to the wrapped handler on success. */
 export interface PcaAttachment {

package/dist/index.js

@@ -8,7 +8,7 @@
  *   );
  *
  * It wraps a Route Handler so the inbound PCActn is verified with the framework-agnostic `requirePCA` guard
- * from `@atlasauth/backend` (default-deny: a required check that is unenforced DENIES) before your handler
+ * from `@atlasauth/pca` (default-deny: a required check that is unenforced DENIES) before your handler
  * runs. On success it calls your handler with `{ pca: { verdict, pcactn } }`; on failure it returns a 401/403
  * JSON response with a WWW-Authenticate challenge. The client sends the PCActn as `PCA-Action: <base64url>`
  * (see `@atlasauth/pca` `pcaHeaders`) or a JSON body `{ pcactn }`; that is exactly what the default extractor
@@ -20,14 +20,14 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = void 0;
 exports.withPCA = withPCA;
-const backend_1 = require("@atlasauth/backend");
-Object.defineProperty(exports, "requirePCA", { enumerable: true, get: function () { return backend_1.requirePCA; } });
-Object.defineProperty(exports, "defaultExtract", { enumerable: true, get: function () { return backend_1.defaultExtract; } });
-Object.defineProperty(exports, "memoryPcaStore", { enumerable: true, get: function () { return backend_1.memoryPcaStore; } });
+const pca_1 = require("@atlasauth/pca");
+Object.defineProperty(exports, "requirePCA", { enumerable: true, get: function () { return pca_1.requirePCA; } });
+Object.defineProperty(exports, "defaultExtract", { enumerable: true, get: function () { return pca_1.defaultExtract; } });
+Object.defineProperty(exports, "memoryPcaStore", { enumerable: true, get: function () { return pca_1.memoryPcaStore; } });
 /** Wrap an App-Router Route Handler so it only runs for a valid PCActn. */
 function withPCA(options, handler) {
     const onDeny = options.onDeny;
-    const guard = (0, backend_1.requirePCA)(options);
+    const guard = (0, pca_1.requirePCA)(options);
     return async (req) => {
         const like = {
             headers: { get: (n) => req.headers.get(n) },

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AAqBH,0BAqBC;AAxCD,gDAAgF;AA0CvE,2FA1CA,oBAAU,OA0CA;AAAE,+FA1CA,wBAAc,OA0CA;AAAE,+FA1CA,wBAAc,OA0CA;AAxBnD,2EAA2E;AAC3E,SAAgB,OAAO,CAAC,OAAuB,EAAE,OAAwB;IACvE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAA,oBAAU,EAAC,OAAO,CAAC,CAAC;IAClC,OAAO,KAAK,EAAE,GAAY,EAAqB,EAAE;QAC/C,MAAM,IAAI,GAAmB;YAC3B,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YACnD,IAAI,EAAE,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;SACtD,CAAC;QACF,MAAM,MAAM,GAAmB,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE;YAClH,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClF;SACF,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AAqBH,0BAqBC;AAxCD,wCAA4E;AA0CnE,2FA1CA,gBAAU,OA0CA;AAAE,+FA1CA,oBAAc,OA0CA;AAAE,+FA1CA,oBAAc,OA0CA;AAxBnD,2EAA2E;AAC3E,SAAgB,OAAO,CAAC,OAAuB,EAAE,OAAwB;IACvE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAA,gBAAU,EAAC,OAAO,CAAC,CAAC;IAClC,OAAO,KAAK,EAAE,GAAY,EAAqB,EAAE;QAC/C,MAAM,IAAI,GAAmB;YAC3B,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YACnD,IAAI,EAAE,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;SACtD,CAAC;QACF,MAAM,MAAM,GAAmB,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE;YAClH,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClF;SACF,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,7 +1,26 @@
 {
   "name": "@atlasauth/pca-next",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Next.js helper for Proof-Carrying Authority: wrap a Route Handler so the inbound PCActn is verified before your handler runs, with a 401/403 response otherwise.",
+  "keywords": [
+    "next.js",
+    "route handler",
+    "middleware",
+    "agent authorization",
+    "proof-carrying authority",
+    "pca",
+    "ai agents"
+  ],
+  "license": "MIT",
+  "homepage": "https://github.com/Atlas-Authorization/pca#readme",
+  "bugs": {
+    "url": "https://github.com/Atlas-Authorization/pca/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Atlas-Authorization/pca.git",
+    "directory": "packages/pca-next"
+  },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -12,8 +31,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@atlasauth/pca": "0.1.0",
-    "@atlasauth/backend": "0.3.0"
+    "@atlasauth/pca": "0.3.0"
   },
   "peerDependencies": {
     "next": "^14 || ^15"
@@ -29,8 +47,12 @@
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
+  "engines": {
+    "node": ">=20"
+  },
   "publishConfig": {
     "access": "public"
   },