@axtary/mcp 0.0.1 → 0.2.0

package/dist/signing.d.ts

@@ -0,0 +1,218 @@
+import { type CryptoKey, type JWK, type KeyObject } from "jose";
+import { z } from "zod";
+import type { ToolHandler } from "@axtary/proxy";
+import { type McpToolDefinitionInput, type McpToolDefinitionRecord, type McpToolInvoker } from "./core.js";
+/**
+ * A signed MCP tool definition gives a tool a *publisher identity* and an
+ * immutable, versioned lineage on top of the content hash that
+ * `@axtary/mcp` already computes. This is the Axtary profile of the ETDI idea
+ * (arXiv:2506.01333): the publisher signs the exact `definitionHash`, a
+ * semantic version, the required scopes, and a pointer to the prior version's
+ * hash. A client rejects any definition that is unsigned, signed by an
+ * unknown key, mis-signed, or whose on-the-wire bytes no longer hash to the
+ * signed `definitionHash` — and it rejects it *before* the tool is invoked.
+ *
+ * We stay on the JOSE/ES256 profile already used by the ActionPass issuer
+ * keyring; the signature is a compact JWT (`statement+jwt`).
+ */
+export declare const MCP_SIGNED_DEFINITION_PROFILE = "axtary.mcp_signed_definition.v1";
+export declare const MCP_SIGNED_DEFINITION_TYP = "axtary-mcp-tool-definition+jwt";
+export declare const MCP_PUBLISHER_KEYRING_VERSION = "axtary.mcp_publisher_keyring.v0";
+export declare const MCP_PUBLISHER_TRUST_VERSION = "axtary.mcp_publisher_trust.v0";
+export declare const MCP_SIGNED_DEFINITION_REGISTRY_VERSION = "axtary.mcp_signed_definition_registry.v0";
+/**
+ * The claims the publisher signs. `definitionHash` binds the signature to the
+ * exact tool definition; `priorDefinitionHash` links this version to the one
+ * it supersedes so a rug-pull (silent re-definition) is visible as a chain.
+ */
+export declare const McpSignedDefinitionClaimsSchema: z.ZodObject<{
+    iss: z.ZodString;
+    sub: z.ZodString;
+    iat: z.ZodNumber;
+    axtary_mcp_profile: z.ZodLiteral<"axtary.mcp_signed_definition.v1">;
+    serverIdentity: z.ZodString;
+    toolName: z.ZodString;
+    schemaVersion: z.ZodString;
+    definitionHash: z.ZodString;
+    semver: z.ZodString;
+    requiredScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    priorDefinitionHash: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export type McpSignedDefinitionClaims = z.infer<typeof McpSignedDefinitionClaimsSchema>;
+/** A public publisher key, JWKS-shaped, resolvable by `kid`. */
+export declare const McpPublisherKeySchema: z.ZodObject<{
+    kid: z.ZodString;
+    kty: z.ZodString;
+    crv: z.ZodString;
+    x: z.ZodString;
+    y: z.ZodString;
+    alg: z.ZodDefault<z.ZodLiteral<"ES256">>;
+    use: z.ZodDefault<z.ZodLiteral<"sig">>;
+}, z.core.$strip>;
+export type McpPublisherKey = z.infer<typeof McpPublisherKeySchema>;
+export declare const McpPublisherKeyringSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"axtary.mcp_publisher_keyring.v0">;
+    publisher: z.ZodString;
+    activeKid: z.ZodString;
+    keys: z.ZodArray<z.ZodObject<{
+        kid: z.ZodString;
+        kty: z.ZodString;
+        crv: z.ZodString;
+        x: z.ZodString;
+        y: z.ZodString;
+        alg: z.ZodDefault<z.ZodLiteral<"ES256">>;
+        use: z.ZodDefault<z.ZodLiteral<"sig">>;
+        privateKeyPem: z.ZodString;
+        createdAt: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type McpPublisherKeyring = z.infer<typeof McpPublisherKeyringSchema>;
+/**
+ * The verifier-side trust anchor: a configured map of publisher identity to
+ * the public keys we will accept signatures from. A signature whose `kid` is
+ * not in this store is rejected — there is no trust-on-first-use for
+ * *signatures* (that would defeat publisher identity); TOFU stays at the pin
+ * layer, which is a deliberate, separate, human-reviewed decision.
+ */
+export declare const McpPublisherTrustEntrySchema: z.ZodObject<{
+    publisher: z.ZodString;
+    keys: z.ZodArray<z.ZodObject<{
+        kid: z.ZodString;
+        kty: z.ZodString;
+        crv: z.ZodString;
+        x: z.ZodString;
+        y: z.ZodString;
+        alg: z.ZodDefault<z.ZodLiteral<"ES256">>;
+        use: z.ZodDefault<z.ZodLiteral<"sig">>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type McpPublisherTrustEntry = z.infer<typeof McpPublisherTrustEntrySchema>;
+export declare const McpPublisherTrustStoreSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"axtary.mcp_publisher_trust.v0">;
+    publishers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        publisher: z.ZodString;
+        keys: z.ZodArray<z.ZodObject<{
+            kid: z.ZodString;
+            kty: z.ZodString;
+            crv: z.ZodString;
+            x: z.ZodString;
+            y: z.ZodString;
+            alg: z.ZodDefault<z.ZodLiteral<"ES256">>;
+            use: z.ZodDefault<z.ZodLiteral<"sig">>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type McpPublisherTrustStore = z.infer<typeof McpPublisherTrustStoreSchema>;
+export declare const McpSignedDefinitionRegistryEntrySchema: z.ZodObject<{
+    serverIdentity: z.ZodString;
+    toolName: z.ZodString;
+    publisher: z.ZodString;
+    statement: z.ZodString;
+}, z.core.$strip>;
+export type McpSignedDefinitionRegistryEntry = z.infer<typeof McpSignedDefinitionRegistryEntrySchema>;
+export declare const McpSignedDefinitionRegistrySchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"axtary.mcp_signed_definition_registry.v0">;
+    statements: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        serverIdentity: z.ZodString;
+        toolName: z.ZodString;
+        publisher: z.ZodString;
+        statement: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type McpSignedDefinitionRegistry = z.infer<typeof McpSignedDefinitionRegistrySchema>;
+export type McpPublisherKeyResolver = (kid: string | undefined) => Promise<CryptoKey | KeyObject | Uint8Array | undefined>;
+export type McpSignedDefinitionVerification = {
+    claims: McpSignedDefinitionClaims;
+    publisher: string;
+    kid: string;
+    semver: string;
+    requiredScopes: string[];
+    definitionHash: string;
+    priorDefinitionHash: string | null;
+};
+export type SignMcpToolDefinitionInput = {
+    definition: McpToolDefinitionInput | McpToolDefinitionRecord;
+    publisher: string;
+    semver: string;
+    signingKey: KeyObject | CryptoKey | JWK | Uint8Array;
+    keyId: string;
+    requiredScopes?: string[];
+    priorDefinitionHash?: string | null;
+    now?: Date;
+};
+/**
+ * Publisher-side: sign a tool definition. The signature commits to the exact
+ * `definitionHash`, so a later byte-level change to the definition cannot be
+ * presented under this signature.
+ */
+export declare function signMcpToolDefinition(input: SignMcpToolDefinitionInput): Promise<{
+    statement: string;
+    claims: McpSignedDefinitionClaims;
+}>;
+/**
+ * Verifier-side: verify a signed definition against a known publisher key and
+ * the *actual* tool definition presented now. Fails closed on every distinct
+ * failure with a stable reason. The `definitionHash` recomputed from the live
+ * definition must equal the signed hash — that is the altered-definition /
+ * tool-poisoning rejection.
+ */
+export declare function verifyMcpSignedDefinition(input: {
+    statement: string;
+    definition: McpToolDefinitionInput | McpToolDefinitionRecord;
+    verificationKeys: McpPublisherKeyResolver;
+    expectedPublisher?: string;
+}): Promise<McpSignedDefinitionVerification>;
+/**
+ * Wrap a tool invoker so the publisher signature is verified against the live
+ * definition *before* the tool runs. Any failure — unsigned (no statement
+ * configured is simply not this handler), mis-signed, unknown key, or an
+ * altered definition whose bytes no longer hash to the signed value — throws
+ * and the tool is never invoked. When the action carries bound provenance, it
+ * must also agree with the verified signature.
+ */
+export declare function createSignedMcpToolHandler(input: {
+    definition: McpToolDefinitionInput | McpToolDefinitionRecord;
+    invoke: McpToolInvoker;
+    statement: string;
+    verificationKeys: McpPublisherKeyResolver;
+    expectedPublisher?: string;
+}): ToolHandler;
+/**
+ * Build a key resolver from a configured trust store. A `kid` that is not
+ * present (optionally scoped to `expectedPublisher`) resolves to `undefined`,
+ * which makes verification fail closed.
+ */
+export declare function mcpPublisherKeyResolver(store: McpPublisherTrustStore, options?: {
+    publisher?: string;
+}): McpPublisherKeyResolver;
+export declare function emptyMcpPublisherTrustStore(): McpPublisherTrustStore;
+export declare function parseMcpPublisherTrustStore(input: unknown): McpPublisherTrustStore;
+export declare function loadMcpPublisherTrustStore(path: string): Promise<McpPublisherTrustStore>;
+export declare function saveMcpPublisherTrustStore(path: string, store: McpPublisherTrustStore): Promise<void>;
+export declare function loadMcpSignedDefinitionRegistry(path: string): Promise<McpSignedDefinitionRegistry>;
+export declare function findMcpSignedDefinition(registry: McpSignedDefinitionRegistry, serverIdentity: string, toolName: string): McpSignedDefinitionRegistryEntry | undefined;
+/**
+ * Add (or replace) a publisher's public keys in the trust store. Pure: never
+ * mutates the input. Used to register a publisher's JWKS for verification.
+ */
+export declare function trustMcpPublisher(store: McpPublisherTrustStore, publisher: string, keys: McpPublisherKey[]): McpPublisherTrustStore;
+/** Public JWKS for a publisher keyring, suitable for distribution. */
+export declare function mcpPublisherJwks(keyring: McpPublisherKeyring): {
+    keys: McpPublisherKey[];
+};
+/** The active signing key for a publisher keyring. */
+export declare function mcpPublisherSigningKey(keyring: McpPublisherKeyring): {
+    kid: string;
+    privateKey: KeyObject;
+    publicJwk: McpPublisherKey;
+};
+/**
+ * Load or create a publisher keyring. The private keys are written `0600` via
+ * an atomic rename; a missing file is first-use, a corrupt file fails loud.
+ */
+export declare function loadOrCreateMcpPublisherKeyring(input: {
+    filePath: string;
+    publisher: string;
+    now?: Date;
+}): Promise<McpPublisherKeyring>;
+//# sourceMappingURL=signing.d.ts.map

package/dist/signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../src/signing.ts"],"names":[],"mappings":"AAIA,OAAO,EAKL,KAAK,SAAS,EACd,KAAK,GAAG,EACR,KAAK,SAAS,EACf,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,EAIL,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACpB,MAAM,WAAW,CAAC;AAEnB;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,oCAAoC,CAAC;AAC/E,eAAO,MAAM,yBAAyB,mCAAmC,CAAC;AAC1E,eAAO,MAAM,6BAA6B,oCAAoC,CAAC;AAC/E,eAAO,MAAM,2BAA2B,kCAAkC,CAAC;AAC3E,eAAO,MAAM,sCAAsC,6CACP,CAAC;AAS7C;;;;GAIG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;iBAgB1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AAEF,gEAAgE;AAChE,eAAO,MAAM,qBAAqB;;;;;;;;iBAQhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAQpE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;iBAKpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;iBAGvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;iBAGvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,sCAAsC;;;;;iBAKjD,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,sCAAsC,CAC9C,CAAC;AAEF,eAAO,MAAM,iCAAiC;;;;;;;;iBAG5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,CACpC,GAAG,EAAE,MAAM,GAAG,SAAS,KACpB,OAAO,CAAC,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC,CAAC;AAE7D,MAAM,MAAM,+BAA+B,GAAG;IAC5C,MAAM,EAAE,yBAAyB,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,UAAU,EAAE,sBAAsB,GAAG,uBAAuB,CAAC;IAC7D,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,SAAS,GAAG,SAAS,GAAG,GAAG,GAAG,UAAU,CAAC;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,yBAAyB,CAAA;CAAE,CAAC,CA0CnE;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,sBAAsB,GAAG,uBAAuB,CAAC;IAC7D,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAwE3C;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,UAAU,EAAE,sBAAsB,GAAG,uBAAuB,CAAC;IAC7D,MAAM,EAAE,cAAc,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,GAAG,WAAW,CAgBd;AA8BD;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,sBAAsB,EAC7B,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,uBAAuB,CAezB;AAED,wBAAgB,2BAA2B,IAAI,sBAAsB,CAEpE;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,CAElF;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,sBAAsB,CAAC,CASjC;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,+BAA+B,CACnD,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,2BAA2B,CAAC,CActC;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,2BAA2B,EACrC,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,GACf,gCAAgC,GAAG,SAAS,CAM9C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,sBAAsB,EAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,eAAe,EAAE,GACtB,sBAAsB,CAaxB;AAED,sEAAsE;AACtE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,GAAG;IAC9D,IAAI,EAAE,eAAe,EAAE,CAAC;CACzB,CAKA;AAED,sDAAsD;AACtD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,mBAAmB,GAAG;IACpE,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,eAAe,CAAC;CAC5B,CAWA;AAED;;;GAGG;AACH,wBAAsB,+BAA+B,CAAC,KAAK,EAAE;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAwB/B"}

package/dist/signing.js

@@ -0,0 +1,429 @@
+import { generateKeyPairSync, createPrivateKey, randomUUID } from "node:crypto";
+import { mkdir, open, readFile, rename, rm } from "node:fs/promises";
+import { dirname } from "node:path";
+import { decodeProtectedHeader, importJWK, jwtVerify, SignJWT, } from "jose";
+import { z } from "zod";
+import { createMcpToolHandler, hashMcpToolDefinition, mcpToolResource, } from "./core.js";
+/**
+ * A signed MCP tool definition gives a tool a *publisher identity* and an
+ * immutable, versioned lineage on top of the content hash that
+ * `@axtary/mcp` already computes. This is the Axtary profile of the ETDI idea
+ * (arXiv:2506.01333): the publisher signs the exact `definitionHash`, a
+ * semantic version, the required scopes, and a pointer to the prior version's
+ * hash. A client rejects any definition that is unsigned, signed by an
+ * unknown key, mis-signed, or whose on-the-wire bytes no longer hash to the
+ * signed `definitionHash` — and it rejects it *before* the tool is invoked.
+ *
+ * We stay on the JOSE/ES256 profile already used by the ActionPass issuer
+ * keyring; the signature is a compact JWT (`statement+jwt`).
+ */
+export const MCP_SIGNED_DEFINITION_PROFILE = "axtary.mcp_signed_definition.v1";
+export const MCP_SIGNED_DEFINITION_TYP = "axtary-mcp-tool-definition+jwt";
+export const MCP_PUBLISHER_KEYRING_VERSION = "axtary.mcp_publisher_keyring.v0";
+export const MCP_PUBLISHER_TRUST_VERSION = "axtary.mcp_publisher_trust.v0";
+export const MCP_SIGNED_DEFINITION_REGISTRY_VERSION = "axtary.mcp_signed_definition_registry.v0";
+const SemverSchema = z
+    .string()
+    .regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/, "mcp_semver_invalid");
+/**
+ * The claims the publisher signs. `definitionHash` binds the signature to the
+ * exact tool definition; `priorDefinitionHash` links this version to the one
+ * it supersedes so a rug-pull (silent re-definition) is visible as a chain.
+ */
+export const McpSignedDefinitionClaimsSchema = z.object({
+    iss: z.string().min(1),
+    sub: z.string().min(1),
+    iat: z.number().int().positive(),
+    axtary_mcp_profile: z.literal(MCP_SIGNED_DEFINITION_PROFILE),
+    serverIdentity: z.string().min(1),
+    toolName: z.string().min(1),
+    schemaVersion: z.string().min(1),
+    definitionHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    semver: SemverSchema,
+    requiredScopes: z.array(z.string().min(1)).default([]),
+    priorDefinitionHash: z
+        .string()
+        .regex(/^sha256:[a-f0-9]{64}$/)
+        .nullable()
+        .default(null),
+});
+/** A public publisher key, JWKS-shaped, resolvable by `kid`. */
+export const McpPublisherKeySchema = z.object({
+    kid: z.string().min(1),
+    kty: z.string().min(1),
+    crv: z.string().min(1),
+    x: z.string().min(1),
+    y: z.string().min(1),
+    alg: z.literal("ES256").default("ES256"),
+    use: z.literal("sig").default("sig"),
+});
+const McpPublisherKeyRecordSchema = McpPublisherKeySchema.extend({
+    privateKeyPem: z.string().min(1),
+    createdAt: z.string().min(1),
+});
+export const McpPublisherKeyringSchema = z.object({
+    schemaVersion: z.literal(MCP_PUBLISHER_KEYRING_VERSION),
+    publisher: z.string().min(1),
+    activeKid: z.string().min(1),
+    keys: z.array(McpPublisherKeyRecordSchema).min(1),
+});
+/**
+ * The verifier-side trust anchor: a configured map of publisher identity to
+ * the public keys we will accept signatures from. A signature whose `kid` is
+ * not in this store is rejected — there is no trust-on-first-use for
+ * *signatures* (that would defeat publisher identity); TOFU stays at the pin
+ * layer, which is a deliberate, separate, human-reviewed decision.
+ */
+export const McpPublisherTrustEntrySchema = z.object({
+    publisher: z.string().min(1),
+    keys: z.array(McpPublisherKeySchema).min(1),
+});
+export const McpPublisherTrustStoreSchema = z.object({
+    schemaVersion: z.literal(MCP_PUBLISHER_TRUST_VERSION),
+    publishers: z.array(McpPublisherTrustEntrySchema).default([]),
+});
+export const McpSignedDefinitionRegistryEntrySchema = z.object({
+    serverIdentity: z.string().min(1),
+    toolName: z.string().min(1),
+    publisher: z.string().min(1),
+    statement: z.string().min(1),
+});
+export const McpSignedDefinitionRegistrySchema = z.object({
+    schemaVersion: z.literal(MCP_SIGNED_DEFINITION_REGISTRY_VERSION),
+    statements: z.array(McpSignedDefinitionRegistryEntrySchema).default([]),
+});
+/**
+ * Publisher-side: sign a tool definition. The signature commits to the exact
+ * `definitionHash`, so a later byte-level change to the definition cannot be
+ * presented under this signature.
+ */
+export async function signMcpToolDefinition(input) {
+    const semver = SemverSchema.parse(input.semver);
+    const definitionHash = hashMcpToolDefinition(input.definition);
+    const serverIdentity = input.definition.serverIdentity;
+    const toolName = input.definition.name;
+    const issuedAt = Math.floor((input.now ?? new Date()).getTime() / 1000);
+    const claims = McpSignedDefinitionClaimsSchema.parse({
+        iss: input.publisher,
+        sub: mcpToolResource(serverIdentity, toolName),
+        iat: issuedAt,
+        axtary_mcp_profile: MCP_SIGNED_DEFINITION_PROFILE,
+        serverIdentity,
+        toolName,
+        schemaVersion: input.definition.schemaVersion,
+        definitionHash,
+        semver,
+        requiredScopes: input.requiredScopes ?? [],
+        priorDefinitionHash: input.priorDefinitionHash ?? null,
+    });
+    const statement = await new SignJWT({
+        axtary_mcp_profile: claims.axtary_mcp_profile,
+        serverIdentity: claims.serverIdentity,
+        toolName: claims.toolName,
+        schemaVersion: claims.schemaVersion,
+        definitionHash: claims.definitionHash,
+        semver: claims.semver,
+        requiredScopes: claims.requiredScopes,
+        priorDefinitionHash: claims.priorDefinitionHash,
+    })
+        .setProtectedHeader({
+        alg: "ES256",
+        kid: input.keyId,
+        typ: MCP_SIGNED_DEFINITION_TYP,
+    })
+        .setIssuer(claims.iss)
+        .setSubject(claims.sub)
+        .setIssuedAt(issuedAt)
+        .sign(input.signingKey);
+    return { statement, claims };
+}
+/**
+ * Verifier-side: verify a signed definition against a known publisher key and
+ * the *actual* tool definition presented now. Fails closed on every distinct
+ * failure with a stable reason. The `definitionHash` recomputed from the live
+ * definition must equal the signed hash — that is the altered-definition /
+ * tool-poisoning rejection.
+ */
+export async function verifyMcpSignedDefinition(input) {
+    let header;
+    try {
+        header = decodeProtectedHeader(input.statement);
+    }
+    catch {
+        throw new Error("mcp_signature_malformed");
+    }
+    if (header.typ !== MCP_SIGNED_DEFINITION_TYP) {
+        throw new Error("mcp_signature_type_invalid");
+    }
+    if (!header.kid) {
+        throw new Error("mcp_signature_key_id_required");
+    }
+    const key = await input.verificationKeys(header.kid);
+    if (!key) {
+        throw new Error(`mcp_publisher_key_not_found:${header.kid}`);
+    }
+    const expectedSubject = mcpToolResource(input.definition.serverIdentity, input.definition.name);
+    let payload;
+    try {
+        ({ payload } = await jwtVerify(input.statement, key, {
+            algorithms: ["ES256"],
+            issuer: input.expectedPublisher,
+            subject: expectedSubject,
+        }));
+    }
+    catch {
+        throw new Error("mcp_signature_invalid");
+    }
+    const parsed = McpSignedDefinitionClaimsSchema.safeParse(payload);
+    if (!parsed.success) {
+        throw new Error("mcp_signed_claims_invalid");
+    }
+    const claims = parsed.data;
+    if (claims.axtary_mcp_profile !== MCP_SIGNED_DEFINITION_PROFILE) {
+        throw new Error("mcp_signed_profile_invalid");
+    }
+    if (claims.serverIdentity !== input.definition.serverIdentity) {
+        throw new Error(`mcp_signed_server_identity_mismatch:${input.definition.serverIdentity}`);
+    }
+    if (claims.toolName !== input.definition.name) {
+        throw new Error(`mcp_signed_tool_name_mismatch:${input.definition.name}`);
+    }
+    if (claims.schemaVersion !== input.definition.schemaVersion) {
+        throw new Error(`mcp_signed_schema_version_mismatch:${input.definition.schemaVersion}`);
+    }
+    const liveHash = hashMcpToolDefinition(input.definition);
+    if (claims.definitionHash !== liveHash) {
+        throw new Error(`mcp_signed_definition_hash_mismatch:${liveHash}`);
+    }
+    return {
+        claims,
+        publisher: claims.iss,
+        kid: header.kid,
+        semver: claims.semver,
+        requiredScopes: claims.requiredScopes,
+        definitionHash: claims.definitionHash,
+        priorDefinitionHash: claims.priorDefinitionHash,
+    };
+}
+/**
+ * Wrap a tool invoker so the publisher signature is verified against the live
+ * definition *before* the tool runs. Any failure — unsigned (no statement
+ * configured is simply not this handler), mis-signed, unknown key, or an
+ * altered definition whose bytes no longer hash to the signed value — throws
+ * and the tool is never invoked. When the action carries bound provenance, it
+ * must also agree with the verified signature.
+ */
+export function createSignedMcpToolHandler(input) {
+    const baseHandler = createMcpToolHandler({
+        definition: input.definition,
+        invoke: input.invoke,
+    });
+    return async (request) => {
+        const verification = await verifyMcpSignedDefinition({
+            statement: input.statement,
+            definition: input.definition,
+            verificationKeys: input.verificationKeys,
+            expectedPublisher: input.expectedPublisher,
+        });
+        assertActionProvenanceMatches(request.action, verification);
+        return baseHandler(request);
+    };
+}
+/**
+ * If an action was built with bound signed provenance, it must match the
+ * signature we just verified. A hash-only action (no bound provenance) is
+ * allowed through a signed handler — the signature check above already gates
+ * it — but mismatched bound provenance is a fail-closed rejection.
+ */
+function assertActionProvenanceMatches(action, verification) {
+    const bound = action.toolDefinition;
+    if (!bound)
+        return;
+    if (bound.definitionHash !== verification.definitionHash) {
+        throw new Error(`mcp_signed_definition_hash_mismatch:${verification.definitionHash}`);
+    }
+    if (bound.publisher && bound.publisher !== verification.publisher) {
+        throw new Error(`mcp_signed_publisher_mismatch:${verification.publisher}`);
+    }
+    if (bound.publisherKeyId && bound.publisherKeyId !== verification.kid) {
+        throw new Error(`mcp_signed_publisher_key_mismatch:${verification.kid}`);
+    }
+    if (bound.semver && bound.semver !== verification.semver) {
+        throw new Error(`mcp_signed_semver_mismatch:${verification.semver}`);
+    }
+}
+/**
+ * Build a key resolver from a configured trust store. A `kid` that is not
+ * present (optionally scoped to `expectedPublisher`) resolves to `undefined`,
+ * which makes verification fail closed.
+ */
+export function mcpPublisherKeyResolver(store, options = {}) {
+    const parsed = McpPublisherTrustStoreSchema.parse(store);
+    return async (kid) => {
+        if (!kid)
+            return undefined;
+        for (const entry of parsed.publishers) {
+            if (options.publisher && entry.publisher !== options.publisher) {
+                continue;
+            }
+            const jwk = entry.keys.find((key) => key.kid === kid);
+            if (jwk) {
+                return importJWK(jwk, "ES256");
+            }
+        }
+        return undefined;
+    };
+}
+export function emptyMcpPublisherTrustStore() {
+    return { schemaVersion: MCP_PUBLISHER_TRUST_VERSION, publishers: [] };
+}
+export function parseMcpPublisherTrustStore(input) {
+    return McpPublisherTrustStoreSchema.parse(input);
+}
+export async function loadMcpPublisherTrustStore(path) {
+    try {
+        return parseMcpPublisherTrustStore(JSON.parse(await readFile(path, "utf8")));
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return emptyMcpPublisherTrustStore();
+        }
+        throw error;
+    }
+}
+export async function saveMcpPublisherTrustStore(path, store) {
+    await writePrivateJson(path, McpPublisherTrustStoreSchema.parse(store));
+}
+export async function loadMcpSignedDefinitionRegistry(path) {
+    try {
+        return McpSignedDefinitionRegistrySchema.parse(JSON.parse(await readFile(path, "utf8")));
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return {
+                schemaVersion: MCP_SIGNED_DEFINITION_REGISTRY_VERSION,
+                statements: [],
+            };
+        }
+        throw error;
+    }
+}
+export function findMcpSignedDefinition(registry, serverIdentity, toolName) {
+    const parsed = McpSignedDefinitionRegistrySchema.parse(registry);
+    return parsed.statements.find((entry) => entry.serverIdentity === serverIdentity && entry.toolName === toolName);
+}
+/**
+ * Add (or replace) a publisher's public keys in the trust store. Pure: never
+ * mutates the input. Used to register a publisher's JWKS for verification.
+ */
+export function trustMcpPublisher(store, publisher, keys) {
+    const parsed = McpPublisherTrustStoreSchema.parse(store);
+    const entry = McpPublisherTrustEntrySchema.parse({
+        publisher,
+        keys: keys.map((key) => McpPublisherKeySchema.parse(key)),
+    });
+    const others = parsed.publishers.filter((p) => p.publisher !== publisher);
+    return {
+        schemaVersion: MCP_PUBLISHER_TRUST_VERSION,
+        publishers: [...others, entry].sort((left, right) => left.publisher < right.publisher ? -1 : left.publisher > right.publisher ? 1 : 0),
+    };
+}
+/** Public JWKS for a publisher keyring, suitable for distribution. */
+export function mcpPublisherJwks(keyring) {
+    const parsed = McpPublisherKeyringSchema.parse(keyring);
+    return {
+        keys: parsed.keys.map((key) => McpPublisherKeySchema.parse(stripPrivate(key))),
+    };
+}
+/** The active signing key for a publisher keyring. */
+export function mcpPublisherSigningKey(keyring) {
+    const parsed = McpPublisherKeyringSchema.parse(keyring);
+    const active = parsed.keys.find((key) => key.kid === parsed.activeKid);
+    if (!active) {
+        throw new Error("mcp_publisher_active_key_missing");
+    }
+    return {
+        kid: active.kid,
+        privateKey: createPrivateKey(active.privateKeyPem),
+        publicJwk: McpPublisherKeySchema.parse(stripPrivate(active)),
+    };
+}
+/**
+ * Load or create a publisher keyring. The private keys are written `0600` via
+ * an atomic rename; a missing file is first-use, a corrupt file fails loud.
+ */
+export async function loadOrCreateMcpPublisherKeyring(input) {
+    try {
+        const data = McpPublisherKeyringSchema.parse(JSON.parse(await readFile(input.filePath, "utf8")));
+        if (data.publisher !== input.publisher) {
+            throw new Error("mcp_publisher_keyring_identity_mismatch");
+        }
+        return data;
+    }
+    catch (error) {
+        if (error.code !== "ENOENT") {
+            throw error;
+        }
+    }
+    const key = createMcpPublisherKeyRecord(input.now ?? new Date());
+    const keyring = {
+        schemaVersion: MCP_PUBLISHER_KEYRING_VERSION,
+        publisher: input.publisher,
+        activeKid: key.kid,
+        keys: [key],
+    };
+    await writePrivateJson(input.filePath, keyring);
+    return keyring;
+}
+function createMcpPublisherKeyRecord(now) {
+    const { privateKey, publicKey } = generateKeyPairSync("ec", {
+        namedCurve: "P-256",
+    });
+    const kid = `mcp-publisher-${randomUUID().slice(0, 12)}`;
+    const jwk = publicKey.export({ format: "jwk" });
+    return McpPublisherKeyRecordSchema.parse({
+        kid,
+        kty: jwk.kty,
+        crv: jwk.crv,
+        x: jwk.x,
+        y: jwk.y,
+        alg: "ES256",
+        use: "sig",
+        privateKeyPem: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+        createdAt: now.toISOString(),
+    });
+}
+function stripPrivate(key) {
+    return {
+        kid: key.kid,
+        kty: key.kty,
+        crv: key.crv,
+        x: key.x,
+        y: key.y,
+        alg: key.alg,
+        use: key.use,
+    };
+}
+async function writePrivateJson(filePath, value) {
+    await mkdir(dirname(filePath), { recursive: true });
+    const tmpPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+    let renamed = false;
+    try {
+        const handle = await open(tmpPath, "wx", 0o600);
+        try {
+            await handle.writeFile(`${JSON.stringify(value, null, 2)}\n`, "utf8");
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await rename(tmpPath, filePath);
+        renamed = true;
+    }
+    finally {
+        if (!renamed) {
+            await rm(tmpPath, { force: true });
+        }
+    }
+}
+//# sourceMappingURL=signing.js.map