@peac/mcp-server 0.10.13 → 0.11.2

package/dist/session-manager.d.ts

@@ -0,0 +1,59 @@
+/**
+ * MCP Session Manager -- Mcp-Session-Id lifecycle, eviction, isolation
+ *
+ * Each HTTP session gets its own McpServer + StreamableHTTPServerTransport
+ * pair. This is the primary defense against CVE-2026-25536 (cross-client
+ * response data leak when a single transport is reused across connections).
+ *
+ * INVARIANT: NEVER reuse a single transport instance across multiple
+ * client sessions. Each session is fully isolated.
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+export interface SessionEntry {
+    readonly sessionId: string;
+    readonly server: McpServer;
+    readonly transport: StreamableHTTPServerTransport;
+    readonly createdAt: number;
+    readonly clientIp: string;
+    lastSeen: number;
+}
+export interface SessionManagerOptions {
+    /** Max idle time before eviction (ms). Default: 30 min */
+    ttlMs?: number;
+    /** Max concurrent sessions. Default: 100 */
+    maxSessions?: number;
+    /** Max sessions per client IP. Default: 10 */
+    maxSessionsPerIp?: number;
+    /** Eviction sweep interval (ms). Default: 60s */
+    sweepIntervalMs?: number;
+}
+type ServerFactory = () => McpServer;
+export declare class SessionManager {
+    private readonly options;
+    private readonly sessions;
+    private readonly ipSessionCount;
+    private readonly ttlMs;
+    private readonly maxSessions;
+    private readonly maxSessionsPerIp;
+    private sweepTimer;
+    constructor(options?: SessionManagerOptions);
+    /** Start periodic eviction sweep */
+    startSweep(): void;
+    /** Create a new isolated session with its own McpServer + transport */
+    createSession(serverFactory: ServerFactory, clientIp?: string): Promise<SessionEntry>;
+    /** Look up an existing session by ID */
+    getSession(sessionId: string): SessionEntry | undefined;
+    /** Terminate and clean up a specific session */
+    terminateSession(sessionId: string): Promise<boolean>;
+    /** Terminate all sessions and stop sweep */
+    cleanup(): Promise<void>;
+    /** Get current session count */
+    get size(): number;
+    /** Evict sessions past TTL */
+    private evictStale;
+    /** Decrement per-IP session count, removing the key when it reaches 0 */
+    private decrementIpCount;
+}
+export {};
+//# sourceMappingURL=session-manager.d.ts.map

package/dist/session-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-manager.d.ts","sourceRoot":"","sources":["../src/session-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;IAClD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,KAAK,aAAa,GAAG,MAAM,SAAS,CAAC;AAErC,qBAAa,cAAc;IAQb,OAAO,CAAC,QAAQ,CAAC,OAAO;IAPpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA6B;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,UAAU,CAA6C;gBAElC,OAAO,GAAE,qBAA0B;IAMhE,oCAAoC;IACpC,UAAU,IAAI,IAAI;IAMlB,uEAAuE;IACjE,aAAa,CAAC,aAAa,EAAE,aAAa,EAAE,QAAQ,SAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAwC9F,wCAAwC;IACxC,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAQvD,gDAAgD;IAC1C,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAe3D,4CAA4C;IACtC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAsB9B,gCAAgC;IAChC,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,8BAA8B;IAC9B,OAAO,CAAC,UAAU;IAalB,yEAAyE;IACzE,OAAO,CAAC,gBAAgB;CAQzB"}

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@peac/mcp-server",
-  "version": "0.10.13",
+  "version": "0.11.2",
   "description": "PEAC receipt operations as MCP tools (verify, inspect, decode)",
+  "mcpName": "io.github.peacprotocol/peac",
   "main": "dist/index.cjs",
   "types": "dist/index.d.ts",
   "bin": {
@@ -33,7 +34,9 @@
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "server.json",
+    "smithery.yaml"
   ],
   "publishConfig": {
     "access": "public",
@@ -42,10 +45,11 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "~1.27.0",
     "commander": "^11.0.0",
-    "zod": "^3.22.4",
-    "@peac/schema": "0.10.13",
-    "@peac/protocol": "0.10.13",
-    "@peac/crypto": "0.10.13"
+    "zod": "^4.3.6",
+    "@peac/crypto": "0.11.2",
+    "@peac/schema": "0.11.2",
+    "@peac/kernel": "0.11.2",
+    "@peac/protocol": "0.11.2"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",

package/server.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.peacprotocol/peac",
+  "title": "PEAC Protocol",
+  "description": "Verify, inspect, decode, issue, and bundle PEAC receipts. Portable, offline-verifiable evidence.",
+  "repository": {
+    "url": "https://github.com/peacprotocol/peac",
+    "source": "github",
+    "subfolder": "packages/mcp-server"
+  },
+  "version": "0.11.2",
+  "websiteUrl": "https://www.peacprotocol.org",
+  "packages": [
+    {
+      "registryType": "npm",
+      "identifier": "@peac/mcp-server",
+      "version": "0.11.2",
+      "transport": {
+        "type": "stdio"
+      }
+    }
+  ]
+}

package/smithery.yaml

@@ -0,0 +1,36 @@
+# Smithery configuration for @peac/mcp-server
+# Docs: https://smithery.ai/docs/build/project-config
+# Transport: stdio (local install via npm). Streamable HTTP gateway path
+# planned for future release (server already supports --transport http).
+
+startCommand:
+  type: stdio
+  configSchema:
+    type: object
+    properties:
+      issuerKey:
+        type: string
+        description: >
+          Ed25519 JWK for receipt issuance (optional; read-only tools
+          work without it). Pass as env:VAR or file:/path.
+      issuerId:
+        type: string
+        description: 'Issuer URI (e.g., https://your-service.example.com)'
+      bundleDir:
+        type: string
+        description: Directory for evidence bundle output (optional)
+      jwksFile:
+        type: string
+        description: JWKS file for verifier key resolution (optional)
+  commandFunction: |-
+    (config) => {
+      const args = ['-y', '@peac/mcp-server'];
+      if (config.issuerKey) { args.push('--issuer-key', config.issuerKey); }
+      if (config.issuerId) { args.push('--issuer-id', config.issuerId); }
+      if (config.bundleDir) { args.push('--bundle-dir', config.bundleDir); }
+      if (config.jwksFile) { args.push('--jwks-file', config.jwksFile); }
+      return { command: 'npx', args };
+    }
+  exampleConfig:
+    issuerKey: 'env:PEAC_ISSUER_KEY'
+    issuerId: 'https://your-service.example.com'