@oobe-protocol-labs/sap-mcp-server 0.1.0

package/dist/prompts/registry/register-sap-agent.prompt.js

@@ -0,0 +1,152 @@
+/**
+ * Register SAP Agent Prompt
+ *
+ * Guides users through SAP agent registration process.
+ * REAL IMPLEMENTATION — Step-by-step wizard
+ */
+import { registerPrompt } from '../../adapters/mcp/sdk-compat.js';
+import { logger } from '../../core/logger.js';
+/**
+ * Executes the register sap agent prompt operation.
+ */
+export function registerSapAgentPrompt(server, _context) {
+    registerPrompt(server, 'register-sap-agent', {}, {
+        description: 'Step-by-step guide to register as SAP agent on Solana blockchain',
+        arguments: [
+            {
+                name: 'agentType',
+                description: 'Type of agent: "citizen", "merchant", "hybrid" (default: "citizen")',
+                required: false,
+            },
+            {
+                name: 'network',
+                description: 'Solana network: "mainnet", "devnet", "testnet" (default: "devnet")',
+                required: false,
+            },
+            {
+                name: 'includeSNS',
+                description: 'Register SNS domain: "yes", "no" (default: "no")',
+                required: false,
+            },
+        ],
+    }, async (args) => {
+        const agentType = args.agentType || 'citizen';
+        const network = args.network || 'devnet';
+        const includeSNS = args.includeSNS === 'yes';
+        logger.info('Registering SAP agent', { agentType, network, includeSNS });
+        const rpcUrl = network === 'mainnet'
+            ? 'https://api.mainnet-beta.solana.com'
+            : network === 'testnet'
+                ? 'https://api.testnet.solana.com'
+                : 'https://api.devnet.solana.com';
+        const content = [
+            '# SAP Agent Registration Guide',
+            '',
+            '## Configuration',
+            '',
+            '- **Agent Type**: ' + agentType,
+            '- **Network**: ' + network + ' (`' + rpcUrl + '`)',
+            '- **SNS Domain**: ' + (includeSNS ? 'Yes (optional)' : 'No'),
+            '',
+            '## ⚡ Quick Start: Check Your Config',
+            '',
+            'Before registering, verify your agent identity:',
+            '',
+            '```bash',
+            '# Check public agent identity only',
+            'npx sap-mcp-config pubkey',
+            '```',
+            '',
+            'Your **agentPubkey** is automatically extracted from your wallet and saved in config.',
+            'This is the public key that will be registered on-chain. Never read or print keypair JSON bytes.',
+            '',
+            '## Prerequisites',
+            '',
+            '1. **Solana Wallet** with SOL for fees',
+            '2. **MCP Server** configured (run `npx sap-mcp-config wizard`)',
+            '3. **Dedicated signer** configured by the SAP MCP profile',
+            '4. **Agent Pubkey** visible in config (`agentPubkey` field)',
+            '',
+            '## Step 1: Configure MCP Server',
+            '',
+            '```bash',
+            '# Run interactive wizard (auto-extracts agentPubkey)',
+            'npx sap-mcp-config wizard',
+            '',
+            '# Select mode:',
+            '#   - local-dev-keypair (development)',
+            '#   - delegated-session (production)',
+            '#   - external-signer (Ledger/Fireblocks)',
+            '#   - hosted-api (remote HTTP)',
+            '```',
+            '',
+            'After wizard completes, you\'ll see:',
+            '```',
+            '✓ Configuration saved to ~/.config/mcp-sap/config-gianni-market-nft-agent.json',
+            '✓ Dedicated signer configured for profile gianni-market-nft-agent',
+            '',
+            '  Agent Public Key: 8xKjPqN9vM2wR5tL3hF6yQ4sD7cB1aE9uY0pZ2iO3mX4',
+            '  Save this pubkey for your agent registration!',
+            '```',
+            '',
+            '## Step 2: Fund Wallet',
+            '',
+            '```bash',
+            '# Check balance',
+            'solana balance --url ' + rpcUrl + '',
+            '',
+            '# Request airdrop (devnet only)',
+            'solana airdrop 1 --url ' + rpcUrl + '',
+            '```',
+            '',
+            '## Step 3: Register Agent On-Chain',
+            '',
+            'Use the MCP tool `sap_register_agent`. The SAP MCP server will sign with the configured profile signer internally.',
+            '',
+            'Do **not** read `SAP_WALLET_PATH`, do **not** open keypair JSON files, and do **not** print private key bytes.',
+            '',
+            'Tool input:',
+            '```json',
+            '{',
+            '  "name": "My SAP Agent",',
+            '  "description": "AI agent with SAP Protocol integration",',
+            '  "capabilities": [',
+            '    { "id": "identity:read", "description": null, "protocolId": "sap", "version": "1.0" },',
+            '    { "id": "memory:write", "description": null, "protocolId": "sap", "version": "1.0" }',
+            '  ],',
+            '  "pricing": [],',
+            '  "protocols": ["sap"],',
+            '  "agentId": "' + agentType + '-agent",',
+            '  "agentUri": "https://my-agent.example.com/agent.json",',
+            '  "x402Endpoint": "https://my-agent.example.com/x402"',
+            '}',
+            '```',
+            '',
+            '## Step 4: Verify Registration',
+            '',
+            '```bash',
+            '# Fetch agent PDA',
+            'solana account <AGENT_PDA> --url ' + rpcUrl + ' --output json',
+            '',
+            '# Or use resource endpoint',
+            'curl sap://registry/agent/<YOUR_WALLET>',
+            '```',
+            '',
+        ];
+        if (includeSNS) {
+            content.push('## Step 5 (Optional): Register SNS Domain', '', 'Use `sap_sns_check_domain` to verify availability, then `sap_sns_build_register_domain_transaction` for unsigned registration or `sap_sns_register_agent_domain` when the MCP profile is in `local-dev-keypair` mode.', '');
+        }
+        content.push('## Step 6: Test Agent', '', '```bash', '# Start MCP server', 'npx sap-mcp-server', '', '# In Claude Desktop or MCP client:', '# "Register me as SAP agent"', '# "Show my agent capabilities"', '# "Execute tool: swap SOL to USDC"', '```', '', '## Registration Fees', '', '| Network | Agent Registration | SNS Domain | Total |', '|---------|-------------------|------------|-------|', '| Devnet | ~0.001 SOL (test) | ~0.001 SOL | ~0.002 SOL |', '| Testnet | ~0.001 SOL (test) | ~0.001 SOL | ~0.002 SOL |', '| Mainnet | ~0.01 SOL | ~0.1 SOL | ~0.11 SOL |', '', '## Post-Registration', '', 'After registration:', '', '1. ✅ **Agent PDA** created on-chain', '2. ✅ **Capabilities** registered', '3. ✅ **Memory vault** initialized', '4. ✅ **Reputation tracking** enabled', '5. ⏳ **Build reputation** by executing tools successfully', '', '## Troubleshooting', '', '### "Insufficient funds"', '- Request airdrop (devnet): `solana airdrop 1`', '- Fund wallet with SOL (mainnet)', '', '### "Agent already registered"', '- Each wallet can register ONE agent', '- Close existing agent first: `agent_close` instruction', '', '### "Invalid capabilities"', '- Use valid capability strings', '- Check SAP SDK documentation', '', '## Resources', '', '- SAP SDK: https://github.com/OOBE-PROTOCOL/synapse-sap-sdk', '- Documentation: https://oobeprotocol.ai/docs', '- Discord: https://discord.gg/oobeprotocol');
+        return {
+            messages: [{
+                    role: 'assistant',
+                    content: {
+                        type: 'text',
+                        text: content.join('\n'),
+                    },
+                }],
+        };
+    });
+    logger.info('Register SAP Agent prompt registered');
+}
+//# sourceMappingURL=register-sap-agent.prompt.js.map

package/dist/prompts/registry/register-sap-agent.prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-sap-agent.prompt.js","sourceRoot":"","sources":["../../../src/prompts/registry/register-sap-agent.prompt.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAG9C;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,QAAuB;IAC5E,cAAc,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,EAAE;QAC/C,WAAW,EAAE,kEAAkE;QAC/E,SAAS,EAAE;YACT;gBACE,IAAI,EAAE,WAAW;gBACjB,WAAW,EAAE,qEAAqE;gBAClF,QAAQ,EAAE,KAAK;aAChB;YACD;gBACE,IAAI,EAAE,SAAS;gBACf,WAAW,EAAE,oEAAoE;gBACjF,QAAQ,EAAE,KAAK;aAChB;YACD;gBACE,IAAI,EAAE,YAAY;gBAClB,WAAW,EAAE,kDAAkD;gBAC/D,QAAQ,EAAE,KAAK;aAChB;SACF;KACF,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAChB,MAAM,SAAS,GAAI,IAAI,CAAC,SAAoB,IAAI,SAAS,CAAC;QAC1D,MAAM,OAAO,GAAI,IAAI,CAAC,OAAkB,IAAI,QAAQ,CAAC;QACrD,MAAM,UAAU,GAAI,IAAI,CAAC,UAAqB,KAAK,KAAK,CAAC;QAEzD,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QAEzE,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS;YAClC,CAAC,CAAC,qCAAqC;YACvC,CAAC,CAAC,OAAO,KAAK,SAAS;gBACvB,CAAC,CAAC,gCAAgC;gBAClC,CAAC,CAAC,+BAA+B,CAAC;QAEpC,MAAM,OAAO,GAAG;YACd,gCAAgC;YAChC,EAAE;YACF,kBAAkB;YAClB,EAAE;YACF,oBAAoB,GAAG,SAAS;YAChC,iBAAiB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,IAAI;YACnD,oBAAoB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,EAAE;YACF,qCAAqC;YACrC,EAAE;YACF,iDAAiD;YACjD,EAAE;YACF,SAAS;YACT,oCAAoC;YACpC,2BAA2B;YAC3B,KAAK;YACL,EAAE;YACF,uFAAuF;YACvF,kGAAkG;YAClG,EAAE;YACF,kBAAkB;YAClB,EAAE;YACF,wCAAwC;YACxC,gEAAgE;YAChE,2DAA2D;YAC3D,6DAA6D;YAC7D,EAAE;YACF,iCAAiC;YACjC,EAAE;YACF,SAAS;YACT,sDAAsD;YACtD,2BAA2B;YAC3B,EAAE;YACF,gBAAgB;YAChB,uCAAuC;YACvC,sCAAsC;YACtC,2CAA2C;YAC3C,gCAAgC;YAChC,KAAK;YACL,EAAE;YACF,sCAAsC;YACtC,KAAK;YACL,gFAAgF;YAChF,mEAAmE;YACnE,EAAE;YACF,kEAAkE;YAClE,iDAAiD;YACjD,KAAK;YACL,EAAE;YACF,wBAAwB;YACxB,EAAE;YACF,SAAS;YACT,iBAAiB;YACjB,uBAAuB,GAAG,MAAM,GAAG,EAAE;YACrC,EAAE;YACF,iCAAiC;YACjC,yBAAyB,GAAG,MAAM,GAAG,EAAE;YACvC,KAAK;YACL,EAAE;YACF,oCAAoC;YACpC,EAAE;YACF,oHAAoH;YACpH,EAAE;YACF,gHAAgH;YAChH,EAAE;YACF,aAAa;YACb,SAAS;YACT,GAAG;YACH,2BAA2B;YAC3B,4DAA4D;YAC5D,qBAAqB;YACrB,4FAA4F;YAC5F,0FAA0F;YAC1F,MAAM;YACN,kBAAkB;YAClB,yBAAyB;YACzB,gBAAgB,GAAG,SAAS,GAAG,UAAU;YACzC,0DAA0D;YAC1D,uDAAuD;YACvD,GAAG;YACH,KAAK;YACL,EAAE;YACF,gCAAgC;YAChC,EAAE;YACF,SAAS;YACT,mBAAmB;YACnB,mCAAmC,GAAG,MAAM,GAAG,gBAAgB;YAC/D,EAAE;YACF,4BAA4B;YAC5B,yCAAyC;YACzC,KAAK;YACL,EAAE;SACH,CAAC;QAEF,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CACV,2CAA2C,EAC3C,EAAE,EACF,uNAAuN,EACvN,EAAE,CACH,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,IAAI,CACV,uBAAuB,EACvB,EAAE,EACF,SAAS,EACT,oBAAoB,EACpB,oBAAoB,EACpB,EAAE,EACF,oCAAoC,EACpC,8BAA8B,EAC9B,gCAAgC,EAChC,oCAAoC,EACpC,KAAK,EACL,EAAE,EACF,sBAAsB,EACtB,EAAE,EACF,uDAAuD,EACvD,sDAAsD,EACtD,0DAA0D,EAC1D,2DAA2D,EAC3D,gDAAgD,EAChD,EAAE,EACF,sBAAsB,EACtB,EAAE,EACF,qBAAqB,EACrB,EAAE,EACF,qCAAqC,EACrC,kCAAkC,EAClC,mCAAmC,EACnC,sCAAsC,EACtC,2DAA2D,EAC3D,EAAE,EACF,oBAAoB,EACpB,EAAE,EACF,0BAA0B,EAC1B,gDAAgD,EAChD,kCAAkC,EAClC,EAAE,EACF,gCAAgC,EAChC,sCAAsC,EACtC,yDAAyD,EACzD,EAAE,EACF,4BAA4B,EAC5B,gCAAgC,EAChC,+BAA+B,EAC/B,EAAE,EACF,cAAc,EACd,EAAE,EACF,6DAA6D,EAC7D,+CAA+C,EAC/C,4CAA4C,CAC7C,CAAC;QAEF,OAAO;YACL,QAAQ,EAAE,CAAC;oBACT,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE;wBACP,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;qBACzB;iBACF,CAAC;SACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;AACtD,CAAC"}

package/dist/remote/auth/index.d.ts

@@ -0,0 +1,86 @@
+/**
+ * @name RemoteAuth
+ * @description Authentication primitives for remote MCP server access control.
+ */
+import type { IncomingHttpHeaders } from 'http';
+/**
+ * @name AuthResult
+ * @description Result of a remote authentication attempt.
+ */
+export interface AuthResult {
+    success: boolean;
+    userId?: string;
+    error?: string;
+}
+/**
+ * @name ApiKeyAuthConfig
+ * @description API-key authentication configuration mapping bearer tokens to user identifiers.
+ */
+export interface ApiKeyAuthConfig {
+    type: 'api_key';
+    keys: ReadonlyMap<string, string>;
+}
+/**
+ * @name JwtAuthConfig
+ * @description HMAC-SHA256 JWT authentication configuration.
+ */
+export interface JwtAuthConfig {
+    type: 'jwt';
+    secret: string;
+    issuer: string;
+}
+/**
+ * @name NoAuthConfig
+ * @description Public bearerless MCP mode for agent-facing x402-first deployments.
+ */
+export interface NoAuthConfig {
+    type: 'none';
+}
+/**
+ * @name RemoteAuthConfig
+ * @description Supported remote authentication strategies.
+ */
+export type RemoteAuthConfig = ApiKeyAuthConfig | JwtAuthConfig | NoAuthConfig;
+/**
+ * @name APIKeyAuth
+ * @description Validates bearer tokens against a configured API-key map.
+ */
+export declare class APIKeyAuth {
+    private readonly keys;
+    constructor(keys: ReadonlyMap<string, string>);
+    /**
+     * @name validate
+     * @description Checks whether an API key exists in the configured key map.
+     */
+    validate(apiKey: string): AuthResult;
+}
+/**
+ * @name JWTAuth
+ * @description Validates HMAC-SHA256 bearer JWTs with issuer and expiration checks.
+ */
+export declare class JWTAuth {
+    private readonly secret;
+    private readonly issuer;
+    constructor(secret: string, issuer: string);
+    /**
+     * @name validate
+     * @description Verifies JWT structure, signature, issuer, subject, and expiration.
+     */
+    validate(token: string): AuthResult;
+}
+/**
+ * @name AuthManager
+ * @description Validates remote MCP request headers through the configured authentication strategy.
+ */
+export declare class AuthManager {
+    private readonly apiKeyAuth?;
+    private readonly jwtAuth?;
+    private readonly publicAccess;
+    constructor(config: RemoteAuthConfig);
+    /**
+     * @name validateFromHeaders
+     * @description Validates remote access through the configured authentication strategy.
+     */
+    validateFromHeaders(headers: IncomingHttpHeaders): AuthResult;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/remote/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/remote/auth/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAEhD;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,KAAK,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,gBAAgB,GAAG,aAAa,GAAG,YAAY,CAAC;AAE/E;;;GAGG;AACH,qBAAa,UAAU;IACF,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC;IAErE;;;OAGG;IACI,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU;CAO5C;AA+CD;;;GAGG;AACH,qBAAa,OAAO;IAEhB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM;IAGjC;;;OAGG;IACI,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU;CAsC3C;AAED;;;GAGG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAa;IACzC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAU;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;gBAEpB,MAAM,EAAE,gBAAgB;IAY3C;;;OAGG;IACI,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,GAAG,UAAU;CAwBrE"}

package/dist/remote/auth/index.js

@@ -0,0 +1,152 @@
+/**
+ * @name RemoteAuth
+ * @description Authentication primitives for remote MCP server access control.
+ */
+import { createHmac, timingSafeEqual } from 'crypto';
+/**
+ * @name APIKeyAuth
+ * @description Validates bearer tokens against a configured API-key map.
+ */
+export class APIKeyAuth {
+    keys;
+    constructor(keys) {
+        this.keys = keys;
+    }
+    /**
+     * @name validate
+     * @description Checks whether an API key exists in the configured key map.
+     */
+    validate(apiKey) {
+        const userId = this.keys.get(apiKey);
+        if (!userId) {
+            return { success: false, error: 'Invalid API key' };
+        }
+        return { success: true, userId };
+    }
+}
+/**
+ * @name isJwtPayload
+ * @description Narrows an unknown JSON value to the JWT payload shape used by the server.
+ */
+function isJwtPayload(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return false;
+    }
+    const record = value;
+    return ((record.iss === undefined || typeof record.iss === 'string') &&
+        (record.sub === undefined || typeof record.sub === 'string') &&
+        (record.exp === undefined || typeof record.exp === 'number'));
+}
+/**
+ * @name decodeJsonSegment
+ * @description Decodes a base64url JWT segment into a typed JSON object.
+ */
+function decodeJsonSegment(segment) {
+    const json = Buffer.from(segment, 'base64url').toString('utf8');
+    return JSON.parse(json);
+}
+/**
+ * @name constantTimeEquals
+ * @description Compares base64url signatures without leaking timing information.
+ */
+function constantTimeEquals(left, right) {
+    const leftBuffer = Buffer.from(left);
+    const rightBuffer = Buffer.from(right);
+    return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);
+}
+/**
+ * @name JWTAuth
+ * @description Validates HMAC-SHA256 bearer JWTs with issuer and expiration checks.
+ */
+export class JWTAuth {
+    secret;
+    issuer;
+    constructor(secret, issuer) {
+        this.secret = secret;
+        this.issuer = issuer;
+    }
+    /**
+     * @name validate
+     * @description Verifies JWT structure, signature, issuer, subject, and expiration.
+     */
+    validate(token) {
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            return { success: false, error: 'Invalid JWT format' };
+        }
+        const [headerSegment, payloadSegment, signatureSegment] = parts;
+        try {
+            const payload = decodeJsonSegment(payloadSegment);
+            if (!isJwtPayload(payload)) {
+                return { success: false, error: 'Invalid JWT payload' };
+            }
+            if (payload.iss !== this.issuer) {
+                return { success: false, error: 'Invalid token issuer' };
+            }
+            if (!payload.sub) {
+                return { success: false, error: 'Missing token subject' };
+            }
+            if (payload.exp !== undefined && payload.exp < Date.now() / 1000) {
+                return { success: false, error: 'Token expired' };
+            }
+            const expectedSignature = createHmac('sha256', this.secret)
+                .update(`${headerSegment}.${payloadSegment}`)
+                .digest('base64url');
+            if (!constantTimeEquals(signatureSegment, expectedSignature)) {
+                return { success: false, error: 'Invalid signature' };
+            }
+            return { success: true, userId: payload.sub };
+        }
+        catch (error) {
+            return {
+                success: false,
+                error: error instanceof Error ? error.message : 'JWT validation failed',
+            };
+        }
+    }
+}
+/**
+ * @name AuthManager
+ * @description Validates remote MCP request headers through the configured authentication strategy.
+ */
+export class AuthManager {
+    apiKeyAuth;
+    jwtAuth;
+    publicAccess;
+    constructor(config) {
+        this.publicAccess = config.type === 'none';
+        if (config.type === 'none') {
+            return;
+        }
+        if (config.type === 'api_key') {
+            this.apiKeyAuth = new APIKeyAuth(config.keys);
+            return;
+        }
+        this.jwtAuth = new JWTAuth(config.secret, config.issuer);
+    }
+    /**
+     * @name validateFromHeaders
+     * @description Validates remote access through the configured authentication strategy.
+     */
+    validateFromHeaders(headers) {
+        if (this.publicAccess) {
+            return { success: true, userId: 'anonymous' };
+        }
+        const authHeader = headers.authorization;
+        if (!authHeader) {
+            return { success: false, error: 'Missing authorization header' };
+        }
+        const [scheme, credentials] = authHeader.split(/\s+/, 2);
+        if (scheme !== 'Bearer' || !credentials) {
+            return { success: false, error: 'Unsupported auth type' };
+        }
+        if (this.apiKeyAuth) {
+            return this.apiKeyAuth.validate(credentials);
+        }
+        if (this.jwtAuth) {
+            return this.jwtAuth.validate(credentials);
+        }
+        return { success: false, error: 'No authentication method configured' };
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/remote/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/remote/auth/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AA8CrD;;;GAGG;AACH,MAAM,OAAO,UAAU;IACe;IAApC,YAAoC,IAAiC;QAAjC,SAAI,GAAJ,IAAI,CAA6B;IAAG,CAAC;IAEzE;;;OAGG;IACI,QAAQ,CAAC,MAAc;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;CACF;AAYD;;;GAGG;AACH,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,CACL,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC;QAC5D,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC;QAC5D,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,IAAY,EAAE,KAAa;IACrD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AAC9F,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,OAAO;IAEC;IACA;IAFnB,YACmB,MAAc,EACd,MAAc;QADd,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ;;;OAGG;IACI,QAAQ,CAAC,KAAa;QAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzD,CAAC;QAED,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,GAAG,KAAK,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;YAClD,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;YAC1D,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;YAC3D,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;YAC5D,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBACjE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;YACpD,CAAC;YAED,MAAM,iBAAiB,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC;iBACxD,MAAM,CAAC,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;iBAC5C,MAAM,CAAC,WAAW,CAAC,CAAC;YAEvB,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,EAAE,CAAC;gBAC7D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;YACxD,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB;aACxE,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,WAAW;IACL,UAAU,CAAc;IACxB,OAAO,CAAW;IAClB,YAAY,CAAU;IAEvC,YAAmB,MAAwB;QACzC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC;QAC3C,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACI,mBAAmB,CAAC,OAA4B;QACrD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;QACnE,CAAC;QAED,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACzD,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;YACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC5D,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;IAC1E,CAAC;CACF"}

package/dist/remote/server.d.ts

@@ -0,0 +1,140 @@
+#!/usr/bin/env node
+/**
+ * @name RemoteMCPServer
+ * @description Streamable HTTP entrypoint for remote SAP MCP deployments.
+ */
+import * as http from 'http';
+import { type SapMcpConfig } from '../config/env.js';
+import { type RemoteAuthConfig } from './auth/index.js';
+/**
+ * @name RemoteMCPConfig
+ * @description Resolved runtime configuration for the remote MCP HTTP server.
+ */
+export interface RemoteMCPConfig {
+    port: number;
+    host: string;
+    corsOrigins?: string[];
+    auth: RemoteAuthConfig;
+}
+/**
+ * @name A2AAgentCard
+ * @description Public discovery document returned for A2A-compatible orchestrators.
+ */
+export interface A2AAgentCard {
+    name: string;
+    description: string;
+    url: string;
+    version: string;
+    protocol: {
+        primary: 'mcp';
+        transport: 'streamable-http';
+        endpoint: string;
+    };
+    capabilities: {
+        streaming: boolean;
+        tools: boolean;
+        resources: boolean;
+        prompts: boolean;
+        authenticated: boolean;
+    };
+    authentication: {
+        schemes: readonly ('Bearer' | 'x402' | 'none')[];
+        required: boolean;
+    };
+    defaultInputModes: readonly ['application/json'];
+    defaultOutputModes: readonly ['application/json', 'text/event-stream'];
+    skills: ReadonlyArray<{
+        id: string;
+        name: string;
+        description: string;
+        tags: readonly string[];
+    }>;
+    setup: {
+        wizard: WizardInstallDescriptor;
+    };
+}
+/**
+ * @name WizardInstallDescriptor
+ * @description Public hosted metadata that tells agents and users how to install the local SAP MCP wizard.
+ */
+export interface WizardInstallDescriptor {
+    name: 'SAP MCP Wizard';
+    version: string;
+    packageName: '@oobe-protocol-labs/sap-mcp-server';
+    hostedMcpUrl: string;
+    configDirectory: '~/.config/mcp-sap';
+    requiredFor: readonly string[];
+    endpoints: {
+        descriptor: string;
+        installScript: string;
+        mcp: string;
+    };
+    commands: {
+        runWizard: string;
+        showConfig: string;
+        showProfile: string;
+    };
+    security: {
+        keypairBytesExposed: false;
+        modifiesSolanaCliKeypair: false;
+        signerLocation: 'user-machine-or-external-signer';
+    };
+}
+/**
+ * @name parseApiKeys
+ * @description Parses comma-separated `apiKey=userId` entries from environment configuration.
+ */
+export declare function parseApiKeys(raw: string | undefined): Map<string, string>;
+/**
+ * @name defaultRemoteConfig
+ * @description Builds remote-server configuration from SAP config plus remote-specific environment values.
+ */
+export declare function defaultRemoteConfig(appConfig: SapMcpConfig): RemoteMCPConfig;
+/**
+ * @name buildA2AAgentCard
+ * @description Builds the public A2A-compatible agent-card document for remote discovery.
+ */
+export declare function buildA2AAgentCard(req: http.IncomingMessage, config: RemoteMCPConfig): A2AAgentCard;
+/**
+ * @name buildWizardInstallDescriptor
+ * @description Builds the public wizard installation descriptor used by agents when local SAP MCP config is missing.
+ */
+export declare function buildWizardInstallDescriptor(req: http.IncomingMessage, config: RemoteMCPConfig): WizardInstallDescriptor;
+/**
+ * @name buildWizardInstallScript
+ * @description Builds a small shell launcher that downloads the npm package and starts the wizard.
+ */
+export declare function buildWizardInstallScript(req: http.IncomingMessage, config: RemoteMCPConfig): string;
+/**
+ * @name RemoteMCPServer
+ * @description Remote MCP server backed by the official Streamable HTTP transport.
+ */
+export declare class RemoteMCPServer {
+    private readonly config;
+    private readonly appConfig;
+    private readonly authManager;
+    private transport?;
+    private httpServer?;
+    constructor(config?: RemoteMCPConfig);
+    /**
+     * @name start
+     * @description Starts the remote MCP endpoint, health check, and A2A discovery routes.
+     */
+    start(): Promise<void>;
+    /**
+     * @name stop
+     * @description Gracefully closes the MCP transport and HTTP listener.
+     */
+    stop(): Promise<void>;
+    /**
+     * @name validateAuthConfig
+     * @description Fails startup when configured remote authentication is incomplete.
+     */
+    private validateAuthConfig;
+    /**
+     * @name applyCors
+     * @description Applies configured CORS headers and handles preflight requests.
+     */
+    private applyCors;
+}
+//# sourceMappingURL=server.d.ts.map

package/dist/remote/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/remote/server.ts"],"names":[],"mappings":";AACA;;;GAGG;AAGH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGjE,OAAO,EAAe,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGrE;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE;QACR,OAAO,EAAE,KAAK,CAAC;QACf,SAAS,EAAE,iBAAiB,CAAC;QAC7B,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,YAAY,EAAE;QACZ,SAAS,EAAE,OAAO,CAAC;QACnB,KAAK,EAAE,OAAO,CAAC;QACf,SAAS,EAAE,OAAO,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IACF,cAAc,EAAE;QACd,OAAO,EAAE,SAAS,CAAC,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;QACjD,QAAQ,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,iBAAiB,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACjD,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;IACvE,MAAM,EAAE,aAAa,CAAC;QACpB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;KACzB,CAAC,CAAC;IACH,KAAK,EAAE;QACL,MAAM,EAAE,uBAAuB,CAAC;KACjC,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,oCAAoC,CAAC;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,mBAAmB,CAAC;IACrC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,SAAS,EAAE;QACT,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;QACtB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,QAAQ,EAAE;QACR,mBAAmB,EAAE,KAAK,CAAC;QAC3B,wBAAwB,EAAE,KAAK,CAAC;QAChC,cAAc,EAAE,iCAAiC,CAAC;KACnD,CAAC;CACH;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAczE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,YAAY,GAAG,eAAe,CAiD5E;AAkCD;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,MAAM,EAAE,eAAe,GACtB,YAAY,CAsEd;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,MAAM,EAAE,eAAe,GACtB,uBAAuB,CA+BzB;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,MAAM,EAAE,eAAe,GACtB,MAAM,CAkBR;AAED;;;GAGG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,SAAS,CAAC,CAAgC;IAClD,OAAO,CAAC,UAAU,CAAC,CAAc;gBAEd,MAAM,CAAC,EAAE,eAAe;IAY3C;;;OAGG;IACU,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAiGnC;;;OAGG;IACU,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAelC;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAY1B;;;OAGG;IACH,OAAO,CAAC,SAAS;CAoBlB"}