@paybond/kit 0.9.8 → 0.11.0

package/dist/mcp-sep2828-evidence.js

@@ -0,0 +1,65 @@
+/**
+ * Maps SEP-2828-style MCP decision/outcome execution records into artifact_attested evidence.
+ *
+ * Wire shapes follow the draft SEP-2828 pairing model: decision record (pre-side-effect) and
+ * outcome record (post-execution) linked via backLink and outcomeDerived.decisionDigest.
+ */
+import { verifySep2828ReceiptPair } from "./sep2828-signature.js";
+function readObject(value) {
+    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+        return value;
+    }
+    return undefined;
+}
+function readBackLink(record) {
+    const backLink = readObject(record.backLink);
+    if (!backLink) {
+        return undefined;
+    }
+    const digest = backLink.attestationDigest;
+    if (typeof digest !== "string" || digest.length === 0) {
+        return undefined;
+    }
+    const nonce = backLink.attestationNonce;
+    return {
+        attestationDigest: digest,
+        attestationNonce: typeof nonce === "string" ? nonce : undefined,
+    };
+}
+/** Strips sha256:/blake3: prefixes so digests fit artifact_blake3_hex entries. */
+export function stripDigestPrefix(digest) {
+    return digest.replace(/^(sha256|blake3):/i, "");
+}
+function pushDigest(hashes, digest) {
+    if (typeof digest !== "string" || digest.length === 0) {
+        return;
+    }
+    const normalized = stripDigestPrefix(digest);
+    if (!hashes.includes(normalized)) {
+        hashes.push(normalized);
+    }
+}
+/**
+ * Converts paired SEP-2828 decision and outcome records into artifact_attested evidence fields.
+ */
+export function mapSep2828ReceiptsToArtifactAttestedEvidence(decisionInput, outcomeInput) {
+    verifySep2828ReceiptPair(decisionInput, outcomeInput);
+    const outcomeDerived = readObject(outcomeInput.outcomeDerived);
+    const status = typeof outcomeDerived?.status === "string" ? outcomeDerived.status : "";
+    const operation = status === "executed" ? "attested" : "pending";
+    const backLink = readBackLink(outcomeInput) ?? readBackLink(decisionInput);
+    const hashes = [];
+    if (outcomeDerived) {
+        pushDigest(hashes, outcomeDerived.decisionDigest);
+        pushDigest(hashes, outcomeDerived.resultCommitment);
+    }
+    if (hashes.length === 0 && backLink) {
+        pushDigest(hashes, backLink.attestationDigest);
+    }
+    const vendorRef = backLink?.attestationDigest ?? "mcp-unknown";
+    return {
+        artifact_blake3_hex: hashes,
+        operation,
+        vendor_ref_id: vendorRef,
+    };
+}

package/dist/mcp-server.d.ts

@@ -1,4 +1,8 @@
 #!/usr/bin/env node
+import { type McpToolPolicyConfig } from "./cli/mcp-policy.js";
+import { type McpEvidencePolicy } from "./mcp-evidence-policy.js";
+import { type McpCapabilityTokenCacheConfig } from "./mcp-capability-token-cache.js";
+import { type McpPolicyReloadConfig } from "./mcp-policy-reload.js";
 type JSONRPCID = string | number | null;
 type JSONRPCRequest = {
     jsonrpc?: unknown;
@@ -28,10 +32,16 @@ export type PaybondMCPSettings = {
     gatewayBaseUrl?: string;
     principalPath?: string;
     maxRetries?: number;
+    toolPolicy?: McpToolPolicyConfig;
+    evidencePolicy?: McpEvidencePolicy;
+    policyReload?: McpPolicyReloadConfig | null;
+    capabilityTokenCache?: McpCapabilityTokenCacheConfig;
 };
+export declare function formatMcpStdioFrame(response: JSONRPCResponse): string;
 export declare class PaybondMCPServer {
     private readonly runtime;
     private readonly tools;
+    private readonly toolPolicy;
     private initialized;
     constructor(settings: PaybondMCPSettings);
     listTools(): Array<Record<string, unknown>>;