@credat/mcp 0.1.2-alpha.1

package/dist/index.d.ts

@@ -0,0 +1,130 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import * as credat from 'credat';
+import { DelegationConstraints, DelegationResult, ChallengeMessage } from 'credat';
+
+interface ConstraintContext {
+    transactionValue?: number;
+    domain?: string;
+    [key: string]: unknown;
+}
+interface ConstraintViolation {
+    constraint: string;
+    message: string;
+}
+interface CredatAuthOptions {
+    /** DID of the server, used as the challenge issuer (e.g. "did:web:api.example.com") */
+    serverDid: string;
+    /** Public key of the owner who issued delegation credentials */
+    ownerPublicKey: Uint8Array;
+    /** Static agent public key (for single-agent scenarios) */
+    agentPublicKey?: Uint8Array;
+    /** Resolve an agent's public key from their DID (for multi-agent scenarios) */
+    resolveAgentKey?: (agentDid: string) => Promise<Uint8Array>;
+    /** Max age for challenges before they expire. Default: 300_000 (5 minutes) */
+    challengeMaxAgeMs?: number;
+    /** Max age for authenticated sessions. Default: 3_600_000 (1 hour) */
+    sessionMaxAgeMs?: number;
+    /** Tool name prefix. Default: "credat" → tools become "credat:challenge", "credat:authenticate" */
+    toolPrefix?: string;
+}
+interface ProtectOptions {
+    /** Required scopes — agent must have ALL of these */
+    scopes?: string[];
+    /** Required scopes — agent must have at least ONE of these */
+    anyScope?: string[];
+    /** Constraint context for runtime constraint validation */
+    constraintContext?: ConstraintContext | ((args: Record<string, unknown>) => ConstraintContext);
+}
+interface AuthContext {
+    /** Authenticated agent's DID */
+    agentDid: string;
+    /** DID of the owner who delegated permissions */
+    ownerDid: string;
+    /** Granted scopes */
+    scopes: string[];
+    /** Delegation constraints (if any) */
+    constraints?: DelegationConstraints;
+}
+interface SessionAuth {
+    delegationResult: DelegationResult & {
+        valid: true;
+    };
+    authenticatedAt: number;
+}
+interface StoredChallenge {
+    challenge: credat.ChallengeMessage;
+    sessionId: string;
+    createdAt: number;
+}
+interface AuthErrorPayload {
+    error: string;
+    code: string;
+    details?: string[];
+}
+/** Minimal subset of MCP's RequestHandlerExtra we depend on */
+interface ToolExtra {
+    sessionId?: string;
+    signal: AbortSignal;
+    [key: string]: unknown;
+}
+
+type ProtectedHandler<TArgs> = (args: TArgs, extra: ToolExtra & {
+    auth: AuthContext;
+}) => CallToolResult | Promise<CallToolResult>;
+declare class CredatAuth {
+    private readonly config;
+    private readonly challengeStore;
+    private readonly sessionStore;
+    private readonly protectFn;
+    constructor(options: CredatAuthOptions);
+    /** Register the credat:challenge and credat:authenticate tools on the server */
+    install(server: McpServer): void;
+    /** Wrap a tool handler to require authentication + optional scope/constraint checks */
+    protect<TArgs extends Record<string, unknown>>(options: ProtectOptions, handler: ProtectedHandler<TArgs>): (args: TArgs, extra: ToolExtra) => CallToolResult | Promise<CallToolResult>;
+    /** Check if a session is currently authenticated */
+    isAuthenticated(sessionId?: string): boolean;
+    /** Get the auth result for a session */
+    getSessionAuth(sessionId?: string): SessionAuth | undefined;
+    /** Revoke a session, forcing re-authentication */
+    revokeSession(sessionId?: string): void;
+}
+
+declare const McpAuthErrorCodes: {
+    readonly NOT_AUTHENTICATED: "NOT_AUTHENTICATED";
+    readonly SESSION_EXPIRED: "SESSION_EXPIRED";
+    readonly SESSION_MISMATCH: "SESSION_MISMATCH";
+    readonly INSUFFICIENT_SCOPES: "INSUFFICIENT_SCOPES";
+    readonly CONSTRAINT_VIOLATION: "CONSTRAINT_VIOLATION";
+    readonly CONFIGURATION_ERROR: "CONFIGURATION_ERROR";
+};
+type McpAuthErrorCode = (typeof McpAuthErrorCodes)[keyof typeof McpAuthErrorCodes];
+declare function authError(message: string, code: string, details?: string[]): CallToolResult;
+declare function scopeError(required: string[], actual: string[]): CallToolResult;
+declare function constraintError(violations: ConstraintViolation[]): CallToolResult;
+
+declare class ChallengeStore {
+    private store;
+    private readonly maxAgeMs;
+    private readonly maxSize;
+    private insertsSinceCleanup;
+    constructor(maxAgeMs: number, maxSize?: number);
+    set(nonce: string, challenge: ChallengeMessage, sessionId: string): void;
+    /** Consume a challenge (single-use). Returns and deletes. */
+    consume(nonce: string): StoredChallenge | undefined;
+    cleanup(): void;
+    get size(): number;
+}
+declare class SessionStore {
+    private store;
+    private readonly maxAgeMs;
+    private insertsSinceCleanup;
+    constructor(maxAgeMs: number);
+    set(sessionId: string, auth: SessionAuth): void;
+    get(sessionId: string): SessionAuth | undefined;
+    delete(sessionId: string): boolean;
+    cleanup(): void;
+    get size(): number;
+}
+
+export { type AuthContext, type AuthErrorPayload, ChallengeStore, CredatAuth, type CredatAuthOptions, type McpAuthErrorCode, McpAuthErrorCodes, type ProtectOptions, type SessionAuth, SessionStore, type StoredChallenge, type ToolExtra, authError, constraintError, scopeError };

package/dist/index.js

@@ -0,0 +1,392 @@
+// src/auth.ts
+import { z } from "zod";
+
+// src/protect.ts
+import { hasAllScopes, hasAnyScope } from "credat";
+
+// src/constraints.ts
+function validateConstraints(constraints, context) {
+  if (!constraints) return [];
+  const violations = [];
+  if (constraints.maxTransactionValue != null && context.transactionValue != null) {
+    if (context.transactionValue > constraints.maxTransactionValue) {
+      violations.push({
+        constraint: "maxTransactionValue",
+        message: `${context.transactionValue} exceeds max ${constraints.maxTransactionValue}`
+      });
+    }
+  }
+  if (constraints.allowedDomains != null && context.domain != null) {
+    if (!constraints.allowedDomains.includes(context.domain)) {
+      violations.push({
+        constraint: "allowedDomains",
+        message: `Domain "${context.domain}" is not in allowed list: ${constraints.allowedDomains.join(", ")}`
+      });
+    }
+  }
+  if (constraints.rateLimit != null && typeof context.rateLimit === "number") {
+    if (context.rateLimit > constraints.rateLimit) {
+      violations.push({
+        constraint: "rateLimit",
+        message: `Rate ${context.rateLimit} exceeds limit ${constraints.rateLimit}`
+      });
+    }
+  }
+  return violations;
+}
+
+// src/errors.ts
+var McpAuthErrorCodes = {
+  NOT_AUTHENTICATED: "NOT_AUTHENTICATED",
+  SESSION_EXPIRED: "SESSION_EXPIRED",
+  SESSION_MISMATCH: "SESSION_MISMATCH",
+  INSUFFICIENT_SCOPES: "INSUFFICIENT_SCOPES",
+  CONSTRAINT_VIOLATION: "CONSTRAINT_VIOLATION",
+  CONFIGURATION_ERROR: "CONFIGURATION_ERROR"
+};
+function authError(message, code, details) {
+  const payload = { error: message, code };
+  if (details && details.length > 0) {
+    payload.details = details;
+  }
+  return {
+    content: [{ type: "text", text: JSON.stringify(payload) }],
+    isError: true
+  };
+}
+function scopeError(required, actual) {
+  const missing = required.filter((s) => !actual.includes(s));
+  return authError(
+    `Insufficient scopes. Missing: ${missing.join(", ")}`,
+    McpAuthErrorCodes.INSUFFICIENT_SCOPES,
+    [`required: ${required.join(", ")}`, `granted: ${actual.join(", ")}`]
+  );
+}
+function constraintError(violations) {
+  return authError(
+    `Constraint violation: ${violations.map((v) => v.message).join("; ")}`,
+    McpAuthErrorCodes.CONSTRAINT_VIOLATION,
+    violations.map((v) => `${v.constraint}: ${v.message}`)
+  );
+}
+
+// src/protect.ts
+var STDIO_SESSION_KEY = "__stdio__";
+function createProtect(sessionStore) {
+  return function protect(options, handler) {
+    return (args, extra) => {
+      const sessionId = extra.sessionId ?? STDIO_SESSION_KEY;
+      const session = sessionStore.get(sessionId);
+      if (!session) {
+        return authError(
+          "Not authenticated. Call the credat:challenge tool to begin authentication.",
+          McpAuthErrorCodes.NOT_AUTHENTICATED
+        );
+      }
+      const { delegationResult } = session;
+      if (options.scopes && options.scopes.length > 0) {
+        if (!hasAllScopes(delegationResult, options.scopes)) {
+          return scopeError(options.scopes, delegationResult.scopes);
+        }
+      }
+      if (options.anyScope && options.anyScope.length > 0) {
+        if (!hasAnyScope(delegationResult, options.anyScope)) {
+          return scopeError(options.anyScope, delegationResult.scopes);
+        }
+      }
+      if (options.constraintContext) {
+        const context = typeof options.constraintContext === "function" ? options.constraintContext(args) : options.constraintContext;
+        const violations = validateConstraints(delegationResult.constraints, context);
+        if (violations.length > 0) {
+          return constraintError(violations);
+        }
+      }
+      const authContext = {
+        agentDid: delegationResult.agent,
+        ownerDid: delegationResult.owner,
+        scopes: delegationResult.scopes,
+        constraints: delegationResult.constraints
+      };
+      const augmentedExtra = Object.assign({}, extra, {
+        auth: authContext
+      });
+      return handler(args, augmentedExtra);
+    };
+  };
+}
+
+// src/session.ts
+var DEFAULT_MAX_SIZE = 1e3;
+var CLEANUP_THRESHOLD = 100;
+var ChallengeStore = class {
+  store = /* @__PURE__ */ new Map();
+  maxAgeMs;
+  maxSize;
+  insertsSinceCleanup = 0;
+  constructor(maxAgeMs, maxSize = DEFAULT_MAX_SIZE) {
+    this.maxAgeMs = maxAgeMs;
+    this.maxSize = maxSize;
+  }
+  set(nonce, challenge, sessionId) {
+    this.store.set(nonce, {
+      challenge,
+      sessionId,
+      createdAt: Date.now()
+    });
+    this.insertsSinceCleanup++;
+    if (this.insertsSinceCleanup >= CLEANUP_THRESHOLD || this.store.size > this.maxSize) {
+      this.cleanup();
+      this.insertsSinceCleanup = 0;
+    }
+  }
+  /** Consume a challenge (single-use). Returns and deletes. */
+  consume(nonce) {
+    const entry = this.store.get(nonce);
+    if (!entry) return void 0;
+    this.store.delete(nonce);
+    if (Date.now() - entry.createdAt > this.maxAgeMs) {
+      return void 0;
+    }
+    return entry;
+  }
+  cleanup() {
+    const now = Date.now();
+    for (const [nonce, entry] of this.store) {
+      if (now - entry.createdAt > this.maxAgeMs) {
+        this.store.delete(nonce);
+      }
+    }
+    if (this.store.size > this.maxSize) {
+      const entries = [...this.store.entries()].sort((a, b) => a[1].createdAt - b[1].createdAt);
+      const toRemove = entries.slice(0, this.store.size - this.maxSize);
+      for (const [nonce] of toRemove) {
+        this.store.delete(nonce);
+      }
+    }
+  }
+  get size() {
+    return this.store.size;
+  }
+};
+var SessionStore = class {
+  store = /* @__PURE__ */ new Map();
+  maxAgeMs;
+  insertsSinceCleanup = 0;
+  constructor(maxAgeMs) {
+    this.maxAgeMs = maxAgeMs;
+  }
+  set(sessionId, auth) {
+    this.store.set(sessionId, auth);
+    this.insertsSinceCleanup++;
+    if (this.insertsSinceCleanup >= CLEANUP_THRESHOLD) {
+      this.cleanup();
+      this.insertsSinceCleanup = 0;
+    }
+  }
+  get(sessionId) {
+    const entry = this.store.get(sessionId);
+    if (!entry) return void 0;
+    if (Date.now() - entry.authenticatedAt > this.maxAgeMs) {
+      this.store.delete(sessionId);
+      return void 0;
+    }
+    return entry;
+  }
+  delete(sessionId) {
+    return this.store.delete(sessionId);
+  }
+  cleanup() {
+    const now = Date.now();
+    for (const [sessionId, entry] of this.store) {
+      if (now - entry.authenticatedAt > this.maxAgeMs) {
+        this.store.delete(sessionId);
+      }
+    }
+  }
+  get size() {
+    return this.store.size;
+  }
+};
+
+// src/tools/authenticate.ts
+import { verifyPresentation } from "credat";
+var STDIO_SESSION_KEY2 = "__stdio__";
+function createAuthenticateHandler(config, challengeStore, sessionStore) {
+  return async (args, extra) => {
+    const { presentation } = args;
+    const sessionId = extra.sessionId ?? STDIO_SESSION_KEY2;
+    const stored = challengeStore.consume(presentation.nonce);
+    if (!stored) {
+      return authError(
+        "Unknown or expired challenge nonce. Request a new challenge.",
+        McpAuthErrorCodes.NOT_AUTHENTICATED
+      );
+    }
+    if (stored.sessionId !== sessionId) {
+      return authError(
+        "Challenge was issued to a different session.",
+        McpAuthErrorCodes.SESSION_MISMATCH
+      );
+    }
+    let agentPublicKey;
+    if (config.agentPublicKey) {
+      agentPublicKey = config.agentPublicKey;
+    } else if (config.resolveAgentKey) {
+      try {
+        agentPublicKey = await config.resolveAgentKey(presentation.from);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : "Unknown error";
+        return authError(
+          `Failed to resolve agent public key for ${presentation.from}: ${message}`,
+          McpAuthErrorCodes.CONFIGURATION_ERROR
+        );
+      }
+    } else {
+      return authError(
+        "No agentPublicKey configured and no resolveAgentKey callback provided.",
+        McpAuthErrorCodes.CONFIGURATION_ERROR
+      );
+    }
+    const result = await verifyPresentation(presentation, {
+      challenge: stored.challenge,
+      ownerPublicKey: config.ownerPublicKey,
+      agentPublicKey,
+      challengeMaxAgeMs: config.challengeMaxAgeMs
+    });
+    if (!result.valid) {
+      const details = result.errors.map((e) => `${e.code}: ${e.message}`);
+      return authError(
+        "Authentication failed.",
+        result.errors[0]?.code ?? "HANDSHAKE_VERIFICATION_FAILED",
+        details
+      );
+    }
+    sessionStore.set(sessionId, {
+      delegationResult: result,
+      authenticatedAt: Date.now()
+    });
+    return {
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify({
+            authenticated: true,
+            agent: result.agent,
+            scopes: result.scopes
+          })
+        }
+      ]
+    };
+  };
+}
+
+// src/tools/challenge.ts
+import { createChallenge } from "credat";
+var STDIO_SESSION_KEY3 = "__stdio__";
+function createChallengeHandler(serverDid, challengeStore) {
+  return (extra) => {
+    const challenge = createChallenge({ from: serverDid });
+    const sessionId = extra.sessionId ?? STDIO_SESSION_KEY3;
+    challengeStore.set(challenge.nonce, challenge, sessionId);
+    return {
+      content: [{ type: "text", text: JSON.stringify(challenge) }]
+    };
+  };
+}
+
+// src/auth.ts
+var DEFAULT_CHALLENGE_MAX_AGE_MS = 5 * 60 * 1e3;
+var DEFAULT_SESSION_MAX_AGE_MS = 60 * 60 * 1e3;
+var DEFAULT_TOOL_PREFIX = "credat";
+var STDIO_SESSION_KEY4 = "__stdio__";
+var CredatAuth = class {
+  config;
+  challengeStore;
+  sessionStore;
+  protectFn;
+  constructor(options) {
+    if (!options.serverDid) {
+      throw new Error("CredatAuth: serverDid is required");
+    }
+    if (!options.ownerPublicKey || options.ownerPublicKey.length === 0) {
+      throw new Error("CredatAuth: ownerPublicKey is required");
+    }
+    this.config = {
+      serverDid: options.serverDid,
+      ownerPublicKey: options.ownerPublicKey,
+      agentPublicKey: options.agentPublicKey,
+      resolveAgentKey: options.resolveAgentKey,
+      challengeMaxAgeMs: options.challengeMaxAgeMs ?? DEFAULT_CHALLENGE_MAX_AGE_MS,
+      sessionMaxAgeMs: options.sessionMaxAgeMs ?? DEFAULT_SESSION_MAX_AGE_MS,
+      toolPrefix: options.toolPrefix ?? DEFAULT_TOOL_PREFIX
+    };
+    this.challengeStore = new ChallengeStore(this.config.challengeMaxAgeMs);
+    this.sessionStore = new SessionStore(this.config.sessionMaxAgeMs);
+    this.protectFn = createProtect(this.sessionStore);
+  }
+  /** Register the credat:challenge and credat:authenticate tools on the server */
+  install(server) {
+    const prefix = this.config.toolPrefix;
+    const challengeHandler = createChallengeHandler(this.config.serverDid, this.challengeStore);
+    const authenticateHandler = createAuthenticateHandler(
+      this.config,
+      this.challengeStore,
+      this.sessionStore
+    );
+    server.registerTool(
+      `${prefix}:challenge`,
+      {
+        description: "Request an authentication challenge. Returns a nonce that must be signed with your delegation credential."
+      },
+      (extra) => challengeHandler(extra)
+    );
+    server.registerTool(
+      `${prefix}:authenticate`,
+      {
+        description: "Present your signed credentials to authenticate. Requires a presentation object containing delegation proof and signed nonce.",
+        inputSchema: z.object({
+          presentation: z.object({
+            type: z.literal("credat:presentation"),
+            delegation: z.string(),
+            nonce: z.string(),
+            proof: z.string(),
+            from: z.string()
+          })
+        })
+      },
+      (args, extra) => authenticateHandler(
+        args,
+        extra
+      )
+    );
+  }
+  /** Wrap a tool handler to require authentication + optional scope/constraint checks */
+  protect(options, handler) {
+    return this.protectFn(options, handler);
+  }
+  /** Check if a session is currently authenticated */
+  isAuthenticated(sessionId) {
+    const key = sessionId ?? STDIO_SESSION_KEY4;
+    return this.sessionStore.get(key) !== void 0;
+  }
+  /** Get the auth result for a session */
+  getSessionAuth(sessionId) {
+    const key = sessionId ?? STDIO_SESSION_KEY4;
+    return this.sessionStore.get(key);
+  }
+  /** Revoke a session, forcing re-authentication */
+  revokeSession(sessionId) {
+    const key = sessionId ?? STDIO_SESSION_KEY4;
+    this.sessionStore.delete(key);
+  }
+};
+export {
+  ChallengeStore,
+  CredatAuth,
+  McpAuthErrorCodes,
+  SessionStore,
+  authError,
+  constraintError,
+  scopeError
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth.ts","../src/protect.ts","../src/constraints.ts","../src/errors.ts","../src/session.ts","../src/tools/authenticate.ts","../src/tools/challenge.ts"],"sourcesContent":["import type { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport type { CallToolResult } from \"@modelcontextprotocol/sdk/types.js\";\nimport { z } from \"zod\";\nimport { createProtect } from \"./protect.js\";\nimport { ChallengeStore, SessionStore } from \"./session.js\";\nimport { createAuthenticateHandler } from \"./tools/authenticate.js\";\nimport { createChallengeHandler } from \"./tools/challenge.js\";\nimport type {\n\tAuthContext,\n\tCredatAuthOptions,\n\tProtectOptions,\n\tSessionAuth,\n\tToolExtra,\n} from \"./types.js\";\n\nconst DEFAULT_CHALLENGE_MAX_AGE_MS = 5 * 60 * 1000; // 5 minutes\nconst DEFAULT_SESSION_MAX_AGE_MS = 60 * 60 * 1000; // 1 hour\nconst DEFAULT_TOOL_PREFIX = \"credat\";\n\nconst STDIO_SESSION_KEY = \"__stdio__\";\n\ntype ProtectedHandler<TArgs> = (\n\targs: TArgs,\n\textra: ToolExtra & { auth: AuthContext },\n) => CallToolResult | Promise<CallToolResult>;\n\nexport class CredatAuth {\n\tprivate readonly config: Required<\n\t\tPick<\n\t\t\tCredatAuthOptions,\n\t\t\t\"serverDid\" | \"ownerPublicKey\" | \"challengeMaxAgeMs\" | \"sessionMaxAgeMs\" | \"toolPrefix\"\n\t\t>\n\t> &\n\t\tPick<CredatAuthOptions, \"agentPublicKey\" | \"resolveAgentKey\">;\n\n\tprivate readonly challengeStore: ChallengeStore;\n\tprivate readonly sessionStore: SessionStore;\n\tprivate readonly protectFn: ReturnType<typeof createProtect>;\n\n\tconstructor(options: CredatAuthOptions) {\n\t\tif (!options.serverDid) {\n\t\t\tthrow new Error(\"CredatAuth: serverDid is required\");\n\t\t}\n\t\tif (!options.ownerPublicKey || options.ownerPublicKey.length === 0) {\n\t\t\tthrow new Error(\"CredatAuth: ownerPublicKey is required\");\n\t\t}\n\n\t\tthis.config = {\n\t\t\tserverDid: options.serverDid,\n\t\t\townerPublicKey: options.ownerPublicKey,\n\t\t\tagentPublicKey: options.agentPublicKey,\n\t\t\tresolveAgentKey: options.resolveAgentKey,\n\t\t\tchallengeMaxAgeMs: options.challengeMaxAgeMs ?? DEFAULT_CHALLENGE_MAX_AGE_MS,\n\t\t\tsessionMaxAgeMs: options.sessionMaxAgeMs ?? DEFAULT_SESSION_MAX_AGE_MS,\n\t\t\ttoolPrefix: options.toolPrefix ?? DEFAULT_TOOL_PREFIX,\n\t\t};\n\n\t\tthis.challengeStore = new ChallengeStore(this.config.challengeMaxAgeMs);\n\t\tthis.sessionStore = new SessionStore(this.config.sessionMaxAgeMs);\n\t\tthis.protectFn = createProtect(this.sessionStore);\n\t}\n\n\t/** Register the credat:challenge and credat:authenticate tools on the server */\n\tinstall(server: McpServer): void {\n\t\tconst prefix = this.config.toolPrefix;\n\n\t\tconst challengeHandler = createChallengeHandler(this.config.serverDid, this.challengeStore);\n\n\t\tconst authenticateHandler = createAuthenticateHandler(\n\t\t\tthis.config,\n\t\t\tthis.challengeStore,\n\t\t\tthis.sessionStore,\n\t\t);\n\n\t\t// Register challenge tool (no input — callback receives just extra)\n\t\tserver.registerTool(\n\t\t\t`${prefix}:challenge`,\n\t\t\t{\n\t\t\t\tdescription:\n\t\t\t\t\t\"Request an authentication challenge. Returns a nonce that must be signed with your delegation credential.\",\n\t\t\t},\n\t\t\t(extra) => challengeHandler(extra as ToolExtra),\n\t\t);\n\n\t\t// Register authenticate tool\n\t\tserver.registerTool(\n\t\t\t`${prefix}:authenticate`,\n\t\t\t{\n\t\t\t\tdescription:\n\t\t\t\t\t\"Present your signed credentials to authenticate. Requires a presentation object containing delegation proof and signed nonce.\",\n\t\t\t\tinputSchema: z.object({\n\t\t\t\t\tpresentation: z.object({\n\t\t\t\t\t\ttype: z.literal(\"credat:presentation\"),\n\t\t\t\t\t\tdelegation: z.string(),\n\t\t\t\t\t\tnonce: z.string(),\n\t\t\t\t\t\tproof: z.string(),\n\t\t\t\t\t\tfrom: z.string(),\n\t\t\t\t\t}),\n\t\t\t\t}),\n\t\t\t},\n\t\t\t(args, extra) =>\n\t\t\t\tauthenticateHandler(\n\t\t\t\t\targs as {\n\t\t\t\t\t\tpresentation: {\n\t\t\t\t\t\t\ttype: \"credat:presentation\";\n\t\t\t\t\t\t\tdelegation: string;\n\t\t\t\t\t\t\tnonce: string;\n\t\t\t\t\t\t\tproof: string;\n\t\t\t\t\t\t\tfrom: string;\n\t\t\t\t\t\t};\n\t\t\t\t\t},\n\t\t\t\t\textra as ToolExtra,\n\t\t\t\t),\n\t\t);\n\t}\n\n\t/** Wrap a tool handler to require authentication + optional scope/constraint checks */\n\tprotect<TArgs extends Record<string, unknown>>(\n\t\toptions: ProtectOptions,\n\t\thandler: ProtectedHandler<TArgs>,\n\t) {\n\t\treturn this.protectFn(options, handler);\n\t}\n\n\t/** Check if a session is currently authenticated */\n\tisAuthenticated(sessionId?: string): boolean {\n\t\tconst key = sessionId ?? STDIO_SESSION_KEY;\n\t\treturn this.sessionStore.get(key) !== undefined;\n\t}\n\n\t/** Get the auth result for a session */\n\tgetSessionAuth(sessionId?: string): SessionAuth | undefined {\n\t\tconst key = sessionId ?? STDIO_SESSION_KEY;\n\t\treturn this.sessionStore.get(key);\n\t}\n\n\t/** Revoke a session, forcing re-authentication */\n\trevokeSession(sessionId?: string): void {\n\t\tconst key = sessionId ?? STDIO_SESSION_KEY;\n\t\tthis.sessionStore.delete(key);\n\t}\n}\n","import type { CallToolResult } from \"@modelcontextprotocol/sdk/types.js\";\nimport { hasAllScopes, hasAnyScope } from \"credat\";\nimport { validateConstraints } from \"./constraints.js\";\nimport { authError, constraintError, McpAuthErrorCodes, scopeError } from \"./errors.js\";\nimport type { SessionStore } from \"./session.js\";\nimport type { AuthContext, ProtectOptions, ToolExtra } from \"./types.js\";\n\nconst STDIO_SESSION_KEY = \"__stdio__\";\n\ntype ProtectedHandler<TArgs> = (\n\targs: TArgs,\n\textra: ToolExtra & { auth: AuthContext },\n) => CallToolResult | Promise<CallToolResult>;\n\ntype ToolHandler<TArgs> = (\n\targs: TArgs,\n\textra: ToolExtra,\n) => CallToolResult | Promise<CallToolResult>;\n\nexport function createProtect(sessionStore: SessionStore) {\n\treturn function protect<TArgs extends Record<string, unknown>>(\n\t\toptions: ProtectOptions,\n\t\thandler: ProtectedHandler<TArgs>,\n\t): ToolHandler<TArgs> {\n\t\treturn (args: TArgs, extra: ToolExtra) => {\n\t\t\tconst sessionId = extra.sessionId ?? STDIO_SESSION_KEY;\n\n\t\t\t// 1. Check authentication\n\t\t\tconst session = sessionStore.get(sessionId);\n\t\t\tif (!session) {\n\t\t\t\treturn authError(\n\t\t\t\t\t\"Not authenticated. Call the credat:challenge tool to begin authentication.\",\n\t\t\t\t\tMcpAuthErrorCodes.NOT_AUTHENTICATED,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst { delegationResult } = session;\n\n\t\t\t// 2. Check required scopes (ALL)\n\t\t\tif (options.scopes && options.scopes.length > 0) {\n\t\t\t\tif (!hasAllScopes(delegationResult, options.scopes)) {\n\t\t\t\t\treturn scopeError(options.scopes, delegationResult.scopes);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// 3. Check required scopes (ANY)\n\t\t\tif (options.anyScope && options.anyScope.length > 0) {\n\t\t\t\tif (!hasAnyScope(delegationResult, options.anyScope)) {\n\t\t\t\t\treturn scopeError(options.anyScope, delegationResult.scopes);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// 4. Validate constraints\n\t\t\tif (options.constraintContext) {\n\t\t\t\tconst context =\n\t\t\t\t\ttypeof options.constraintContext === \"function\"\n\t\t\t\t\t\t? options.constraintContext(args as Record<string, unknown>)\n\t\t\t\t\t\t: options.constraintContext;\n\n\t\t\t\tconst violations = validateConstraints(delegationResult.constraints, context);\n\t\t\t\tif (violations.length > 0) {\n\t\t\t\t\treturn constraintError(violations);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// 5. Build auth context and call handler\n\t\t\tconst authContext: AuthContext = {\n\t\t\t\tagentDid: delegationResult.agent,\n\t\t\t\townerDid: delegationResult.owner,\n\t\t\t\tscopes: delegationResult.scopes,\n\t\t\t\tconstraints: delegationResult.constraints,\n\t\t\t};\n\n\t\t\tconst augmentedExtra = Object.assign({}, extra, {\n\t\t\t\tauth: authContext,\n\t\t\t});\n\n\t\t\treturn handler(args, augmentedExtra);\n\t\t};\n\t};\n}\n","import type { DelegationConstraints } from \"credat\";\nimport type { ConstraintContext, ConstraintViolation } from \"./types.js\";\n\nexport function validateConstraints(\n\tconstraints: DelegationConstraints | undefined,\n\tcontext: ConstraintContext,\n): ConstraintViolation[] {\n\tif (!constraints) return [];\n\n\tconst violations: ConstraintViolation[] = [];\n\n\tif (constraints.maxTransactionValue != null && context.transactionValue != null) {\n\t\tif (context.transactionValue > constraints.maxTransactionValue) {\n\t\t\tviolations.push({\n\t\t\t\tconstraint: \"maxTransactionValue\",\n\t\t\t\tmessage: `${context.transactionValue} exceeds max ${constraints.maxTransactionValue}`,\n\t\t\t});\n\t\t}\n\t}\n\n\tif (constraints.allowedDomains != null && context.domain != null) {\n\t\tif (!constraints.allowedDomains.includes(context.domain)) {\n\t\t\tviolations.push({\n\t\t\t\tconstraint: \"allowedDomains\",\n\t\t\t\tmessage: `Domain \"${context.domain}\" is not in allowed list: ${constraints.allowedDomains.join(\", \")}`,\n\t\t\t});\n\t\t}\n\t}\n\n\tif (constraints.rateLimit != null && typeof context.rateLimit === \"number\") {\n\t\tif (context.rateLimit > constraints.rateLimit) {\n\t\t\tviolations.push({\n\t\t\t\tconstraint: \"rateLimit\",\n\t\t\t\tmessage: `Rate ${context.rateLimit} exceeds limit ${constraints.rateLimit}`,\n\t\t\t});\n\t\t}\n\t}\n\n\treturn violations;\n}\n","import type { CallToolResult } from \"@modelcontextprotocol/sdk/types.js\";\nimport type { AuthErrorPayload, ConstraintViolation } from \"./types.js\";\n\n// ── Error Codes ──\n\nexport const McpAuthErrorCodes = {\n\tNOT_AUTHENTICATED: \"NOT_AUTHENTICATED\",\n\tSESSION_EXPIRED: \"SESSION_EXPIRED\",\n\tSESSION_MISMATCH: \"SESSION_MISMATCH\",\n\tINSUFFICIENT_SCOPES: \"INSUFFICIENT_SCOPES\",\n\tCONSTRAINT_VIOLATION: \"CONSTRAINT_VIOLATION\",\n\tCONFIGURATION_ERROR: \"CONFIGURATION_ERROR\",\n} as const;\n\nexport type McpAuthErrorCode = (typeof McpAuthErrorCodes)[keyof typeof McpAuthErrorCodes];\n\n// ── Error Response Builders ──\n\nexport function authError(message: string, code: string, details?: string[]): CallToolResult {\n\tconst payload: AuthErrorPayload = { error: message, code };\n\tif (details && details.length > 0) {\n\t\tpayload.details = details;\n\t}\n\treturn {\n\t\tcontent: [{ type: \"text\", text: JSON.stringify(payload) }],\n\t\tisError: true,\n\t};\n}\n\nexport function scopeError(required: string[], actual: string[]): CallToolResult {\n\tconst missing = required.filter((s) => !actual.includes(s));\n\treturn authError(\n\t\t`Insufficient scopes. Missing: ${missing.join(\", \")}`,\n\t\tMcpAuthErrorCodes.INSUFFICIENT_SCOPES,\n\t\t[`required: ${required.join(\", \")}`, `granted: ${actual.join(\", \")}`],\n\t);\n}\n\nexport function constraintError(violations: ConstraintViolation[]): CallToolResult {\n\treturn authError(\n\t\t`Constraint violation: ${violations.map((v) => v.message).join(\"; \")}`,\n\t\tMcpAuthErrorCodes.CONSTRAINT_VIOLATION,\n\t\tviolations.map((v) => `${v.constraint}: ${v.message}`),\n\t);\n}\n","import type { ChallengeMessage } from \"credat\";\nimport type { SessionAuth, StoredChallenge } from \"./types.js\";\n\nconst DEFAULT_MAX_SIZE = 1000;\nconst CLEANUP_THRESHOLD = 100;\n\n// ── Challenge Store ──\n\nexport class ChallengeStore {\n\tprivate store = new Map<string, StoredChallenge>();\n\tprivate readonly maxAgeMs: number;\n\tprivate readonly maxSize: number;\n\tprivate insertsSinceCleanup = 0;\n\n\tconstructor(maxAgeMs: number, maxSize = DEFAULT_MAX_SIZE) {\n\t\tthis.maxAgeMs = maxAgeMs;\n\t\tthis.maxSize = maxSize;\n\t}\n\n\tset(nonce: string, challenge: ChallengeMessage, sessionId: string): void {\n\t\tthis.store.set(nonce, {\n\t\t\tchallenge,\n\t\t\tsessionId,\n\t\t\tcreatedAt: Date.now(),\n\t\t});\n\n\t\tthis.insertsSinceCleanup++;\n\t\tif (this.insertsSinceCleanup >= CLEANUP_THRESHOLD || this.store.size > this.maxSize) {\n\t\t\tthis.cleanup();\n\t\t\tthis.insertsSinceCleanup = 0;\n\t\t}\n\t}\n\n\t/** Consume a challenge (single-use). Returns and deletes. */\n\tconsume(nonce: string): StoredChallenge | undefined {\n\t\tconst entry = this.store.get(nonce);\n\t\tif (!entry) return undefined;\n\n\t\tthis.store.delete(nonce);\n\n\t\tif (Date.now() - entry.createdAt > this.maxAgeMs) {\n\t\t\treturn undefined;\n\t\t}\n\n\t\treturn entry;\n\t}\n\n\tcleanup(): void {\n\t\tconst now = Date.now();\n\t\tfor (const [nonce, entry] of this.store) {\n\t\t\tif (now - entry.createdAt > this.maxAgeMs) {\n\t\t\t\tthis.store.delete(nonce);\n\t\t\t}\n\t\t}\n\n\t\t// Evict oldest if still over max size\n\t\tif (this.store.size > this.maxSize) {\n\t\t\tconst entries = [...this.store.entries()].sort((a, b) => a[1].createdAt - b[1].createdAt);\n\t\t\tconst toRemove = entries.slice(0, this.store.size - this.maxSize);\n\t\t\tfor (const [nonce] of toRemove) {\n\t\t\t\tthis.store.delete(nonce);\n\t\t\t}\n\t\t}\n\t}\n\n\tget size(): number {\n\t\treturn this.store.size;\n\t}\n}\n\n// ── Session Store ──\n\nexport class SessionStore {\n\tprivate store = new Map<string, SessionAuth>();\n\tprivate readonly maxAgeMs: number;\n\tprivate insertsSinceCleanup = 0;\n\n\tconstructor(maxAgeMs: number) {\n\t\tthis.maxAgeMs = maxAgeMs;\n\t}\n\n\tset(sessionId: string, auth: SessionAuth): void {\n\t\tthis.store.set(sessionId, auth);\n\n\t\tthis.insertsSinceCleanup++;\n\t\tif (this.insertsSinceCleanup >= CLEANUP_THRESHOLD) {\n\t\t\tthis.cleanup();\n\t\t\tthis.insertsSinceCleanup = 0;\n\t\t}\n\t}\n\n\tget(sessionId: string): SessionAuth | undefined {\n\t\tconst entry = this.store.get(sessionId);\n\t\tif (!entry) return undefined;\n\n\t\tif (Date.now() - entry.authenticatedAt > this.maxAgeMs) {\n\t\t\tthis.store.delete(sessionId);\n\t\t\treturn undefined;\n\t\t}\n\n\t\treturn entry;\n\t}\n\n\tdelete(sessionId: string): boolean {\n\t\treturn this.store.delete(sessionId);\n\t}\n\n\tcleanup(): void {\n\t\tconst now = Date.now();\n\t\tfor (const [sessionId, entry] of this.store) {\n\t\t\tif (now - entry.authenticatedAt > this.maxAgeMs) {\n\t\t\t\tthis.store.delete(sessionId);\n\t\t\t}\n\t\t}\n\t}\n\n\tget size(): number {\n\t\treturn this.store.size;\n\t}\n}\n","import type { CallToolResult } from \"@modelcontextprotocol/sdk/types.js\";\nimport type { PresentationMessage } from \"credat\";\nimport { verifyPresentation } from \"credat\";\nimport { authError, McpAuthErrorCodes } from \"../errors.js\";\nimport type { ChallengeStore, SessionStore } from \"../session.js\";\nimport type { CredatAuthOptions, ToolExtra } from \"../types.js\";\n\nconst STDIO_SESSION_KEY = \"__stdio__\";\n\nexport function createAuthenticateHandler(\n\tconfig: CredatAuthOptions,\n\tchallengeStore: ChallengeStore,\n\tsessionStore: SessionStore,\n) {\n\treturn async (\n\t\targs: { presentation: PresentationMessage },\n\t\textra: ToolExtra,\n\t): Promise<CallToolResult> => {\n\t\tconst { presentation } = args;\n\t\tconst sessionId = extra.sessionId ?? STDIO_SESSION_KEY;\n\n\t\t// 1. Consume challenge (single-use nonce)\n\t\tconst stored = challengeStore.consume(presentation.nonce);\n\t\tif (!stored) {\n\t\t\treturn authError(\n\t\t\t\t\"Unknown or expired challenge nonce. Request a new challenge.\",\n\t\t\t\tMcpAuthErrorCodes.NOT_AUTHENTICATED,\n\t\t\t);\n\t\t}\n\n\t\t// 2. Verify session binding\n\t\tif (stored.sessionId !== sessionId) {\n\t\t\treturn authError(\n\t\t\t\t\"Challenge was issued to a different session.\",\n\t\t\t\tMcpAuthErrorCodes.SESSION_MISMATCH,\n\t\t\t);\n\t\t}\n\n\t\t// 3. Resolve agent public key\n\t\tlet agentPublicKey: Uint8Array;\n\t\tif (config.agentPublicKey) {\n\t\t\tagentPublicKey = config.agentPublicKey;\n\t\t} else if (config.resolveAgentKey) {\n\t\t\ttry {\n\t\t\t\tagentPublicKey = await config.resolveAgentKey(presentation.from);\n\t\t\t} catch (err) {\n\t\t\t\tconst message = err instanceof Error ? err.message : \"Unknown error\";\n\t\t\t\treturn authError(\n\t\t\t\t\t`Failed to resolve agent public key for ${presentation.from}: ${message}`,\n\t\t\t\t\tMcpAuthErrorCodes.CONFIGURATION_ERROR,\n\t\t\t\t);\n\t\t\t}\n\t\t} else {\n\t\t\treturn authError(\n\t\t\t\t\"No agentPublicKey configured and no resolveAgentKey callback provided.\",\n\t\t\t\tMcpAuthErrorCodes.CONFIGURATION_ERROR,\n\t\t\t);\n\t\t}\n\n\t\t// 4. Verify presentation\n\t\tconst result = await verifyPresentation(presentation, {\n\t\t\tchallenge: stored.challenge,\n\t\t\townerPublicKey: config.ownerPublicKey,\n\t\t\tagentPublicKey,\n\t\t\tchallengeMaxAgeMs: config.challengeMaxAgeMs,\n\t\t});\n\n\t\tif (!result.valid) {\n\t\t\tconst details = result.errors.map((e) => `${e.code}: ${e.message}`);\n\t\t\treturn authError(\n\t\t\t\t\"Authentication failed.\",\n\t\t\t\tresult.errors[0]?.code ?? \"HANDSHAKE_VERIFICATION_FAILED\",\n\t\t\t\tdetails,\n\t\t\t);\n\t\t}\n\n\t\t// 5. Store session auth\n\t\tsessionStore.set(sessionId, {\n\t\t\tdelegationResult: result,\n\t\t\tauthenticatedAt: Date.now(),\n\t\t});\n\n\t\treturn {\n\t\t\tcontent: [\n\t\t\t\t{\n\t\t\t\t\ttype: \"text\",\n\t\t\t\t\ttext: JSON.stringify({\n\t\t\t\t\t\tauthenticated: true,\n\t\t\t\t\t\tagent: result.agent,\n\t\t\t\t\t\tscopes: result.scopes,\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t],\n\t\t};\n\t};\n}\n","import type { CallToolResult } from \"@modelcontextprotocol/sdk/types.js\";\nimport { createChallenge } from \"credat\";\nimport type { ChallengeStore } from \"../session.js\";\nimport type { ToolExtra } from \"../types.js\";\n\nconst STDIO_SESSION_KEY = \"__stdio__\";\n\nexport function createChallengeHandler(serverDid: string, challengeStore: ChallengeStore) {\n\treturn (extra: ToolExtra): CallToolResult => {\n\t\tconst challenge = createChallenge({ from: serverDid });\n\t\tconst sessionId = extra.sessionId ?? STDIO_SESSION_KEY;\n\n\t\tchallengeStore.set(challenge.nonce, challenge, sessionId);\n\n\t\treturn {\n\t\t\tcontent: [{ type: \"text\", text: JSON.stringify(challenge) }],\n\t\t};\n\t};\n}\n"],"mappings":";AAEA,SAAS,SAAS;;;ACDlB,SAAS,cAAc,mBAAmB;;;ACEnC,SAAS,oBACf,aACA,SACwB;AACxB,MAAI,CAAC,YAAa,QAAO,CAAC;AAE1B,QAAM,aAAoC,CAAC;AAE3C,MAAI,YAAY,uBAAuB,QAAQ,QAAQ,oBAAoB,MAAM;AAChF,QAAI,QAAQ,mBAAmB,YAAY,qBAAqB;AAC/D,iBAAW,KAAK;AAAA,QACf,YAAY;AAAA,QACZ,SAAS,GAAG,QAAQ,gBAAgB,gBAAgB,YAAY,mBAAmB;AAAA,MACpF,CAAC;AAAA,IACF;AAAA,EACD;AAEA,MAAI,YAAY,kBAAkB,QAAQ,QAAQ,UAAU,MAAM;AACjE,QAAI,CAAC,YAAY,eAAe,SAAS,QAAQ,MAAM,GAAG;AACzD,iBAAW,KAAK;AAAA,QACf,YAAY;AAAA,QACZ,SAAS,WAAW,QAAQ,MAAM,6BAA6B,YAAY,eAAe,KAAK,IAAI,CAAC;AAAA,MACrG,CAAC;AAAA,IACF;AAAA,EACD;AAEA,MAAI,YAAY,aAAa,QAAQ,OAAO,QAAQ,cAAc,UAAU;AAC3E,QAAI,QAAQ,YAAY,YAAY,WAAW;AAC9C,iBAAW,KAAK;AAAA,QACf,YAAY;AAAA,QACZ,SAAS,QAAQ,QAAQ,SAAS,kBAAkB,YAAY,SAAS;AAAA,MAC1E,CAAC;AAAA,IACF;AAAA,EACD;AAEA,SAAO;AACR;;;AClCO,IAAM,oBAAoB;AAAA,EAChC,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,qBAAqB;AAAA,EACrB,sBAAsB;AAAA,EACtB,qBAAqB;AACtB;AAMO,SAAS,UAAU,SAAiB,MAAc,SAAoC;AAC5F,QAAM,UAA4B,EAAE,OAAO,SAAS,KAAK;AACzD,MAAI,WAAW,QAAQ,SAAS,GAAG;AAClC,YAAQ,UAAU;AAAA,EACnB;AACA,SAAO;AAAA,IACN,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,OAAO,EAAE,CAAC;AAAA,IACzD,SAAS;AAAA,EACV;AACD;AAEO,SAAS,WAAW,UAAoB,QAAkC;AAChF,QAAM,UAAU,SAAS,OAAO,CAAC,MAAM,CAAC,OAAO,SAAS,CAAC,CAAC;AAC1D,SAAO;AAAA,IACN,iCAAiC,QAAQ,KAAK,IAAI,CAAC;AAAA,IACnD,kBAAkB;AAAA,IAClB,CAAC,aAAa,SAAS,KAAK,IAAI,CAAC,IAAI,YAAY,OAAO,KAAK,IAAI,CAAC,EAAE;AAAA,EACrE;AACD;AAEO,SAAS,gBAAgB,YAAmD;AAClF,SAAO;AAAA,IACN,yBAAyB,WAAW,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,IACpE,kBAAkB;AAAA,IAClB,WAAW,IAAI,CAAC,MAAM,GAAG,EAAE,UAAU,KAAK,EAAE,OAAO,EAAE;AAAA,EACtD;AACD;;;AFrCA,IAAM,oBAAoB;AAYnB,SAAS,cAAc,cAA4B;AACzD,SAAO,SAAS,QACf,SACA,SACqB;AACrB,WAAO,CAAC,MAAa,UAAqB;AACzC,YAAM,YAAY,MAAM,aAAa;AAGrC,YAAM,UAAU,aAAa,IAAI,SAAS;AAC1C,UAAI,CAAC,SAAS;AACb,eAAO;AAAA,UACN;AAAA,UACA,kBAAkB;AAAA,QACnB;AAAA,MACD;AAEA,YAAM,EAAE,iBAAiB,IAAI;AAG7B,UAAI,QAAQ,UAAU,QAAQ,OAAO,SAAS,GAAG;AAChD,YAAI,CAAC,aAAa,kBAAkB,QAAQ,MAAM,GAAG;AACpD,iBAAO,WAAW,QAAQ,QAAQ,iBAAiB,MAAM;AAAA,QAC1D;AAAA,MACD;AAGA,UAAI,QAAQ,YAAY,QAAQ,SAAS,SAAS,GAAG;AACpD,YAAI,CAAC,YAAY,kBAAkB,QAAQ,QAAQ,GAAG;AACrD,iBAAO,WAAW,QAAQ,UAAU,iBAAiB,MAAM;AAAA,QAC5D;AAAA,MACD;AAGA,UAAI,QAAQ,mBAAmB;AAC9B,cAAM,UACL,OAAO,QAAQ,sBAAsB,aAClC,QAAQ,kBAAkB,IAA+B,IACzD,QAAQ;AAEZ,cAAM,aAAa,oBAAoB,iBAAiB,aAAa,OAAO;AAC5E,YAAI,WAAW,SAAS,GAAG;AAC1B,iBAAO,gBAAgB,UAAU;AAAA,QAClC;AAAA,MACD;AAGA,YAAM,cAA2B;AAAA,QAChC,UAAU,iBAAiB;AAAA,QAC3B,UAAU,iBAAiB;AAAA,QAC3B,QAAQ,iBAAiB;AAAA,QACzB,aAAa,iBAAiB;AAAA,MAC/B;AAEA,YAAM,iBAAiB,OAAO,OAAO,CAAC,GAAG,OAAO;AAAA,QAC/C,MAAM;AAAA,MACP,CAAC;AAED,aAAO,QAAQ,MAAM,cAAc;AAAA,IACpC;AAAA,EACD;AACD;;;AG7EA,IAAM,mBAAmB;AACzB,IAAM,oBAAoB;AAInB,IAAM,iBAAN,MAAqB;AAAA,EACnB,QAAQ,oBAAI,IAA6B;AAAA,EAChC;AAAA,EACA;AAAA,EACT,sBAAsB;AAAA,EAE9B,YAAY,UAAkB,UAAU,kBAAkB;AACzD,SAAK,WAAW;AAChB,SAAK,UAAU;AAAA,EAChB;AAAA,EAEA,IAAI,OAAe,WAA6B,WAAyB;AACxE,SAAK,MAAM,IAAI,OAAO;AAAA,MACrB;AAAA,MACA;AAAA,MACA,WAAW,KAAK,IAAI;AAAA,IACrB,CAAC;AAED,SAAK;AACL,QAAI,KAAK,uBAAuB,qBAAqB,KAAK,MAAM,OAAO,KAAK,SAAS;AACpF,WAAK,QAAQ;AACb,WAAK,sBAAsB;AAAA,IAC5B;AAAA,EACD;AAAA;AAAA,EAGA,QAAQ,OAA4C;AACnD,UAAM,QAAQ,KAAK,MAAM,IAAI,KAAK;AAClC,QAAI,CAAC,MAAO,QAAO;AAEnB,SAAK,MAAM,OAAO,KAAK;AAEvB,QAAI,KAAK,IAAI,IAAI,MAAM,YAAY,KAAK,UAAU;AACjD,aAAO;AAAA,IACR;AAEA,WAAO;AAAA,EACR;AAAA,EAEA,UAAgB;AACf,UAAM,MAAM,KAAK,IAAI;AACrB,eAAW,CAAC,OAAO,KAAK,KAAK,KAAK,OAAO;AACxC,UAAI,MAAM,MAAM,YAAY,KAAK,UAAU;AAC1C,aAAK,MAAM,OAAO,KAAK;AAAA,MACxB;AAAA,IACD;AAGA,QAAI,KAAK,MAAM,OAAO,KAAK,SAAS;AACnC,YAAM,UAAU,CAAC,GAAG,KAAK,MAAM,QAAQ,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS;AACxF,YAAM,WAAW,QAAQ,MAAM,GAAG,KAAK,MAAM,OAAO,KAAK,OAAO;AAChE,iBAAW,CAAC,KAAK,KAAK,UAAU;AAC/B,aAAK,MAAM,OAAO,KAAK;AAAA,MACxB;AAAA,IACD;AAAA,EACD;AAAA,EAEA,IAAI,OAAe;AAClB,WAAO,KAAK,MAAM;AAAA,EACnB;AACD;AAIO,IAAM,eAAN,MAAmB;AAAA,EACjB,QAAQ,oBAAI,IAAyB;AAAA,EAC5B;AAAA,EACT,sBAAsB;AAAA,EAE9B,YAAY,UAAkB;AAC7B,SAAK,WAAW;AAAA,EACjB;AAAA,EAEA,IAAI,WAAmB,MAAyB;AAC/C,SAAK,MAAM,IAAI,WAAW,IAAI;AAE9B,SAAK;AACL,QAAI,KAAK,uBAAuB,mBAAmB;AAClD,WAAK,QAAQ;AACb,WAAK,sBAAsB;AAAA,IAC5B;AAAA,EACD;AAAA,EAEA,IAAI,WAA4C;AAC/C,UAAM,QAAQ,KAAK,MAAM,IAAI,SAAS;AACtC,QAAI,CAAC,MAAO,QAAO;AAEnB,QAAI,KAAK,IAAI,IAAI,MAAM,kBAAkB,KAAK,UAAU;AACvD,WAAK,MAAM,OAAO,SAAS;AAC3B,aAAO;AAAA,IACR;AAEA,WAAO;AAAA,EACR;AAAA,EAEA,OAAO,WAA4B;AAClC,WAAO,KAAK,MAAM,OAAO,SAAS;AAAA,EACnC;AAAA,EAEA,UAAgB;AACf,UAAM,MAAM,KAAK,IAAI;AACrB,eAAW,CAAC,WAAW,KAAK,KAAK,KAAK,OAAO;AAC5C,UAAI,MAAM,MAAM,kBAAkB,KAAK,UAAU;AAChD,aAAK,MAAM,OAAO,SAAS;AAAA,MAC5B;AAAA,IACD;AAAA,EACD;AAAA,EAEA,IAAI,OAAe;AAClB,WAAO,KAAK,MAAM;AAAA,EACnB;AACD;;;ACrHA,SAAS,0BAA0B;AAKnC,IAAMA,qBAAoB;AAEnB,SAAS,0BACf,QACA,gBACA,cACC;AACD,SAAO,OACN,MACA,UAC6B;AAC7B,UAAM,EAAE,aAAa,IAAI;AACzB,UAAM,YAAY,MAAM,aAAaA;AAGrC,UAAM,SAAS,eAAe,QAAQ,aAAa,KAAK;AACxD,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,QACN;AAAA,QACA,kBAAkB;AAAA,MACnB;AAAA,IACD;AAGA,QAAI,OAAO,cAAc,WAAW;AACnC,aAAO;AAAA,QACN;AAAA,QACA,kBAAkB;AAAA,MACnB;AAAA,IACD;AAGA,QAAI;AACJ,QAAI,OAAO,gBAAgB;AAC1B,uBAAiB,OAAO;AAAA,IACzB,WAAW,OAAO,iBAAiB;AAClC,UAAI;AACH,yBAAiB,MAAM,OAAO,gBAAgB,aAAa,IAAI;AAAA,MAChE,SAAS,KAAK;AACb,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,eAAO;AAAA,UACN,0CAA0C,aAAa,IAAI,KAAK,OAAO;AAAA,UACvE,kBAAkB;AAAA,QACnB;AAAA,MACD;AAAA,IACD,OAAO;AACN,aAAO;AAAA,QACN;AAAA,QACA,kBAAkB;AAAA,MACnB;AAAA,IACD;AAGA,UAAM,SAAS,MAAM,mBAAmB,cAAc;AAAA,MACrD,WAAW,OAAO;AAAA,MAClB,gBAAgB,OAAO;AAAA,MACvB;AAAA,MACA,mBAAmB,OAAO;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,OAAO,OAAO;AAClB,YAAM,UAAU,OAAO,OAAO,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,EAAE,OAAO,EAAE;AAClE,aAAO;AAAA,QACN;AAAA,QACA,OAAO,OAAO,CAAC,GAAG,QAAQ;AAAA,QAC1B;AAAA,MACD;AAAA,IACD;AAGA,iBAAa,IAAI,WAAW;AAAA,MAC3B,kBAAkB;AAAA,MAClB,iBAAiB,KAAK,IAAI;AAAA,IAC3B,CAAC;AAED,WAAO;AAAA,MACN,SAAS;AAAA,QACR;AAAA,UACC,MAAM;AAAA,UACN,MAAM,KAAK,UAAU;AAAA,YACpB,eAAe;AAAA,YACf,OAAO,OAAO;AAAA,YACd,QAAQ,OAAO;AAAA,UAChB,CAAC;AAAA,QACF;AAAA,MACD;AAAA,IACD;AAAA,EACD;AACD;;;AC9FA,SAAS,uBAAuB;AAIhC,IAAMC,qBAAoB;AAEnB,SAAS,uBAAuB,WAAmB,gBAAgC;AACzF,SAAO,CAAC,UAAqC;AAC5C,UAAM,YAAY,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACrD,UAAM,YAAY,MAAM,aAAaA;AAErC,mBAAe,IAAI,UAAU,OAAO,WAAW,SAAS;AAExD,WAAO;AAAA,MACN,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,SAAS,EAAE,CAAC;AAAA,IAC5D;AAAA,EACD;AACD;;;ANHA,IAAM,+BAA+B,IAAI,KAAK;AAC9C,IAAM,6BAA6B,KAAK,KAAK;AAC7C,IAAM,sBAAsB;AAE5B,IAAMC,qBAAoB;AAOnB,IAAM,aAAN,MAAiB;AAAA,EACN;AAAA,EAQA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,SAA4B;AACvC,QAAI,CAAC,QAAQ,WAAW;AACvB,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACpD;AACA,QAAI,CAAC,QAAQ,kBAAkB,QAAQ,eAAe,WAAW,GAAG;AACnE,YAAM,IAAI,MAAM,wCAAwC;AAAA,IACzD;AAEA,SAAK,SAAS;AAAA,MACb,WAAW,QAAQ;AAAA,MACnB,gBAAgB,QAAQ;AAAA,MACxB,gBAAgB,QAAQ;AAAA,MACxB,iBAAiB,QAAQ;AAAA,MACzB,mBAAmB,QAAQ,qBAAqB;AAAA,MAChD,iBAAiB,QAAQ,mBAAmB;AAAA,MAC5C,YAAY,QAAQ,cAAc;AAAA,IACnC;AAEA,SAAK,iBAAiB,IAAI,eAAe,KAAK,OAAO,iBAAiB;AACtE,SAAK,eAAe,IAAI,aAAa,KAAK,OAAO,eAAe;AAChE,SAAK,YAAY,cAAc,KAAK,YAAY;AAAA,EACjD;AAAA;AAAA,EAGA,QAAQ,QAAyB;AAChC,UAAM,SAAS,KAAK,OAAO;AAE3B,UAAM,mBAAmB,uBAAuB,KAAK,OAAO,WAAW,KAAK,cAAc;AAE1F,UAAM,sBAAsB;AAAA,MAC3B,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IACN;AAGA,WAAO;AAAA,MACN,GAAG,MAAM;AAAA,MACT;AAAA,QACC,aACC;AAAA,MACF;AAAA,MACA,CAAC,UAAU,iBAAiB,KAAkB;AAAA,IAC/C;AAGA,WAAO;AAAA,MACN,GAAG,MAAM;AAAA,MACT;AAAA,QACC,aACC;AAAA,QACD,aAAa,EAAE,OAAO;AAAA,UACrB,cAAc,EAAE,OAAO;AAAA,YACtB,MAAM,EAAE,QAAQ,qBAAqB;AAAA,YACrC,YAAY,EAAE,OAAO;AAAA,YACrB,OAAO,EAAE,OAAO;AAAA,YAChB,OAAO,EAAE,OAAO;AAAA,YAChB,MAAM,EAAE,OAAO;AAAA,UAChB,CAAC;AAAA,QACF,CAAC;AAAA,MACF;AAAA,MACA,CAAC,MAAM,UACN;AAAA,QACC;AAAA,QASA;AAAA,MACD;AAAA,IACF;AAAA,EACD;AAAA;AAAA,EAGA,QACC,SACA,SACC;AACD,WAAO,KAAK,UAAU,SAAS,OAAO;AAAA,EACvC;AAAA;AAAA,EAGA,gBAAgB,WAA6B;AAC5C,UAAM,MAAM,aAAaA;AACzB,WAAO,KAAK,aAAa,IAAI,GAAG,MAAM;AAAA,EACvC;AAAA;AAAA,EAGA,eAAe,WAA6C;AAC3D,UAAM,MAAM,aAAaA;AACzB,WAAO,KAAK,aAAa,IAAI,GAAG;AAAA,EACjC;AAAA;AAAA,EAGA,cAAc,WAA0B;AACvC,UAAM,MAAM,aAAaA;AACzB,SAAK,aAAa,OAAO,GAAG;AAAA,EAC7B;AACD;","names":["STDIO_SESSION_KEY","STDIO_SESSION_KEY","STDIO_SESSION_KEY"]}

package/package.json

@@ -0,0 +1,78 @@
+{
+  "name": "@credat/mcp",
+  "version": "0.1.2-alpha.1",
+  "description": "Trust & authentication layer for MCP servers — verify agent identity, delegated permissions, and scopes using Credat",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "lint": "biome check src/",
+    "lint:fix": "biome check --write src/",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "authentication",
+    "authorization",
+    "trust",
+    "agent",
+    "delegation",
+    "verifiable-credentials",
+    "did",
+    "credat",
+    "ai-agent",
+    "middleware"
+  ],
+  "author": "Maxime Mansiet",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/credat/credat-mcp.git"
+  },
+  "homepage": "https://github.com/credat/credat-mcp#readme",
+  "bugs": {
+    "url": "https://github.com/credat/credat-mcp/issues"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "peerDependencies": {
+    "credat": "^0.2.0-alpha.1",
+    "@modelcontextprotocol/sdk": "^1.27.0",
+    "zod": "^3.25.0"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.4.0",
+    "@modelcontextprotocol/sdk": "^1.27.0",
+    "@types/node": "^22.0.0",
+    "credat": "^0.2.0-alpha.1",
+    "tsup": "^8.5.1",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.18",
+    "zod": "^3.25.0"
+  }
+}