@keycardai/eve 0.1.0

package/dist/esm/testing/testUtils.js

@@ -0,0 +1,90 @@
+/**
+ * A zone client that mints deterministic tokens and records what it was asked
+ * for.
+ *
+ * Covers the three cases the contract requires from a testing seam: successful
+ * acquisition, failure of one resource, and failure of every call.
+ */
+export function fakeZoneClient(options = {}) {
+    const calls = { exchanges: [], impersonations: [], clientCredentials: [] };
+    const issue = (kind, resource) => {
+        if (options.fail)
+            throw options.fail;
+        const failure = resource ? options.failResources?.[resource] : undefined;
+        if (failure)
+            throw failure;
+        return {
+            accessToken: `${kind}-token-for-${resource ?? "unknown"}`,
+            tokenType: "Bearer",
+            ...(options.expiresIn !== undefined ? { expiresIn: options.expiresIn } : {}),
+        };
+    };
+    return {
+        calls,
+        async exchangeToken(request) {
+            calls.exchanges.push(request);
+            return issue("exchanged", request.resource);
+        },
+        async impersonate(request) {
+            calls.impersonations.push(request);
+            return issue("impersonated", request.resource);
+        },
+        async clientCredentialsGrant(request) {
+            calls.clientCredentials.push(request ?? {});
+            return issue("app", request?.resource);
+        },
+    };
+}
+/** An unsigned JWT with the given claims, for decode-only paths. */
+export function unsignedJwt(claims) {
+    const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+    return `${encode({ alg: "RS256", typ: "JWT" })}.${encode(claims)}.signature`;
+}
+/** A JWT that expired `secondsAgo` seconds ago. */
+export function expiredJwt(secondsAgo = 60) {
+    return unsignedJwt({ exp: Math.floor(Date.now() / 1000) - secondsAgo, sub: "user-1" });
+}
+/** A JWT that is valid for another `secondsAhead` seconds. */
+export function validJwt(secondsAhead = 3600, claims = {}) {
+    return unsignedJwt({
+        exp: Math.floor(Date.now() / 1000) + secondsAhead,
+        sub: "user-1",
+        ...claims,
+    });
+}
+/** A request carrying a bearer token. */
+export function bearerRequest(token, url = "https://agent.example.com/chat") {
+    return new Request(url, { headers: { authorization: `Bearer ${token}` } });
+}
+/** A verification seam that accepts one token and rejects everything else. */
+export function fakeVerifier(accepted, claims) {
+    return async (token) => {
+        if (token !== accepted)
+            throw new Error("Invalid token");
+        return claims;
+    };
+}
+/** A user connection principal. */
+export function userPrincipal(id = "user-1", issuer = "https://zone.example.com", attributes) {
+    return { type: "user", id, issuer, ...(attributes ? { attributes } : {}) };
+}
+/** The app connection principal. */
+export function appPrincipal() {
+    return { type: "app" };
+}
+/** A session auth context, as `keycardAuth` would return it. */
+export function sessionAuthContext(overrides = {}) {
+    return {
+        attributes: {},
+        authenticator: "keycard",
+        issuer: "https://zone.example.com",
+        principalId: "user-1",
+        principalType: "user",
+        ...overrides,
+    };
+}
+/** The connection metadata eve passes to every authorization callback. */
+export function connectionContext(url = "https://mcp.example.com/mcp") {
+    return { url };
+}
+//# sourceMappingURL=testUtils.js.map

package/dist/esm/testing/testUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testUtils.js","sourceRoot":"","sources":["../../../src/testing/testUtils.ts"],"names":[],"mappings":"AAiCA;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,UAAiC,EAAE;IAChE,MAAM,KAAK,GAAc,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC;IAEtF,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,QAA4B,EAAiB,EAAE;QAC1E,IAAI,OAAO,CAAC,IAAI;YAAE,MAAM,OAAO,CAAC,IAAI,CAAC;QACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC;QAC3B,OAAO;YACL,WAAW,EAAE,GAAG,IAAI,cAAc,QAAQ,IAAI,SAAS,EAAE;YACzD,SAAS,EAAE,QAAQ;YACnB,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7E,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,KAAK;QACL,KAAK,CAAC,aAAa,CAAC,OAAO;YACzB,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,OAAO,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,OAAO;YACvB,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnC,OAAO,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,CAAC,sBAAsB,CAAC,OAAO;YAClC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YAC5C,OAAO,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,WAAW,CAAC,MAA+B;IACzD,MAAM,MAAM,GAAG,CAAC,KAAc,EAAU,EAAE,CACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3D,OAAO,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;AAC/E,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,UAAU,CAAC,UAAU,GAAG,EAAE;IACxC,OAAO,WAAW,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,QAAQ,CAAC,YAAY,GAAG,IAAI,EAAE,SAAkC,EAAE;IAChF,OAAO,WAAW,CAAC;QACjB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,YAAY;QACjD,GAAG,EAAE,QAAQ;QACb,GAAG,MAAM;KACV,CAAC,CAAC;AACL,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,GAAG,GAAG,gCAAgC;IACjF,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAC1B,QAAgB,EAChB,MAAiB;IAEjB,OAAO,KAAK,EAAE,KAAa,EAAE,EAAE;QAC7B,IAAI,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,aAAa,CAC3B,EAAE,GAAG,QAAQ,EACb,MAAM,GAAG,0BAA0B,EACnC,UAAiE;IAEjE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,YAAY;IAC1B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,kBAAkB,CAChC,YAAyC,EAAE;IAE3C,OAAO;QACL,UAAU,EAAE,EAAE;QACd,aAAa,EAAE,SAAS;QACxB,MAAM,EAAE,0BAA0B;QAClC,WAAW,EAAE,QAAQ;QACrB,aAAa,EAAE,MAAM;QACrB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAAC,GAAG,GAAG,6BAA6B;IACnE,OAAO,EAAE,GAAG,EAAE,CAAC;AACjB,CAAC"}

package/dist/esm/zoneClient.d.ts

@@ -0,0 +1,42 @@
+import { type ApplicationCredential, type ClientCredentialsRequest, type ImpersonateRequest, type TokenExchangeRequest, type TokenResponse } from "@keycardai/oauth";
+/**
+ * The zone operations a connection auth factory needs, as one seam.
+ *
+ * `@keycardai/oauth` splits acquisition across `TokenExchangeClient` and
+ * `ClientCredentialsClient`; this interface is the single injection point the
+ * contract calls for (`client`), and lets a test stand in for the zone with no
+ * network.
+ */
+export interface ZoneClient {
+    /** RFC 8693 exchange of a subject token for a resource token. */
+    exchangeToken(request: TokenExchangeRequest, options?: {
+        issuer?: string;
+    }): Promise<TokenResponse>;
+    /** Substitute-user exchange for a user the agent holds no token for. */
+    impersonate(request: ImpersonateRequest): Promise<TokenResponse>;
+    /** Client-credentials grant under the agent's own authority. */
+    clientCredentialsGrant(request?: ClientCredentialsRequest, options?: {
+        issuer?: string;
+    }): Promise<TokenResponse>;
+}
+/**
+ * The default `ZoneClient`: one warm `TokenExchangeClient` and one warm
+ * `ClientCredentialsClient` per factory.
+ *
+ * Both underlying clients cache authorization-server metadata after their
+ * first call, so discovery happens once per process rather than once per tool
+ * call. eve resolves connection auth on every step, which makes per-call
+ * client construction the thing to avoid here.
+ */
+export declare class KeycardZoneClient implements ZoneClient {
+    #private;
+    constructor(issuer: string, credential?: ApplicationCredential);
+    exchangeToken(request: TokenExchangeRequest, options?: {
+        issuer?: string;
+    }): Promise<TokenResponse>;
+    impersonate(request: ImpersonateRequest): Promise<TokenResponse>;
+    clientCredentialsGrant(request?: ClientCredentialsRequest, options?: {
+        issuer?: string;
+    }): Promise<TokenResponse>;
+}
+//# sourceMappingURL=zoneClient.d.ts.map

package/dist/esm/zoneClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zoneClient.d.ts","sourceRoot":"","sources":["../../src/zoneClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,iEAAiE;IACjE,aAAa,CACX,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1B,wEAAwE;IACxE,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACjE,gEAAgE;IAChE,sBAAsB,CACpB,OAAO,CAAC,EAAE,wBAAwB,EAClC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5B,OAAO,CAAC,aAAa,CAAC,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,qBAAa,iBAAkB,YAAW,UAAU;;gBAKtC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,qBAAqB;IAM9D,aAAa,CACX,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5B,OAAO,CAAC,aAAa,CAAC;IAIzB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC;IAIhE,sBAAsB,CACpB,OAAO,CAAC,EAAE,wBAAwB,EAClC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5B,OAAO,CAAC,aAAa,CAAC;CAK1B"}

package/dist/esm/zoneClient.js

@@ -0,0 +1,45 @@
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _KeycardZoneClient_issuer, _KeycardZoneClient_exchange, _KeycardZoneClient_clientCredentials;
+import { ClientCredentialsClient, TokenExchangeClient, } from "@keycardai/oauth";
+/**
+ * The default `ZoneClient`: one warm `TokenExchangeClient` and one warm
+ * `ClientCredentialsClient` per factory.
+ *
+ * Both underlying clients cache authorization-server metadata after their
+ * first call, so discovery happens once per process rather than once per tool
+ * call. eve resolves connection auth on every step, which makes per-call
+ * client construction the thing to avoid here.
+ */
+export class KeycardZoneClient {
+    constructor(issuer, credential) {
+        _KeycardZoneClient_issuer.set(this, void 0);
+        _KeycardZoneClient_exchange.set(this, void 0);
+        _KeycardZoneClient_clientCredentials.set(this, void 0);
+        __classPrivateFieldSet(this, _KeycardZoneClient_issuer, issuer, "f");
+        __classPrivateFieldSet(this, _KeycardZoneClient_exchange, new TokenExchangeClient(issuer, { credential }), "f");
+        __classPrivateFieldSet(this, _KeycardZoneClient_clientCredentials, new ClientCredentialsClient(issuer, { credential }), "f");
+    }
+    exchangeToken(request, options) {
+        return __classPrivateFieldGet(this, _KeycardZoneClient_exchange, "f").exchangeToken(request, { issuer: options?.issuer ?? __classPrivateFieldGet(this, _KeycardZoneClient_issuer, "f") });
+    }
+    impersonate(request) {
+        return __classPrivateFieldGet(this, _KeycardZoneClient_exchange, "f").impersonate(request);
+    }
+    clientCredentialsGrant(request, options) {
+        return __classPrivateFieldGet(this, _KeycardZoneClient_clientCredentials, "f").requestToken(request, {
+            issuer: options?.issuer ?? __classPrivateFieldGet(this, _KeycardZoneClient_issuer, "f"),
+        });
+    }
+}
+_KeycardZoneClient_issuer = new WeakMap(), _KeycardZoneClient_exchange = new WeakMap(), _KeycardZoneClient_clientCredentials = new WeakMap();
+//# sourceMappingURL=zoneClient.js.map

package/dist/esm/zoneClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zoneClient.js","sourceRoot":"","sources":["../../src/zoneClient.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EACL,uBAAuB,EACvB,mBAAmB,GAMpB,MAAM,kBAAkB,CAAC;AAyB1B;;;;;;;;GAQG;AACH,MAAM,OAAO,iBAAiB;IAK5B,YAAY,MAAc,EAAE,UAAkC;QAJ9D,4CAAgB;QAChB,8CAA+B;QAC/B,uDAA4C;QAG1C,uBAAA,IAAI,6BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,+BAAa,IAAI,mBAAmB,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,MAAA,CAAC;QACjE,uBAAA,IAAI,wCAAsB,IAAI,uBAAuB,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,MAAA,CAAC;IAChF,CAAC;IAED,aAAa,CACX,OAA6B,EAC7B,OAA6B;QAE7B,OAAO,uBAAA,IAAI,mCAAU,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,uBAAA,IAAI,iCAAQ,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,WAAW,CAAC,OAA2B;QACrC,OAAO,uBAAA,IAAI,mCAAU,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,sBAAsB,CACpB,OAAkC,EAClC,OAA6B;QAE7B,OAAO,uBAAA,IAAI,4CAAmB,CAAC,YAAY,CAAC,OAAO,EAAE;YACnD,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,uBAAA,IAAI,iCAAQ;SACxC,CAAC,CAAC;IACL,CAAC;CACF"}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@keycardai/eve",
+  "version": "0.1.0",
+  "description": "[Preview] Keycard auth adapters for eve agents: a zone token verifier for the channel auth walk, Keycard-backed connection auth, and interactive authorization over the zone's web flow",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/keycardai/typescript-sdk.git",
+    "directory": "packages/eve"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "import": "./dist/esm/index.js",
+      "types": "./dist/esm/index.d.ts"
+    },
+    "./testing": {
+      "import": "./dist/esm/testing/index.js",
+      "types": "./dist/esm/testing/index.d.ts"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "typesVersions": {
+    "*": {
+      "*": [
+        "./dist/esm/*"
+      ]
+    }
+  },
+  "dependencies": {
+    "@keycardai/oauth": "0.22.0"
+  },
+  "peerDependencies": {
+    "eve": ">=0.47.3 <0.48.0"
+  },
+  "devDependencies": {
+    "@jest/globals": "^30.0.4",
+    "@types/node": "^25.6.0",
+    "eve": "0.47.3",
+    "jest": "^30.0.4",
+    "ts-jest": "^29.4.7",
+    "typescript": "^5.8.3"
+  },
+  "scripts": {
+    "build": "pnpm run build:esm",
+    "build:esm": "tsc -p tsconfig.prod.json && echo '{\"type\": \"module\"}' > dist/esm/package.json",
+    "test": "NODE_OPTIONS='--experimental-vm-modules' jest",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist"
+  }
+}