@kya-os/mcp 1.4.0 → 1.6.0

package/dist/providers/web-crypto.js

@@ -0,0 +1,91 @@
+/**
+ * WebCrypto CryptoProvider
+ *
+ * Ed25519 crypto backed by the WebCrypto API (`globalThis.crypto.subtle`).
+ * Isomorphic — runs in Cloudflare Workers, Deno, modern browsers, and Node 20+
+ * — so an edge runtime (or the isomorphic `@kya-os/verifier`) can use the
+ * shared `ProofVerifier` without pulling in `node:crypto`.
+ *
+ * Mirrors {@link NodeCryptoProvider}'s key formats EXACTLY — raw 32-byte
+ * Ed25519 keys, base64-encoded; `sha256:<hex>` digests — so the two are
+ * drop-in interchangeable: a proof signed under one verifies under the other.
+ * (Cross-provider parity is asserted in the tests.)
+ *
+ * Requires a runtime whose WebCrypto implements the Ed25519 curve (Workers,
+ * Deno, Node 20+, recent browsers). Throws a clear error if `crypto.subtle`
+ * is unavailable rather than failing obscurely deep in a verify call.
+ *
+ * @example
+ * ```typescript
+ * import { WebCryptoProvider } from '@kya-os/mcp/providers';
+ * const verifier = new ProofVerifier({ cryptoProvider: new WebCryptoProvider(), ... });
+ * ```
+ */
+import { CryptoProvider } from "./base.js";
+import { base64ToBytes, bytesToBase64 } from "../utils/base64.js";
+const ALG = "Ed25519";
+/** PKCS8 DER header for Ed25519 private keys (16 bytes) — matches NodeCryptoProvider. */
+const ED25519_PKCS8_PREFIX = Uint8Array.from([
+    0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x04, 0x22, 0x04, 0x20,
+]);
+function getCrypto() {
+    // `crypto` is the WebCrypto global (Node 20+, Cloudflare Workers, Deno,
+    // browsers). Typed via the runtime's lib/@types — referenced bare (like
+    // authz/oidc/pkce.ts) so this file needs no DOM lib in tsconfig.
+    if (typeof crypto === "undefined" || !crypto.subtle) {
+        throw new Error("WebCryptoProvider: WebCrypto (crypto.subtle) is unavailable in this runtime");
+    }
+    return crypto;
+}
+function toHex(bytes) {
+    let out = "";
+    for (const b of bytes)
+        out += b.toString(16).padStart(2, "0");
+    return out;
+}
+export class WebCryptoProvider extends CryptoProvider {
+    async sign(data, privateKeyBase64) {
+        const raw = base64ToBytes(privateKeyBase64);
+        // Accept both raw 32-byte and full 64-byte Ed25519 keys (use the seed).
+        const seed = raw.length === 64 ? raw.subarray(0, 32) : raw;
+        const pkcs8 = new Uint8Array(ED25519_PKCS8_PREFIX.length + seed.length);
+        pkcs8.set(ED25519_PKCS8_PREFIX, 0);
+        pkcs8.set(seed, ED25519_PKCS8_PREFIX.length);
+        const key = await getCrypto().subtle.importKey("pkcs8", pkcs8, { name: ALG }, false, ["sign"]);
+        const sig = await getCrypto().subtle.sign({ name: ALG }, key, data);
+        return new Uint8Array(sig);
+    }
+    async verify(data, signature, publicKeyBase64) {
+        try {
+            const raw = base64ToBytes(publicKeyBase64);
+            const key = await getCrypto().subtle.importKey("raw", raw, { name: ALG }, false, ["verify"]);
+            return await getCrypto().subtle.verify({ name: ALG }, key, signature, data);
+        }
+        catch {
+            // Never throw on a bad key/signature — verification simply fails.
+            return false;
+        }
+    }
+    async generateKeyPair() {
+        const kp = await getCrypto().subtle.generateKey({ name: ALG }, true, ["sign", "verify"]);
+        // generateKey returns CryptoKey | CryptoKeyPair; narrow to the pair without
+        // naming the DOM type (this file compiles without a DOM lib — see getCrypto).
+        if (!("publicKey" in kp)) {
+            throw new Error("WebCryptoProvider: expected an Ed25519 key pair from generateKey");
+        }
+        const rawPub = new Uint8Array(await getCrypto().subtle.exportKey("raw", kp.publicKey));
+        const pkcs8 = new Uint8Array(await getCrypto().subtle.exportKey("pkcs8", kp.privateKey));
+        // Strip the 16-byte PKCS8 prefix to recover the raw 32-byte seed (mirrors
+        // NodeCryptoProvider, which slices [16,48) of the DER).
+        const seed = pkcs8.subarray(ED25519_PKCS8_PREFIX.length, ED25519_PKCS8_PREFIX.length + 32);
+        return { privateKey: bytesToBase64(seed), publicKey: bytesToBase64(rawPub) };
+    }
+    async hash(data) {
+        const digest = new Uint8Array(await getCrypto().subtle.digest("SHA-256", data));
+        return `sha256:${toHex(digest)}`;
+    }
+    async randomBytes(length) {
+        return getCrypto().getRandomValues(new Uint8Array(length));
+    }
+}
+//# sourceMappingURL=web-crypto.js.map

package/dist/providers/web-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-crypto.js","sourceRoot":"","sources":["../../src/providers/web-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElE,MAAM,GAAG,GAAG,SAAkB,CAAC;AAE/B,yFAAyF;AACzF,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,CAAC;IAC3C,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CAC/F,CAAC,CAAC;AAEH,SAAS,SAAS;IAChB,wEAAwE;IACxE,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,iBAAkB,SAAQ,cAAc;IACnD,KAAK,CAAC,IAAI,CAAC,IAAgB,EAAE,gBAAwB;QACnD,MAAM,GAAG,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC5C,wEAAwE;QACxE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,oBAAoB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACxE,KAAK,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;QACnC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/F,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACpE,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAAgB,EAChB,SAAqB,EACrB,eAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7F,OAAO,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzF,4EAA4E;QAC5E,8EAA8E;QAC9E,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACzF,0EAA0E;QAC1E,wDAAwD;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAC3F,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QAChF,OAAO,UAAU,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,SAAS,EAAE,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/mcp",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "description": "Reference implementation of the KYA-OS protocol for Model Context Protocol servers: delegation, proof, and session primitives",
   "license": "MIT",
   "type": "module",
@@ -43,6 +43,14 @@
       "types": "./dist/middleware/index.d.ts",
       "default": "./dist/middleware/index.js"
     },
+    "./policy": {
+      "types": "./dist/policy/index.d.ts",
+      "default": "./dist/policy/index.js"
+    },
+    "./authz": {
+      "types": "./dist/authz/index.d.ts",
+      "default": "./dist/authz/index.js"
+    },
     "./schemas/*.json": "./schemas/*.json",
     "./package.json": "./package.json"
   },
@@ -66,7 +74,11 @@
     "example:server": "npx tsx examples/node-server/server.ts",
     "example:inspector": "npx @modelcontextprotocol/inspector npx tsx examples/node-server/server.ts --stdio",
     "example:verify-proof": "npx tsx examples/verify-proof/verify.ts",
-    "example:anti-mitm": "npx tsx examples/verify-proof/anti-mitm-demo.ts"
+    "example:anti-mitm": "npx tsx examples/verify-proof/anti-mitm-demo.ts",
+    "example:authz-inspector": "npx @modelcontextprotocol/inspector npx tsx examples/authz-inspector/src/stdio.ts",
+    "example:authz-inspector:http": "npx tsx examples/authz-inspector/src/inspector-http.ts",
+    "example:authz-inspector:http:server": "npx tsx examples/authz-inspector/src/http.ts",
+    "example:authz-inspector:stdio:server": "npx tsx examples/authz-inspector/src/stdio.ts"
   },
   "dependencies": {
     "jose": "^5.6.3",