@opendatalabs/personal-server-ts-core 0.2.0 → 1.0.1

package/dist/mcp/connection-api.d.ts

@@ -0,0 +1,170 @@
+/**
+ * Owner-only MCP connection management. Implements the four endpoints listed
+ * in §2 of 260604-PLAN-vana-mcp-personal-server.md:
+ *
+ *   POST   /v1/mcp/connections
+ *   GET    /v1/mcp/connections
+ *   POST   /v1/mcp/connections/:id/approve
+ *   DELETE /v1/mcp/connections/:id
+ *
+ * These endpoints DO NOT read user data. They only manage connection records
+ * — create the per-connection grantee/token, store grant ids after the user
+ * approves them, and mark connections revoked.
+ */
+import type { DataPortabilityGatewayConfig, GatewayClient } from "@opendatalabs/vana-sdk/browser";
+import type { ServerSigner } from "../signing/index.js";
+import type { McpConnectionRecord, McpConnectionStore, McpConnectionGrant, McpOAuthAuthorizationRecord, McpOAuthAuthorizationStore } from "./types.js";
+export declare function hashConnectionToken(token: string): Promise<string>;
+export interface CreateMcpConnectionInput {
+    displayName?: string;
+}
+export interface CreateMcpConnectionOutput {
+    connectionId: string;
+    granteeAddress: `0x${string}`;
+    /** Raw token. Returned ONCE — the store keeps only the SHA-256 hash. */
+    connectionToken: string;
+    /** Convenience: the full URL Claude should call. */
+    mcpUrl: string;
+    createdAt: string;
+}
+export interface CreateMcpConnectionOptions {
+    store: McpConnectionStore;
+    /**
+     * Public origin Claude will hit. Used to build the returned `mcpUrl`. The
+     * caller (route handler) typically resolves this from the request's public
+     * URL (relay) at call time.
+     */
+    publicOrigin: string;
+    now?: () => Date;
+}
+export declare function createMcpConnection(input: CreateMcpConnectionInput, options: CreateMcpConnectionOptions): Promise<CreateMcpConnectionOutput>;
+export declare function buildMcpUrl(publicOrigin: string, token: string): string;
+export declare function buildStableMcpUrl(publicOrigin: string): string;
+export declare function buildMcpProtectedResourceMetadataUrl(publicOrigin: string): string;
+export interface ApproveMcpConnectionInput {
+    connectionId: string;
+    grants: McpConnectionGrant[];
+}
+export interface ApproveMcpConnectionOptions {
+    store: McpConnectionStore;
+    now?: () => Date;
+}
+export declare class McpConnectionNotFoundError extends Error {
+    connectionId: string;
+    constructor(connectionId: string);
+}
+export declare class McpConnectionStateError extends Error {
+    connectionId: string;
+    state: string;
+    expected: string;
+    constructor(connectionId: string, state: string, expected: string);
+}
+export declare function approveMcpConnection(input: ApproveMcpConnectionInput, options: ApproveMcpConnectionOptions): Promise<McpConnectionRecord>;
+export interface RevokeMcpConnectionOptions {
+    store: McpConnectionStore;
+    now?: () => Date;
+}
+export declare function revokeMcpConnection(connectionId: string, options: RevokeMcpConnectionOptions): Promise<McpConnectionRecord>;
+/**
+ * Public representation of a connection — never includes the encrypted
+ * private key or token hash. Safe to return to owner clients (Vana Web).
+ */
+export interface McpConnectionView {
+    id: string;
+    displayName: string;
+    granteeAddress: `0x${string}`;
+    status: "pending" | "approved" | "revoked";
+    grants: McpConnectionGrant[];
+    createdAt: string;
+    approvedAt?: string;
+    revokedAt?: string;
+    lastUsedAt?: string;
+}
+export declare function toMcpConnectionView(record: McpConnectionRecord): McpConnectionView;
+export declare function listMcpConnectionViews(store: McpConnectionStore): Promise<McpConnectionView[]>;
+export interface CreateMcpOAuthAuthorizationInput {
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    codeChallengeMethod: string;
+    scope?: string;
+    state?: string;
+}
+export interface CreateMcpOAuthAuthorizationOptions {
+    connectionStore: McpConnectionStore;
+    authorizationStore: McpOAuthAuthorizationStore;
+    publicOrigin: string;
+    now?: () => Date;
+}
+export interface CreateMcpOAuthAuthorizationOutput {
+    authorizationId: string;
+    connectionId: string;
+    granteeAddress: `0x${string}`;
+    expiresAt: string;
+}
+export declare class McpOAuthAuthorizationError extends Error {
+    code: string;
+    status: number;
+    body?: unknown | undefined;
+    constructor(code: string, message: string, status?: number, body?: unknown | undefined);
+}
+export declare function createMcpOAuthAuthorization(input: CreateMcpOAuthAuthorizationInput, options: CreateMcpOAuthAuthorizationOptions): Promise<CreateMcpOAuthAuthorizationOutput>;
+export interface McpOAuthAuthorizationView {
+    id: string;
+    clientId: string;
+    redirectUri: string;
+    scope?: string;
+    state?: string;
+    connectionId: string;
+    granteeAddress: `0x${string}`;
+    status: McpOAuthAuthorizationRecord["status"];
+    createdAt: string;
+    expiresAt: string;
+}
+export declare function toMcpOAuthAuthorizationView(record: McpOAuthAuthorizationRecord): McpOAuthAuthorizationView;
+export interface ApproveMcpOAuthAuthorizationInput {
+    authorizationId: string;
+    grants: McpConnectionGrant[];
+}
+export interface ApproveMcpOAuthAuthorizationScopesInput {
+    authorizationId: string;
+    scopes: string[];
+    expiresAt?: number;
+    nonce?: number;
+}
+export interface ApproveMcpOAuthAuthorizationOptions {
+    connectionStore: McpConnectionStore;
+    authorizationStore: McpOAuthAuthorizationStore;
+    now?: () => Date;
+}
+export interface ApproveMcpOAuthAuthorizationOutput {
+    redirectTo: string;
+    authorizationCode: string;
+}
+export declare function approveMcpOAuthAuthorization(input: ApproveMcpOAuthAuthorizationInput, options: ApproveMcpOAuthAuthorizationOptions): Promise<ApproveMcpOAuthAuthorizationOutput>;
+export interface ApproveMcpOAuthAuthorizationScopesOptions extends ApproveMcpOAuthAuthorizationOptions {
+    gateway: Pick<GatewayClient, "getBuilder" | "createGrant">;
+    gatewayConfig: DataPortabilityGatewayConfig;
+    gatewayUrl: string;
+    serverOwner?: `0x${string}`;
+    serverSigner?: Pick<ServerSigner, "signGrantRegistration">;
+    fetch?: typeof fetch;
+}
+export declare function approveMcpOAuthAuthorizationWithScopes(input: ApproveMcpOAuthAuthorizationScopesInput, options: ApproveMcpOAuthAuthorizationScopesOptions): Promise<ApproveMcpOAuthAuthorizationOutput>;
+export interface RedeemMcpOAuthAuthorizationCodeInput {
+    authorizationCode: string;
+    codeVerifier: string;
+    clientId: string;
+    redirectUri: string;
+}
+export interface RedeemMcpOAuthAuthorizationCodeOptions {
+    authorizationStore: McpOAuthAuthorizationStore;
+    connectionStore: McpConnectionStore;
+    now?: () => Date;
+}
+export interface RedeemMcpOAuthAuthorizationCodeOutput {
+    accessToken: string;
+    scope?: string;
+}
+export declare function redeemMcpOAuthAuthorizationCode(input: RedeemMcpOAuthAuthorizationCodeInput, options: RedeemMcpOAuthAuthorizationCodeOptions): Promise<RedeemMcpOAuthAuthorizationCodeOutput>;
+//# sourceMappingURL=connection-api.d.ts.map

package/dist/mcp/connection-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-api.d.ts","sourceRoot":"","sources":["../../src/mcp/connection-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAMxD,OAAO,KAAK,EACV,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,2BAA2B,EAC3B,0BAA0B,EAC3B,MAAM,YAAY,CAAC;AA4BpB,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIxE;AAYD,MAAM,WAAW,wBAAwB;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,wEAAwE;IACxE,eAAe,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,kBAAkB,CAAC;IAC1B;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,wBAAwB,EAC/B,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,yBAAyB,CAAC,CA4BpC;AAED,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKvE;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAK9D;AAED,wBAAgB,oCAAoC,CAClD,YAAY,EAAE,MAAM,GACnB,MAAM,CAKR;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,kBAAkB,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,qBAAa,0BAA2B,SAAQ,KAAK;IAChC,YAAY,EAAE,MAAM;gBAApB,YAAY,EAAE,MAAM;CAGxC;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAEvC,YAAY,EAAE,MAAM;IACpB,KAAK,EAAE,MAAM;IACb,QAAQ,EAAE,MAAM;gBAFhB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM;CAI1B;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,EAChC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,mBAAmB,CAAC,CAuB9B;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,kBAAkB,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAsB,mBAAmB,CACvC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,mBAAmB,CAAC,CAW9B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,mBAAmB,GAC1B,iBAAiB,CAYnB;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAG9B;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kCAAkC;IACjD,eAAe,EAAE,kBAAkB,CAAC;IACpC,kBAAkB,EAAE,0BAA0B,CAAC;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,iCAAiC;IAChD,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,0BAA2B,SAAQ,KAAK;IAE1C,IAAI,EAAE,MAAM;IAEZ,MAAM;IACN,IAAI,CAAC,EAAE,OAAO;gBAHd,IAAI,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACR,MAAM,SAAM,EACZ,IAAI,CAAC,EAAE,OAAO,YAAA;CAKxB;AAED,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,gCAAgC,EACvC,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,iCAAiC,CAAC,CA6D5C;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,MAAM,EAAE,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,2BAA2B,GAClC,yBAAyB,CAa3B;AAED,MAAM,WAAW,iCAAiC;IAChD,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,uCAAuC;IACtD,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mCAAmC;IAClD,eAAe,EAAE,kBAAkB,CAAC;IACpC,kBAAkB,EAAE,0BAA0B,CAAC;IAC/C,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,kCAAkC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,iCAAiC,EACxC,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC,kCAAkC,CAAC,CAsD7C;AAED,MAAM,WAAW,yCAA0C,SAAQ,mCAAmC;IACpG,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,aAAa,CAAC,CAAC;IAC3D,aAAa,EAAE,4BAA4B,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,YAAY,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IAC3D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,wBAAsB,sCAAsC,CAC1D,KAAK,EAAE,uCAAuC,EAC9C,OAAO,EAAE,yCAAyC,GACjD,OAAO,CAAC,kCAAkC,CAAC,CAqF7C;AAED,MAAM,WAAW,oCAAoC;IACnD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sCAAsC;IACrD,kBAAkB,EAAE,0BAA0B,CAAC;IAC/C,eAAe,EAAE,kBAAkB,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,qCAAqC;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,oCAAoC,EAC3C,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,qCAAqC,CAAC,CAwEhD"}

package/dist/mcp/connection-api.js

@@ -0,0 +1,379 @@
+/**
+ * Owner-only MCP connection management. Implements the four endpoints listed
+ * in §2 of 260604-PLAN-vana-mcp-personal-server.md:
+ *
+ *   POST   /v1/mcp/connections
+ *   GET    /v1/mcp/connections
+ *   POST   /v1/mcp/connections/:id/approve
+ *   DELETE /v1/mcp/connections/:id
+ *
+ * These endpoints DO NOT read user data. They only manage connection records
+ * — create the per-connection grantee/token, store grant ids after the user
+ * approves them, and mark connections revoked.
+ */
+import { generateMcpGrantee } from "./grantee.js";
+import { createGrantContract } from "../contracts/index.js";
+import { appUrlFromOAuthRedirectUri, ensureMcpGranteeRegistered, McpGranteeRegistrationError, } from "./builder-registration.js";
+const TOKEN_BYTES = 32;
+const OAUTH_AUTHORIZATION_TTL_MS = 10 * 60 * 1000;
+function nowIso(now) {
+    return (now ? now() : new Date()).toISOString();
+}
+function randomBytes(byteLength) {
+    const bytes = new Uint8Array(byteLength);
+    globalThis.crypto.getRandomValues(bytes);
+    return bytes;
+}
+function bytesToHex(bytes) {
+    return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function bytesToBase64Url(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    // `btoa` exists in modern browsers AND Node ≥18 (the engines version that
+    // PS Lite and personal-server-ts already target).
+    const base64 = btoa(binary);
+    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export async function hashConnectionToken(token) {
+    const data = new TextEncoder().encode(token);
+    const digest = await globalThis.crypto.subtle.digest("SHA-256", data);
+    return bytesToHex(new Uint8Array(digest));
+}
+function randomId() {
+    return (globalThis.crypto?.randomUUID?.() ?? `mcp-${bytesToHex(randomBytes(8))}`);
+}
+function randomToken() {
+    return bytesToBase64Url(randomBytes(TOKEN_BYTES));
+}
+export async function createMcpConnection(input, options) {
+    const grantee = generateMcpGrantee();
+    const token = randomToken();
+    const tokenHash = await hashConnectionToken(token);
+    const id = randomId();
+    const createdAt = nowIso(options.now);
+    const record = {
+        id,
+        displayName: input.displayName?.trim() || "Claude",
+        granteeAddress: grantee.key.address,
+        granteePublicKey: grantee.key.publicKey,
+        encryptedGranteePrivateKey: grantee.key.encryptedPrivateKey,
+        tokenHash,
+        status: "pending",
+        grants: [],
+        createdAt,
+    };
+    await options.store.create(record);
+    return {
+        connectionId: id,
+        granteeAddress: grantee.key.address,
+        connectionToken: token,
+        mcpUrl: buildMcpUrl(options.publicOrigin, token),
+        createdAt,
+    };
+}
+export function buildMcpUrl(publicOrigin, token) {
+    const base = publicOrigin.endsWith("/")
+        ? publicOrigin.slice(0, -1)
+        : publicOrigin;
+    return `${base}/mcp/${encodeURIComponent(token)}`;
+}
+export function buildStableMcpUrl(publicOrigin) {
+    const base = publicOrigin.endsWith("/")
+        ? publicOrigin.slice(0, -1)
+        : publicOrigin;
+    return `${base}/mcp`;
+}
+export function buildMcpProtectedResourceMetadataUrl(publicOrigin) {
+    const base = publicOrigin.endsWith("/")
+        ? publicOrigin.slice(0, -1)
+        : publicOrigin;
+    return `${base}/.well-known/oauth-protected-resource/mcp`;
+}
+export class McpConnectionNotFoundError extends Error {
+    connectionId;
+    constructor(connectionId) {
+        super(`mcp connection ${connectionId} not found`);
+        this.connectionId = connectionId;
+    }
+}
+export class McpConnectionStateError extends Error {
+    connectionId;
+    state;
+    expected;
+    constructor(connectionId, state, expected) {
+        super(`mcp connection ${connectionId} is ${state}; expected ${expected}`);
+        this.connectionId = connectionId;
+        this.state = state;
+        this.expected = expected;
+    }
+}
+export async function approveMcpConnection(input, options) {
+    const existing = await options.store.getById(input.connectionId);
+    if (!existing)
+        throw new McpConnectionNotFoundError(input.connectionId);
+    if (existing.status === "revoked") {
+        throw new McpConnectionStateError(input.connectionId, existing.status, "pending or approved");
+    }
+    if (!input.grants.length) {
+        throw new Error("approveMcpConnection requires at least one grant; the consent flow must mint grants first");
+    }
+    const approvedAt = nowIso(options.now);
+    const updated = await options.store.update(input.connectionId, {
+        status: "approved",
+        grants: input.grants,
+        approvedAt,
+    });
+    if (!updated)
+        throw new McpConnectionNotFoundError(input.connectionId);
+    return updated;
+}
+export async function revokeMcpConnection(connectionId, options) {
+    const existing = await options.store.getById(connectionId);
+    if (!existing)
+        throw new McpConnectionNotFoundError(connectionId);
+    if (existing.status === "revoked")
+        return existing;
+    const revokedAt = nowIso(options.now);
+    const updated = await options.store.update(connectionId, {
+        status: "revoked",
+        revokedAt,
+    });
+    if (!updated)
+        throw new McpConnectionNotFoundError(connectionId);
+    return updated;
+}
+export function toMcpConnectionView(record) {
+    return {
+        id: record.id,
+        displayName: record.displayName,
+        granteeAddress: record.granteeAddress,
+        status: record.status,
+        grants: record.grants,
+        createdAt: record.createdAt,
+        approvedAt: record.approvedAt,
+        revokedAt: record.revokedAt,
+        lastUsedAt: record.lastUsedAt,
+    };
+}
+export async function listMcpConnectionViews(store) {
+    const records = await store.list();
+    return records.map(toMcpConnectionView);
+}
+export class McpOAuthAuthorizationError extends Error {
+    code;
+    status;
+    body;
+    constructor(code, message, status = 400, body) {
+        super(message);
+        this.code = code;
+        this.status = status;
+        this.body = body;
+        this.name = "McpOAuthAuthorizationError";
+    }
+}
+export async function createMcpOAuthAuthorization(input, options) {
+    if (!input.clientId.trim()) {
+        throw new McpOAuthAuthorizationError("invalid_client", "client_id is required");
+    }
+    if (!input.redirectUri.trim()) {
+        throw new McpOAuthAuthorizationError("invalid_request", "redirect_uri is required");
+    }
+    if (!input.codeChallenge.trim()) {
+        throw new McpOAuthAuthorizationError("invalid_request", "code_challenge is required");
+    }
+    if (input.codeChallengeMethod !== "S256") {
+        throw new McpOAuthAuthorizationError("invalid_request", "Only S256 PKCE is supported");
+    }
+    const now = options.now ? options.now() : new Date();
+    const expiresAt = new Date(now.getTime() + OAUTH_AUTHORIZATION_TTL_MS).toISOString();
+    const created = await createMcpConnection({ displayName: "Claude" }, {
+        store: options.connectionStore,
+        publicOrigin: options.publicOrigin,
+        now: () => now,
+    });
+    const authorizationId = randomId();
+    const record = {
+        id: authorizationId,
+        clientId: input.clientId,
+        redirectUri: input.redirectUri,
+        codeChallenge: input.codeChallenge,
+        codeChallengeMethod: "S256",
+        ...(input.scope ? { scope: input.scope } : {}),
+        ...(input.state ? { state: input.state } : {}),
+        connectionId: created.connectionId,
+        granteeAddress: created.granteeAddress,
+        status: "pending",
+        createdAt: now.toISOString(),
+        expiresAt,
+    };
+    await options.authorizationStore.create(record);
+    return {
+        authorizationId,
+        connectionId: created.connectionId,
+        granteeAddress: created.granteeAddress,
+        expiresAt,
+    };
+}
+export function toMcpOAuthAuthorizationView(record) {
+    return {
+        id: record.id,
+        clientId: record.clientId,
+        redirectUri: record.redirectUri,
+        ...(record.scope ? { scope: record.scope } : {}),
+        ...(record.state ? { state: record.state } : {}),
+        connectionId: record.connectionId,
+        granteeAddress: record.granteeAddress,
+        status: record.status,
+        createdAt: record.createdAt,
+        expiresAt: record.expiresAt,
+    };
+}
+export async function approveMcpOAuthAuthorization(input, options) {
+    const record = await options.authorizationStore.getById(input.authorizationId);
+    if (!record) {
+        throw new McpOAuthAuthorizationError("not_found", `mcp oauth authorization ${input.authorizationId} not found`);
+    }
+    if (record.status !== "pending") {
+        throw new McpOAuthAuthorizationError("invalid_state", `mcp oauth authorization ${input.authorizationId} is ${record.status}; expected pending`);
+    }
+    if (Date.parse(record.expiresAt) <= (options.now?.() ?? new Date()).getTime()) {
+        await options.authorizationStore.update(record.id, { status: "expired" });
+        throw new McpOAuthAuthorizationError("expired", "MCP OAuth authorization expired before approval");
+    }
+    if (input.grants.length === 0) {
+        throw new McpOAuthAuthorizationError("grants_required", "Approve requires at least one grant");
+    }
+    await approveMcpConnection({ connectionId: record.connectionId, grants: input.grants }, { store: options.connectionStore, now: options.now });
+    const authorizationCode = randomToken();
+    const authorizationCodeHash = await hashMcpOAuthAuthorizationCode(authorizationCode);
+    const approvedAt = (options.now ? options.now() : new Date()).toISOString();
+    await options.authorizationStore.update(record.id, {
+        status: "approved",
+        approvedAt,
+        authorizationCodeHash,
+    });
+    const redirectTo = new URL(record.redirectUri);
+    redirectTo.searchParams.set("code", authorizationCode);
+    if (record.state) {
+        redirectTo.searchParams.set("state", record.state);
+    }
+    return { redirectTo: redirectTo.toString(), authorizationCode };
+}
+export async function approveMcpOAuthAuthorizationWithScopes(input, options) {
+    const record = await options.authorizationStore.getById(input.authorizationId);
+    if (!record) {
+        throw new McpOAuthAuthorizationError("not_found", `mcp oauth authorization ${input.authorizationId} not found`, 404);
+    }
+    if (!Array.isArray(input.scopes) || input.scopes.length === 0) {
+        throw new McpOAuthAuthorizationError("scopes_required", "Approve requires at least one scope");
+    }
+    const connection = await options.connectionStore.getById(record.connectionId);
+    if (!connection) {
+        throw new McpOAuthAuthorizationError("connection_not_found", `mcp connection ${record.connectionId} not found`, 404);
+    }
+    try {
+        await ensureMcpGranteeRegistered({
+            connection,
+            gateway: options.gateway,
+            gatewayConfig: options.gatewayConfig,
+            gatewayUrl: options.gatewayUrl,
+            appUrl: appUrlFromOAuthRedirectUri(record.redirectUri, record.clientId),
+            fetch: options.fetch,
+        });
+    }
+    catch (err) {
+        if (err instanceof McpGranteeRegistrationError) {
+            throw new McpOAuthAuthorizationError(err.code, err.message, err.status ?? 502, err.body);
+        }
+        throw err;
+    }
+    const grantResult = await createGrantContract({
+        gateway: options.gateway,
+        serverOwner: options.serverOwner,
+        serverSigner: options.serverSigner,
+        body: {
+            granteeAddress: connection.granteeAddress,
+            scopes: input.scopes,
+            ...(input.expiresAt !== undefined ? { expiresAt: input.expiresAt } : {}),
+            ...(input.nonce !== undefined ? { nonce: input.nonce } : {}),
+        },
+    });
+    if (!grantResult.ok) {
+        throw new McpOAuthAuthorizationError("grant_creation_failed", extractGrantErrorMessage(grantResult.body), grantResult.status, grantResult.body);
+    }
+    const grantId = grantResult.body.grantId;
+    if (!grantId) {
+        throw new McpOAuthAuthorizationError("grant_creation_failed", "Personal Server did not return a grant id.", 500, grantResult.body);
+    }
+    return approveMcpOAuthAuthorization({
+        authorizationId: input.authorizationId,
+        grants: [{ grantId, scopes: input.scopes }],
+    }, options);
+}
+export async function redeemMcpOAuthAuthorizationCode(input, options) {
+    const codeHash = await hashMcpOAuthAuthorizationCode(input.authorizationCode);
+    const record = await options.authorizationStore.getByCodeHash(codeHash);
+    if (!record) {
+        throw new McpOAuthAuthorizationError("invalid_grant", "Unknown MCP authorization code");
+    }
+    if (record.status !== "approved") {
+        throw new McpOAuthAuthorizationError("invalid_grant", "MCP authorization code has already been used or is not approved");
+    }
+    if (record.clientId !== input.clientId) {
+        throw new McpOAuthAuthorizationError("invalid_grant", "client_id does not match authorization request");
+    }
+    if (record.redirectUri !== input.redirectUri) {
+        throw new McpOAuthAuthorizationError("invalid_grant", "redirect_uri does not match authorization request");
+    }
+    if (Date.parse(record.expiresAt) <= (options.now?.() ?? new Date()).getTime()) {
+        await options.authorizationStore.update(record.id, { status: "expired" });
+        throw new McpOAuthAuthorizationError("invalid_grant", "MCP authorization code expired");
+    }
+    if (!(await verifyPkceS256({
+        codeVerifier: input.codeVerifier,
+        expectedChallenge: record.codeChallenge,
+    }))) {
+        throw new McpOAuthAuthorizationError("invalid_grant", "PKCE verification failed");
+    }
+    const accessToken = randomToken();
+    const tokenHash = await hashConnectionToken(accessToken);
+    const updatedConnection = await options.connectionStore.update(record.connectionId, {
+        tokenHash,
+    });
+    if (!updatedConnection) {
+        throw new McpOAuthAuthorizationError("invalid_grant", "MCP connection for authorization no longer exists");
+    }
+    await options.authorizationStore.update(record.id, {
+        status: "redeemed",
+        redeemedAt: (options.now ? options.now() : new Date()).toISOString(),
+    });
+    return {
+        accessToken,
+        ...(record.scope ? { scope: record.scope } : {}),
+    };
+}
+async function hashMcpOAuthAuthorizationCode(code) {
+    return hashConnectionToken(`mcp-oauth-code:${code}`);
+}
+async function verifyPkceS256(input) {
+    const data = new TextEncoder().encode(input.codeVerifier);
+    const digest = await globalThis.crypto.subtle.digest("SHA-256", data);
+    return bytesToBase64Url(new Uint8Array(digest)) === input.expectedChallenge;
+}
+function extractGrantErrorMessage(body) {
+    if (body && typeof body === "object") {
+        const record = body;
+        if (typeof record.message === "string")
+            return record.message;
+        const nested = record.error;
+        if (nested && typeof nested === "object") {
+            const message = nested.message;
+            if (typeof message === "string")
+                return message;
+        }
+    }
+    return "Could not create MCP grant";
+}
+//# sourceMappingURL=connection-api.js.map

package/dist/mcp/connection-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-api.js","sourceRoot":"","sources":["../../src/mcp/connection-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAM5D,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AASnC,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,SAAS,MAAM,CAAC,GAAgB;IAC9B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB;IACrC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAiB;IACzC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,0EAA0E;IAC1E,kDAAkD;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa;IACrD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACtE,OAAO,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,CACL,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,OAAO,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CACzE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,gBAAgB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;AACpD,CAAC;AA2BD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA+B,EAC/B,OAAmC;IAEnC,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;IACtB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAwB;QAClC,EAAE;QACF,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,QAAQ;QAClD,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;QACnC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;QACvC,0BAA0B,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC3D,SAAS;QACT,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,EAAE;QACV,SAAS;KACV,CAAC;IAEF,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEnC,OAAO;QACL,YAAY,EAAE,EAAE;QAChB,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;QACnC,eAAe,EAAE,KAAK;QACtB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC;QAChD,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,YAAoB,EAAE,KAAa;IAC7D,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3B,CAAC,CAAC,YAAY,CAAC;IACjB,OAAO,GAAG,IAAI,QAAQ,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,YAAoB;IACpD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3B,CAAC,CAAC,YAAY,CAAC;IACjB,OAAO,GAAG,IAAI,MAAM,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,YAAoB;IAEpB,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3B,CAAC,CAAC,YAAY,CAAC;IACjB,OAAO,GAAG,IAAI,2CAA2C,CAAC;AAC5D,CAAC;AAYD,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAChC;IAAnB,YAAmB,YAAoB;QACrC,KAAK,CAAC,kBAAkB,YAAY,YAAY,CAAC,CAAC;QADjC,iBAAY,GAAZ,YAAY,CAAQ;IAEvC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAEvC;IACA;IACA;IAHT,YACS,YAAoB,EACpB,KAAa,EACb,QAAgB;QAEvB,KAAK,CAAC,kBAAkB,YAAY,OAAO,KAAK,cAAc,QAAQ,EAAE,CAAC,CAAC;QAJnE,iBAAY,GAAZ,YAAY,CAAQ;QACpB,UAAK,GAAL,KAAK,CAAQ;QACb,aAAQ,GAAR,QAAQ,CAAQ;IAGzB,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAgC,EAChC,OAAoC;IAEpC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACjE,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,0BAA0B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAuB,CAC/B,KAAK,CAAC,YAAY,EAClB,QAAQ,CAAC,MAAM,EACf,qBAAqB,CACtB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE;QAC7D,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU;KACX,CAAC,CAAC;IACH,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,0BAA0B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC;AACjB,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,YAAoB,EACpB,OAAmC;IAEnC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,0BAA0B,CAAC,YAAY,CAAC,CAAC;IAClE,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACnD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE;QACvD,MAAM,EAAE,SAAS;QACjB,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,0BAA0B,CAAC,YAAY,CAAC,CAAC;IACjE,OAAO,OAAO,CAAC;AACjB,CAAC;AAkBD,MAAM,UAAU,mBAAmB,CACjC,MAA2B;IAE3B,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAyB;IAEzB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AAC1C,CAAC;AAyBD,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAE1C;IAEA;IACA;IAJT,YACS,IAAY,EACnB,OAAe,EACR,SAAS,GAAG,EACZ,IAAc;QAErB,KAAK,CAAC,OAAO,CAAC,CAAC;QALR,SAAI,GAAJ,IAAI,CAAQ;QAEZ,WAAM,GAAN,MAAM,CAAM;QACZ,SAAI,GAAJ,IAAI,CAAU;QAGrB,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAuC,EACvC,OAA2C;IAE3C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,0BAA0B,CAClC,gBAAgB,EAChB,uBAAuB,CACxB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,0BAA0B,CAClC,iBAAiB,EACjB,0BAA0B,CAC3B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,0BAA0B,CAClC,iBAAiB,EACjB,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,0BAA0B,CAClC,iBAAiB,EACjB,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,GAAG,CAAC,OAAO,EAAE,GAAG,0BAA0B,CAC3C,CAAC,WAAW,EAAE,CAAC;IAChB,MAAM,OAAO,GAAG,MAAM,mBAAmB,CACvC,EAAE,WAAW,EAAE,QAAQ,EAAE,EACzB;QACE,KAAK,EAAE,OAAO,CAAC,eAAe;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG;KACf,CACF,CAAC;IACF,MAAM,eAAe,GAAG,QAAQ,EAAE,CAAC;IACnC,MAAM,MAAM,GAAgC;QAC1C,EAAE,EAAE,eAAe;QACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,mBAAmB,EAAE,MAAM;QAC3B,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,SAAS;KACV,CAAC;IACF,MAAM,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEhD,OAAO;QACL,eAAe;QACf,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,SAAS;KACV,CAAC;AACJ,CAAC;AAeD,MAAM,UAAU,2BAA2B,CACzC,MAAmC;IAEnC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAyBD,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAwC,EACxC,OAA4C;IAE5C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,CACrD,KAAK,CAAC,eAAe,CACtB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,0BAA0B,CAClC,WAAW,EACX,2BAA2B,KAAK,CAAC,eAAe,YAAY,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,2BAA2B,KAAK,CAAC,eAAe,OAAO,MAAM,CAAC,MAAM,oBAAoB,CACzF,CAAC;IACJ,CAAC;IACD,IACE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EACzE,CAAC;QACD,MAAM,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1E,MAAM,IAAI,0BAA0B,CAClC,SAAS,EACT,iDAAiD,CAClD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,0BAA0B,CAClC,iBAAiB,EACjB,qCAAqC,CACtC,CAAC;IACJ,CAAC;IAED,MAAM,oBAAoB,CACxB,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAC3D,EAAE,KAAK,EAAE,OAAO,CAAC,eAAe,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CACrD,CAAC;IAEF,MAAM,iBAAiB,GAAG,WAAW,EAAE,CAAC;IACxC,MAAM,qBAAqB,GACzB,MAAM,6BAA6B,CAAC,iBAAiB,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5E,MAAM,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE;QACjD,MAAM,EAAE,UAAU;QAClB,UAAU;QACV,qBAAqB;KACtB,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/C,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,iBAAiB,EAAE,CAAC;AAClE,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAA8C,EAC9C,OAAkD;IAElD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,CACrD,KAAK,CAAC,eAAe,CACtB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,0BAA0B,CAClC,WAAW,EACX,2BAA2B,KAAK,CAAC,eAAe,YAAY,EAC5D,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,0BAA0B,CAClC,iBAAiB,EACjB,qCAAqC,CACtC,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,0BAA0B,CAClC,sBAAsB,EACtB,kBAAkB,MAAM,CAAC,YAAY,YAAY,EACjD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,0BAA0B,CAAC;YAC/B,UAAU;YACV,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,MAAM,EAAE,0BAA0B,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC;YACvE,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,2BAA2B,EAAE,CAAC;YAC/C,MAAM,IAAI,0BAA0B,CAClC,GAAG,CAAC,IAAI,EACR,GAAG,CAAC,OAAO,EACX,GAAG,CAAC,MAAM,IAAI,GAAG,EACjB,GAAG,CAAC,IAAI,CACT,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC;QAC5C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,IAAI,EAAE;YACJ,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D;KACF,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,0BAA0B,CAClC,uBAAuB,EACvB,wBAAwB,CAAC,WAAW,CAAC,IAAI,CAAC,EAC1C,WAAW,CAAC,MAAM,EAClB,WAAW,CAAC,IAAI,CACjB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAI,WAAW,CAAC,IAA6B,CAAC,OAAO,CAAC;IACnE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,0BAA0B,CAClC,uBAAuB,EACvB,4CAA4C,EAC5C,GAAG,EACH,WAAW,CAAC,IAAI,CACjB,CAAC;IACJ,CAAC;IAED,OAAO,4BAA4B,CACjC;QACE,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;KAC5C,EACD,OAAO,CACR,CAAC;AACJ,CAAC;AAoBD,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAA2C,EAC3C,OAA+C;IAE/C,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,IACE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EACzE,CAAC;QACD,MAAM,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1E,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,IACE,CAAC,CAAC,MAAM,cAAc,CAAC;QACrB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,iBAAiB,EAAE,MAAM,CAAC,aAAa;KACxC,CAAC,CAAC,EACH,CAAC;QACD,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,0BAA0B,CAC3B,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACzD,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,MAAM,CAC5D,MAAM,CAAC,YAAY,EACnB;QACE,SAAS;KACV,CACF,CAAC;IACF,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,mDAAmD,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE;QACjD,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;KACrE,CAAC,CAAC;IAEH,OAAO;QACL,WAAW;QACX,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,6BAA6B,CAAC,IAAY;IACvD,OAAO,mBAAmB,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAG7B;IACC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACtE,OAAO,gBAAgB,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,iBAAiB,CAAC;AAC9E,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAa;IAC7C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAA+B,CAAC;QAC/C,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5B,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,OAAO,GAAI,MAAkC,CAAC,OAAO,CAAC;YAC5D,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC;QAClD,CAAC;IACH,CAAC;IACD,OAAO,4BAA4B,CAAC;AACtC,CAAC"}

package/dist/mcp/grantee.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Per-connection MCP grantee key generation + Web3Signed request signing.
+ *
+ * Each MCP connection gets a fresh secp256k1 keypair. The PS route uses this
+ * keypair to sign every read it performs on behalf of the connection so:
+ *
+ *  1. The data read flows through `authorizeBuilderRead` exactly like any
+ *     external builder request.
+ *  2. The access log records the per-connection grantee address, not the
+ *     owner.
+ *  3. Disconnecting one MCP client cannot affect another or the owner.
+ *
+ * This module does NOT do encryption-at-rest. The caller chooses the storage
+ * representation (`McpEncryptedPrivateKey`) — for Node the `plaintext` variant
+ * is fine (same trust boundary as the on-disk server key); for Web PS Lite the
+ * caller should wrap with the owner-derived master key.
+ */
+import type { ServerAccount } from "../keys/server-account.js";
+import type { McpEncryptedPrivateKey } from "./types.js";
+export interface McpGranteeKey {
+    address: `0x${string}`;
+    publicKey: `0x${string}`;
+    encryptedPrivateKey: McpEncryptedPrivateKey;
+}
+export interface GeneratedMcpGrantee {
+    key: McpGranteeKey;
+    account: ServerAccount;
+}
+/**
+ * Generate a new MCP grantee keypair and return both the persisted
+ * (plaintext-wrapped) form and a ready-to-sign `ServerAccount`.
+ */
+export declare function generateMcpGrantee(): GeneratedMcpGrantee;
+/**
+ * Reconstruct a `ServerAccount` from a persisted MCP grantee record.
+ * Only `plaintext` is supported here; Web PS Lite must decrypt to plaintext
+ * before calling.
+ */
+export declare function loadMcpGranteeAccount(key: McpGranteeKey): ServerAccount;
+/**
+ * Build a Web3Signed Authorization header that authenticates the bearer as the
+ * MCP connection's grantee for a given grant id and request URL.
+ */
+export declare function signMcpGranteeRequest(params: {
+    account: ServerAccount;
+    aud: string;
+    method: string;
+    uri: string;
+    grantId: string;
+    body?: Uint8Array;
+}): Promise<string>;
+//# sourceMappingURL=grantee.d.ts.map

package/dist/mcp/grantee.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grantee.d.ts","sourceRoot":"","sources":["../../src/mcp/grantee.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC;IACzB,mBAAmB,EAAE,sBAAsB,CAAC;CAC7C;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,aAAa,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,mBAAmB,CA8BxD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa,CA0BvE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,OAAO,EAAE,aAAa,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB,GAAG,OAAO,CAAC,MAAM,CAAC,CASlB"}