@mcp-i/core 0.1.0

package/dist/index.js

@@ -0,0 +1,53 @@
+/**
+ * @mcp-i/core — MCP-I Protocol Reference Implementation
+ *
+ * Delegation, proof, and session for Model Context Protocol Identity.
+ * This package is a DIF TAAWG protocol reference implementation.
+ *
+ * Related Spec: https://modelcontextprotocol-identity.io
+ *
+ * ## Error handling strategy
+ *
+ * - **Validation functions** (`verify*`, `validate*`) return result objects `{ valid, reason }` — never throw
+ * - **Construction/setup functions** throw `Error` on invalid configuration
+ * - **Resolution functions** (`resolve*`, `fetch*`) return `null` on failure — never throw
+ *
+ * This ensures callers can always handle failures without try/catch on validation paths.
+ */
+export { wrapDelegationAsVC, extractDelegationFromVC, isDelegationCredentialExpired, isDelegationCredentialNotYetValid, validateDelegationCredential, validateDetachedProof, createNeedsAuthorizationError, isNeedsAuthorizationError, DELEGATION_CREDENTIAL_CONTEXT, DEFAULT_SESSION_TTL_MINUTES, DEFAULT_TIMESTAMP_SKEW_SECONDS, NONCE_LENGTH_BYTES, } from './types/protocol.js';
+// Delegation module
+export { DelegationCredentialIssuer, createDelegationIssuer, } from './delegation/vc-issuer.js';
+export { DelegationCredentialVerifier, createDelegationVerifier, } from './delegation/vc-verifier.js';
+export { DelegationGraphManager, createDelegationGraph, } from './delegation/delegation-graph.js';
+export { StatusList2021Manager, createStatusListManager, } from './delegation/statuslist-manager.js';
+export { CascadingRevocationManager, createCascadingRevocationManager, } from './delegation/cascading-revocation.js';
+export { BitstringManager, isIndexSet, } from './delegation/bitstring.js';
+export { verifyDelegationAudience, } from './delegation/audience-validator.js';
+export { buildDelegationProofJWT, buildChainString, } from './delegation/outbound-proof.js';
+export { buildOutboundDelegationHeaders, OUTBOUND_HEADER_NAMES, } from './delegation/outbound-headers.js';
+export { canonicalizeJSON, createUnsignedVCJWT, completeVCJWT, parseVCJWT, } from './delegation/utils.js';
+export { MemoryStatusListStorage } from './delegation/storage/memory-statuslist-storage.js';
+export { MemoryDelegationGraphStorage } from './delegation/storage/memory-graph-storage.js';
+export { createDidKeyResolver, resolveDidKeySync, isEd25519DidKey, extractPublicKeyFromDidKey, publicKeyToJwk, } from './delegation/did-key-resolver.js';
+export { DidWebResolver, createDidWebResolver, isDidWeb, parseDidWeb, didWebToUrl, } from './delegation/did-web-resolver.js';
+// Utils
+export { base58Encode, base58Decode, isValidBase58, } from './utils/base58.js';
+export { isValidDid, getDidMethod, normalizeDid, compareDids, getServerDid, extractAgentId, extractAgentSlug, generateDidKeyFromBytes, generateDidKeyFromBase64, } from './utils/did-helpers.js';
+// Auth module
+export { verifyOrHints, hasSensitiveScopes, MemoryResumeTokenStore, } from './auth/index.js';
+// Proof module
+export { ProofGenerator, createProofResponse, extractCanonicalData, } from './proof/index.js';
+export { ProofVerifier, } from './proof/verifier.js';
+export { ProofVerificationError, PROOF_VERIFICATION_ERROR_CODES, createProofVerificationError, } from './proof/errors.js';
+// Session module
+export { SessionManager, createHandshakeRequest, validateHandshakeFormat, } from './session/index.js';
+// Providers
+export { CryptoProvider, ClockProvider, FetchProvider, StorageProvider, NonceCacheProvider, IdentityProvider, } from './providers/base.js';
+export { MemoryStorageProvider, MemoryNonceCacheProvider, MemoryIdentityProvider, } from './providers/memory.js';
+// Middleware
+export { createMCPIMiddleware, } from './middleware/index.js';
+// Logging
+export { logger, createDefaultConsoleLogger, } from './logging/index.js';
+// Ed25519 Constants
+export { ED25519_PKCS8_DER_HEADER, ED25519_SPKI_DER_HEADER_LENGTH, ED25519_KEY_SIZE, } from './utils/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA6BH,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAE7B,oBAAoB;AACpB,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GAIvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,GAQzB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GAGtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GAGxB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GAIjC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,gBAAgB,EAChB,UAAU,GAGX,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,wBAAwB,GACzB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GAGjB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,GAGtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,UAAU,GAGX,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAE5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAE5F,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,GACZ,MAAM,kCAAkC,CAAC;AAE1C,QAAQ;AACR,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAEhC,cAAc;AACd,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,GAOvB,MAAM,iBAAiB,CAAC;AAEzB,eAAe;AACf,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,GAKrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,GAGd,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,GAE7B,MAAM,mBAAmB,CAAC;AAE3B,iBAAiB;AACjB,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,GAGxB,MAAM,oBAAoB,CAAC;AAE5B,YAAY;AACZ,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,aAAa;AACb,OAAO,EACL,oBAAoB,GAQrB,MAAM,uBAAuB,CAAC;AAE/B,UAAU;AACV,OAAO,EACL,MAAM,EACN,0BAA0B,GAG3B,MAAM,oBAAoB,CAAC;AAE5B,oBAAoB;AACpB,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}

package/dist/logging/index.d.ts

@@ -0,0 +1,2 @@
+export { logger, createDefaultConsoleLogger, type Logger, type Level, } from './logger.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/logging/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/logging/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,0BAA0B,EAC1B,KAAK,MAAM,EACX,KAAK,KAAK,GACX,MAAM,aAAa,CAAC"}

package/dist/logging/index.js

@@ -0,0 +1,2 @@
+export { logger, createDefaultConsoleLogger, } from './logger.js';
+//# sourceMappingURL=index.js.map

package/dist/logging/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/logging/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,0BAA0B,GAG3B,MAAM,aAAa,CAAC"}

package/dist/logging/logger.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Transport-aware Logger for MCP-I
+ *
+ * Provides a lightweight, dependency-free logging interface that:
+ * - Maps log levels correctly for Cloudflare Workers
+ * - Routes all logs to stderr for stdio transport (so stdout remains protocol-only)
+ * - Supports runtime configuration of log level and transport mode
+ */
+export type Level = 'debug' | 'info' | 'warn' | 'error';
+export interface Logger {
+    configure: (opts?: {
+        level?: Level;
+        transport?: string;
+        forceStderr?: boolean;
+    }) => void;
+    debug: (...args: unknown[]) => void;
+    info: (...args: unknown[]) => void;
+    warn: (...args: unknown[]) => void;
+    error: (...args: unknown[]) => void;
+}
+export declare function createDefaultConsoleLogger(): Logger;
+export declare const logger: Logger;
+//# sourceMappingURL=logger.d.ts.map

package/dist/logging/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/logging/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AASxD,MAAM,WAAW,MAAM;IACrB,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,KAAK,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;IACzF,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACpC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACnC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACnC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACrC;AAED,wBAAgB,0BAA0B,IAAI,MAAM,CA8DnD;AAED,eAAO,MAAM,MAAM,QAA+B,CAAC"}

package/dist/logging/logger.js

@@ -0,0 +1,82 @@
+/**
+ * Transport-aware Logger for MCP-I
+ *
+ * Provides a lightweight, dependency-free logging interface that:
+ * - Maps log levels correctly for Cloudflare Workers
+ * - Routes all logs to stderr for stdio transport (so stdout remains protocol-only)
+ * - Supports runtime configuration of log level and transport mode
+ */
+const SEVERITY = {
+    debug: 10,
+    info: 20,
+    warn: 30,
+    error: 40,
+};
+export function createDefaultConsoleLogger() {
+    let level = 'info';
+    let forceStderr = false;
+    function shouldLog(l) {
+        return SEVERITY[l] >= SEVERITY[level];
+    }
+    function write(l, ...args) {
+        if (!shouldLog(l))
+            return;
+        if (forceStderr) {
+            console.error(...args);
+            return;
+        }
+        switch (l) {
+            case 'debug':
+                if (typeof console.debug === 'function') {
+                    console.debug(...args);
+                }
+                else {
+                    console.log(...args);
+                }
+                break;
+            case 'info':
+                if (typeof console.info === 'function') {
+                    console.info(...args);
+                }
+                else {
+                    console.log(...args);
+                }
+                break;
+            case 'warn':
+                if (typeof console.warn === 'function') {
+                    console.warn(...args);
+                }
+                else {
+                    console.error(...args);
+                }
+                break;
+            case 'error':
+                console.error(...args);
+                break;
+        }
+    }
+    return {
+        configure(opts = {}) {
+            if (opts.level)
+                level = opts.level;
+            if (opts.forceStderr === true) {
+                forceStderr = true;
+            }
+            else if (opts.forceStderr === false) {
+                forceStderr = false;
+            }
+            else if (opts.transport === 'stdio') {
+                forceStderr = true;
+            }
+            else if (opts.transport === 'sse' || opts.transport === 'http') {
+                forceStderr = false;
+            }
+        },
+        debug: (...a) => write('debug', ...a),
+        info: (...a) => write('info', ...a),
+        warn: (...a) => write('warn', ...a),
+        error: (...a) => write('error', ...a),
+    };
+}
+export const logger = createDefaultConsoleLogger();
+//# sourceMappingURL=logger.js.map

package/dist/logging/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/logging/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,MAAM,QAAQ,GAA0B;IACtC,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,EAAE;IACR,IAAI,EAAE,EAAE;IACR,KAAK,EAAE,EAAE;CACV,CAAC;AAUF,MAAM,UAAU,0BAA0B;IACxC,IAAI,KAAK,GAAU,MAAM,CAAC;IAC1B,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,SAAS,SAAS,CAAC,CAAQ;QACzB,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,SAAS,KAAK,CAAC,CAAQ,EAAE,GAAG,IAAe;QACzC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAAE,OAAO;QAE1B,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,EAAE,CAAC;YACV,KAAK,OAAO;gBACV,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;oBACxC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;gBACvB,CAAC;gBACD,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBACvC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;gBACxB,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;gBACvB,CAAC;gBACD,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBACvC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;gBACxB,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;gBACzB,CAAC;gBACD,MAAM;YACR,KAAK,OAAO;gBACV,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;gBACvB,MAAM;QACV,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS,CAAC,IAAI,GAAG,EAAE;YACjB,IAAI,IAAI,CAAC,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACnC,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;gBAC9B,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;iBAAM,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;gBACtC,WAAW,GAAG,KAAK,CAAC;YACtB,CAAC;iBAAM,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBACtC,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;iBAAM,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;gBACjE,WAAW,GAAG,KAAK,CAAC;YACtB,CAAC;QACH,CAAC;QACD,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACnC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,0BAA0B,EAAE,CAAC"}

package/dist/middleware/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * MCP-I Middleware
+ *
+ * Provides identity-aware middleware for @modelcontextprotocol/sdk Server.
+ */
+export { createMCPIMiddleware, type MCPIConfig, type MCPIDelegationConfig, type MCPIIdentityConfig, type MCPIMiddleware, type MCPIToolDefinition, type MCPIToolHandler, type MCPIServer, } from './with-mcpi.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,oBAAoB,EACpB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,UAAU,GAChB,MAAM,gBAAgB,CAAC"}

package/dist/middleware/index.js

@@ -0,0 +1,7 @@
+/**
+ * MCP-I Middleware
+ *
+ * Provides identity-aware middleware for @modelcontextprotocol/sdk Server.
+ */
+export { createMCPIMiddleware, } from './with-mcpi.js';
+//# sourceMappingURL=index.js.map

package/dist/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,oBAAoB,GAQrB,MAAM,gBAAgB,CAAC"}

package/dist/middleware/with-mcpi.d.ts

@@ -0,0 +1,152 @@
+/**
+ * MCP-I Middleware for @modelcontextprotocol/sdk Server
+ *
+ * Adds identity, session management, and proof generation to a standard
+ * MCP SDK Server.
+ *
+ * Usage:
+ *   const { handshakeTool, registerToolWithProof } = createMCPIMiddleware(config, crypto);
+ *   server.setRequestHandler(ListToolsRequestSchema, () => ({ tools: [handshakeTool, ...] }));
+ *   registerToolWithProof(server, myToolDef, myHandler);
+ */
+import { type CryptoProvider, FetchProvider } from "../providers/base.js";
+import { SessionManager, type SessionConfig } from "../session/manager.js";
+import { ProofGenerator } from "../proof/generator.js";
+import { type DIDResolver, type StatusListResolver } from "../delegation/vc-verifier.js";
+import { type DelegationCredential } from "../types/protocol.js";
+export interface MCPIIdentityConfig {
+    did: string;
+    kid: string;
+    privateKey: string;
+    publicKey: string;
+}
+export interface MCPIDelegationConfig {
+    /**
+     * Optional custom DID resolver. If it returns null, middleware falls back to
+     * built-in did:key resolution and fetch-backed did:web resolution.
+     */
+    didResolver?: DIDResolver;
+    /**
+     * Optional fetch provider used for did:web resolution.
+     * If omitted, middleware falls back to the runtime global fetch when available.
+     */
+    fetchProvider?: FetchProvider;
+    /**
+     * Resolver for StatusList2021 checks. Credentials with credentialStatus are
+     * rejected when no resolver is configured.
+     */
+    statusListResolver?: StatusListResolver;
+    /**
+     * Resolve ancestor credentials for a delegated chain. The returned array may
+     * contain only ancestors (root -> parent) or the full chain (root -> leaf).
+     */
+    resolveDelegationChain?: (leafCredential: DelegationCredential) => Promise<DelegationCredential[]>;
+    /**
+     * Compatibility mode for legacy integrations that cannot yet provide
+     * full delegation-chain and status-list resolvers.
+     *
+     * WARNING: Enabling this weakens verification guarantees:
+     * - Parent-linked delegations are accepted without chain resolution
+     * - credentialStatus is accepted without StatusList checks
+     *
+     * Default is false (strict security behavior).
+     */
+    allowLegacyUnsafeDelegation?: boolean;
+}
+export interface MCPIConfig {
+    /** Agent identity (DID + key material) */
+    identity: MCPIIdentityConfig;
+    /** Session configuration overrides */
+    session?: Omit<SessionConfig, "nonceCache">;
+    /** Delegation verification overrides */
+    delegation?: MCPIDelegationConfig;
+    /**
+     * When true, automatically creates a session on the first tool call
+     * if no session exists. Useful for demos and development where
+     * MCP clients don't support the _mcpi_handshake flow.
+     * In production, MCP-I-aware clients handle handshake automatically.
+     */
+    autoSession?: boolean;
+}
+export interface MCPIToolDefinition {
+    name: string;
+    description?: string;
+    inputSchema: {
+        type: "object";
+        properties?: Record<string, unknown>;
+        required?: string[];
+        [key: string]: unknown;
+    };
+}
+export interface MCPIToolHandler {
+    (args: Record<string, unknown>, sessionId?: string): Promise<{
+        content: Array<{
+            type: string;
+            text: string;
+            [key: string]: unknown;
+        }>;
+        isError?: boolean;
+        [key: string]: unknown;
+    }>;
+}
+/**
+ * Server interface — minimal subset of @modelcontextprotocol/sdk Server.
+ * This avoids a hard dependency on the SDK at the type level.
+ */
+export interface MCPIServer {
+    setRequestHandler(schema: unknown, handler: (...args: unknown[]) => unknown): void;
+}
+export interface MCPIMiddleware {
+    /** The SessionManager instance for manual session operations */
+    sessionManager: SessionManager;
+    /** The ProofGenerator instance for manual proof operations */
+    proofGenerator: ProofGenerator;
+    /**
+     * Tool definition for `_mcpi_handshake`.
+     * Include this in your ListToolsRequest handler's tool list.
+     */
+    handshakeTool: MCPIToolDefinition;
+    /**
+     * Handle a handshake call. Use this in your CallToolRequest handler
+     * when `request.params.name === '_mcpi_handshake'`.
+     */
+    handleHandshake(args: Record<string, unknown>): Promise<{
+        content: Array<{
+            type: string;
+            text: string;
+        }>;
+        isError?: boolean;
+    }>;
+    /**
+     * Wrap a tool handler to automatically generate proofs.
+     * Returns a new handler that appends proof metadata to the response.
+     */
+    wrapWithProof(toolName: string, handler: MCPIToolHandler): MCPIToolHandler;
+    /**
+     * Wrap a tool handler to require a valid W3C Delegation Credential.
+     *
+     * Caller must pass the VC as `_mcpi_delegation` in the tool args.
+     * - If absent: returns a `needs_authorization` response with the consentUrl.
+     * - If present but invalid: returns a structured error with reason.
+     * - If valid with correct scope: strips `_mcpi_delegation` and calls the handler.
+     */
+    wrapWithDelegation(toolName: string, config: {
+        scopeId: string;
+        consentUrl: string;
+    }, handler: MCPIToolHandler): MCPIToolHandler;
+}
+/**
+ * Create MCP-I middleware for a standard MCP SDK Server.
+ *
+ * @param config - Agent identity and session configuration
+ * @param cryptoProvider - Platform-specific crypto implementation
+ * @returns Middleware components for session management and proof generation
+ *
+ * @remarks
+ * **Single-process only**: This middleware stores session state in memory using closure
+ * variables (`activeSessionId`, `sessionNonces`). It is NOT suitable for multi-instance
+ * deployments behind a load balancer. For distributed deployments, implement a custom
+ * `SessionStore` backed by Redis, DynamoDB, or similar and pass it via `config.session`.
+ */
+export declare function createMCPIMiddleware(config: MCPIConfig, cryptoProvider: CryptoProvider): MCPIMiddleware;
+//# sourceMappingURL=with-mcpi.d.ts.map

package/dist/middleware/with-mcpi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-mcpi.d.ts","sourceRoot":"","sources":["../../src/middleware/with-mcpi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,KAAK,cAAc,EACnB,aAAa,EACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,cAAc,EACd,KAAK,aAAa,EAEnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,cAAc,EAIf,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAEL,KAAK,WAAW,EAEhB,KAAK,kBAAkB,EACxB,MAAM,8BAA8B,CAAC;AAItC,OAAO,EAGL,KAAK,oBAAoB,EAE1B,MAAM,sBAAsB,CAAC;AAK9B,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CACvB,cAAc,EAAE,oBAAoB,KACjC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACrC;;;;;;;;;OASG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC;AAED,MAAM,WAAW,UAAU;IACzB,0CAA0C;IAC1C,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,sCAAsC;IACtC,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC5C,wCAAwC;IACxC,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,CACE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC;QACT,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC,CAAC;QACvE,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC,CAAC;CACJ;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,iBAAiB,CACf,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,GACvC,IAAI,CAAC;CACT;AAED,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,cAAc,EAAE,cAAc,CAAC;IAE/B,8DAA8D;IAC9D,cAAc,EAAE,cAAc,CAAC;IAE/B;;;OAGG;IACH,aAAa,EAAE,kBAAkB,CAAC;IAElC;;;OAGG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;IAEH;;;OAGG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,eAAe,CAAC;IAE3E;;;;;;;OAOG;IACH,kBAAkB,CAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;QACN,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;KACpB,EACD,OAAO,EAAE,eAAe,GACvB,eAAe,CAAC;CACpB;AAqED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,UAAU,EAClB,cAAc,EAAE,cAAc,GAC7B,cAAc,CAifhB"}