@peac/mcp-server 0.10.13

package/dist/index.mjs

@@ -0,0 +1,1623 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { verifyLocal, issue, IssueError } from '@peac/protocol';
+import { base64urlDecode, decode, sha256Hex, sign, validateKeypair, derivePublicKey, base64urlEncode } from '@peac/crypto';
+import { readFile, mkdir, rename, rm, mkdtemp, writeFile, stat, lstat } from 'fs/promises';
+import { parseReceiptClaims } from '@peac/schema';
+import * as nodePath from 'path';
+import { join } from 'path';
+import { randomUUID } from 'crypto';
+import { z } from 'zod';
+
+// src/server.ts
+
+// src/infra/constants.ts
+var SERVER_NAME = "peac-mcp-server";
+var SERVER_VERSION = "0.10.12";
+var MCP_PROTOCOL_VERSION = "2025-11-25";
+var DEFAULT_MAX_JWS_BYTES = 16384;
+var DEFAULT_MAX_RESPONSE_BYTES = 65536;
+var DEFAULT_TOOL_TIMEOUT_MS = 3e4;
+var DEFAULT_MAX_CLAIMS_BYTES = 262144;
+var DEFAULT_MAX_BUNDLE_RECEIPTS = 256;
+var DEFAULT_MAX_BUNDLE_BYTES = 16777216;
+var DEFAULT_MAX_TTL_SECONDS = 86400;
+
+// src/infra/errors.ts
+var McpServerError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "McpServerError";
+    this.code = code;
+  }
+};
+var KeyLoadError = class extends McpServerError {
+  constructor(message) {
+    super("E_MCP_KEY_LOAD", message);
+    this.name = "KeyLoadError";
+  }
+};
+var PolicyLoadError = class extends McpServerError {
+  constructor(message) {
+    super("E_MCP_POLICY_LOAD", message);
+    this.name = "PolicyLoadError";
+  }
+};
+var JwksLoadError = class extends McpServerError {
+  constructor(message) {
+    super("E_MCP_JWKS_LOAD", message);
+    this.name = "JwksLoadError";
+  }
+};
+var IssueToolError = class extends McpServerError {
+  constructor(message) {
+    super("E_MCP_ISSUE_FAILED", message);
+    this.name = "IssueToolError";
+  }
+};
+var BundleToolError = class extends McpServerError {
+  constructor(message) {
+    super("E_MCP_BUNDLE_FAILED", message);
+    this.name = "BundleToolError";
+  }
+};
+var PathTraversalError = class extends McpServerError {
+  constructor(message) {
+    super("E_MCP_PATH_TRAVERSAL", message);
+    this.name = "PathTraversalError";
+  }
+};
+function sanitizeOutput(text, sensitivePatterns) {
+  let result = text;
+  for (const pattern of sensitivePatterns) {
+    result = result.replace(pattern, "[REDACTED]");
+  }
+  return result;
+}
+
+// src/infra/jwks-loader.ts
+async function loadJwksFile(filePath) {
+  let raw;
+  try {
+    raw = await readFile(filePath, "utf-8");
+  } catch (err) {
+    throw new JwksLoadError(
+      `Failed to read JWKS file: ${filePath} -- ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new JwksLoadError(`JWKS file is not valid JSON: ${filePath}`);
+  }
+  if (typeof parsed !== "object" || parsed === null || !("keys" in parsed)) {
+    throw new JwksLoadError('JWKS must contain a "keys" array');
+  }
+  const jwks = parsed;
+  if (!Array.isArray(jwks.keys)) {
+    throw new JwksLoadError('JWKS "keys" must be an array');
+  }
+  const entries = [];
+  for (const key of jwks.keys) {
+    if (typeof key !== "object" || key === null) continue;
+    const k = key;
+    if (k.kty !== "OKP" || k.crv !== "Ed25519") continue;
+    if (typeof k.x !== "string") continue;
+    if (k.alg !== void 0 && k.alg !== "EdDSA") continue;
+    const kid = typeof k.kid === "string" ? k.kid : `key-${entries.length}`;
+    try {
+      const publicKey = base64urlDecode(k.x);
+      if (publicKey.length === 32) {
+        entries.push({ kid, publicKey });
+      }
+    } catch {
+    }
+  }
+  return entries;
+}
+function resolveKeyByKid(keys, kid) {
+  const entry = keys.find((k) => k.kid === kid);
+  return entry?.publicKey;
+}
+
+// src/handlers/guards.ts
+function checkJwsSize(jws, policy) {
+  const byteLength = new TextEncoder().encode(jws).length;
+  if (byteLength > policy.limits.max_jws_bytes) {
+    return {
+      text: `Input rejected: JWS is ${byteLength} bytes, exceeding limit of ${policy.limits.max_jws_bytes} bytes`,
+      structured: {
+        ok: false,
+        code: "E_MCP_INPUT_TOO_LARGE",
+        message: `JWS input is ${byteLength} bytes, limit is ${policy.limits.max_jws_bytes}`
+      },
+      isError: true
+    };
+  }
+  return void 0;
+}
+function checkToolEnabled(toolName, policy) {
+  const toolConfig = policy.tools[toolName];
+  if (toolConfig && toolConfig.enabled === false) {
+    return {
+      text: `Tool "${toolName}" is disabled by server policy`,
+      structured: {
+        ok: false,
+        code: "E_MCP_TOOL_DISABLED",
+        message: `Tool "${toolName}" is disabled by server policy`
+      },
+      isError: true
+    };
+  }
+  return void 0;
+}
+function sumStringBytes(value, seen) {
+  if (typeof value === "string") {
+    return new TextEncoder().encode(value).length;
+  }
+  if (typeof value !== "object" || value === null) return 0;
+  const visited = seen ?? /* @__PURE__ */ new WeakSet();
+  if (visited.has(value)) return 0;
+  visited.add(value);
+  if (Array.isArray(value)) {
+    let total2 = 0;
+    for (const item of value) {
+      total2 += sumStringBytes(item, visited);
+    }
+    return total2;
+  }
+  let total = 0;
+  for (const v of Object.values(value)) {
+    total += sumStringBytes(v, visited);
+  }
+  return total;
+}
+function estimateSerializedBytes(value, limit, seen) {
+  if (value === null) return 4;
+  if (value === void 0) return 0;
+  if (typeof value === "boolean") return value ? 4 : 5;
+  if (typeof value === "number") return String(value).length;
+  if (typeof value === "string") return Buffer.byteLength(JSON.stringify(value), "utf8");
+  if (typeof value !== "object") return 0;
+  const visited = seen ?? /* @__PURE__ */ new WeakSet();
+  if (visited.has(value)) return 0;
+  visited.add(value);
+  let total = 2;
+  if (Array.isArray(value)) {
+    for (let i = 0; i < value.length; i++) {
+      if (i > 0) total += 1;
+      total += estimateSerializedBytes(value[i], limit, visited);
+      if (total > limit) return Infinity;
+    }
+    return total;
+  }
+  const entries = Object.entries(value);
+  for (let i = 0; i < entries.length; i++) {
+    if (i > 0) total += 1;
+    const [k, v] = entries[i];
+    total += Buffer.byteLength(JSON.stringify(k), "utf8") + 1;
+    total += estimateSerializedBytes(v, limit, visited);
+    if (total > limit) return Infinity;
+  }
+  return total;
+}
+function checkInputSizes(input, policy) {
+  const limit = policy.limits.max_jws_bytes * 2;
+  const totalBytes = sumStringBytes(input);
+  if (totalBytes > limit) {
+    return {
+      text: `Input rejected: total input is ${totalBytes} bytes, exceeding limit of ${limit} bytes`,
+      structured: {
+        ok: false,
+        code: "E_MCP_INPUT_TOO_LARGE",
+        message: `Total input is ${totalBytes} bytes, limit is ${limit}`
+      },
+      isError: true
+    };
+  }
+  const estimatedBytes = estimateSerializedBytes(input, limit);
+  if (estimatedBytes > limit) {
+    return {
+      text: `Input rejected: estimated serialized input exceeds limit of ${limit} bytes`,
+      structured: {
+        ok: false,
+        code: "E_MCP_INPUT_TOO_LARGE",
+        message: `Estimated serialized input exceeds limit of ${limit} bytes`
+      },
+      isError: true
+    };
+  }
+  return void 0;
+}
+function checkObjectDepth(obj, maxDepth = 10, currentDepth = 0) {
+  if (currentDepth > maxDepth) return false;
+  if (typeof obj !== "object" || obj === null) return true;
+  if (Array.isArray(obj)) {
+    return obj.every((item) => checkObjectDepth(item, maxDepth, currentDepth + 1));
+  }
+  return Object.values(obj).every(
+    (value) => checkObjectDepth(value, maxDepth, currentDepth + 1)
+  );
+}
+var CONSERVATIVE_ID_PLACEHOLDER = "00000000-0000-0000-0000-000000000000";
+function measureEnvelopeBytes(callToolResult, id = CONSERVATIVE_ID_PLACEHOLDER) {
+  const envelope = {
+    jsonrpc: "2.0",
+    id,
+    result: {
+      content: callToolResult.content,
+      structuredContent: callToolResult.structuredContent,
+      isError: callToolResult.isError
+    }
+  };
+  return Buffer.byteLength(JSON.stringify(envelope), "utf8") + 1;
+}
+var TRUNCATION_SUFFIX = "\n\n[TRUNCATED: response exceeded policy limit]";
+var TRUNCATION_SUFFIX_BYTES = new TextEncoder().encode(TRUNCATION_SUFFIX).length;
+function truncateResponse(text, policy) {
+  const maxBytes = policy.limits.max_response_bytes;
+  const encoded = new TextEncoder().encode(text);
+  if (encoded.length <= maxBytes) {
+    return { text, truncated: false, originalBytes: encoded.length, returnedBytes: encoded.length };
+  }
+  const bodyBudget = Math.max(0, maxBytes - TRUNCATION_SUFFIX_BYTES);
+  const truncatedText = new TextDecoder().decode(encoded.slice(0, bodyBudget));
+  const finalText = truncatedText + TRUNCATION_SUFFIX;
+  const finalEncoded = new TextEncoder().encode(finalText);
+  return {
+    text: finalText,
+    truncated: true,
+    originalBytes: encoded.length,
+    returnedBytes: finalEncoded.length
+  };
+}
+
+// src/handlers/verify.ts
+function resolvePublicKey(params) {
+  const { input, context } = params;
+  if (input.public_key_base64url) {
+    return {
+      publicKey: base64urlDecode(input.public_key_base64url),
+      keySource: "inline"
+    };
+  }
+  if (input.jwks) {
+    const jwks = JSON.parse(input.jwks);
+    if (!jwks.keys?.length) {
+      throw new Error("Provided JWKS contains no keys");
+    }
+    const { header } = decode(input.jws);
+    const kid = header.kid;
+    const ed25519Keys = jwks.keys.filter(
+      (k) => k.kty === "OKP" && k.crv === "Ed25519" && typeof k.x === "string" && (k.alg === void 0 || k.alg === "EdDSA")
+    );
+    if (ed25519Keys.length === 0) {
+      throw new Error("Provided JWKS contains no Ed25519 keys");
+    }
+    if (kid) {
+      const matched = ed25519Keys.find((k) => k.kid === kid);
+      if (matched) {
+        return {
+          publicKey: base64urlDecode(matched.x),
+          keySource: "inline-jwks"
+        };
+      }
+      throw Object.assign(
+        new Error(`No matching Ed25519 key found in provided JWKS for kid="${kid}"`),
+        { errorCode: "E_MCP_JWKS_NO_MATCH" }
+      );
+    }
+    if (ed25519Keys.length === 1) {
+      return {
+        publicKey: base64urlDecode(ed25519Keys[0].x),
+        keySource: "inline-jwks"
+      };
+    }
+    throw Object.assign(
+      new Error(
+        `JWS has no kid and JWKS contains ${ed25519Keys.length} Ed25519 keys -- provide kid to select`
+      ),
+      { errorCode: "E_MCP_KID_REQUIRED" }
+    );
+  }
+  if (context.jwksKeys?.length) {
+    const { header } = decode(input.jws);
+    const kid = header.kid;
+    if (kid) {
+      const key = resolveKeyByKid(context.jwksKeys, kid);
+      if (key) {
+        return { publicKey: key, keySource: "server-jwks" };
+      }
+      throw Object.assign(new Error(`No matching key in server JWKS for kid="${kid}"`), {
+        errorCode: "E_MCP_JWKS_NO_MATCH"
+      });
+    }
+    if (context.jwksKeys.length === 1) {
+      return { publicKey: context.jwksKeys[0].publicKey, keySource: "server-jwks" };
+    }
+    throw Object.assign(
+      new Error(
+        `JWS has no kid and server JWKS contains ${context.jwksKeys.length} keys -- provide kid to select`
+      ),
+      { errorCode: "E_MCP_KID_REQUIRED" }
+    );
+  }
+  throw Object.assign(
+    new Error(
+      "No public key available: provide public_key_base64url, jwks, or configure --jwks-file"
+    ),
+    { errorCode: "E_MCP_KEY_RESOLUTION" }
+  );
+}
+async function handleVerify(params) {
+  const { input, policy } = params;
+  const disabledResult = checkToolEnabled("peac_verify", policy);
+  if (disabledResult) return disabledResult;
+  const sizeResult = checkJwsSize(input.jws, policy);
+  if (sizeResult) return sizeResult;
+  let publicKey;
+  let keySource;
+  try {
+    const resolved = resolvePublicKey(params);
+    publicKey = resolved.publicKey;
+    keySource = resolved.keySource;
+  } catch (err) {
+    const code = err.errorCode ?? "E_MCP_KEY_RESOLUTION";
+    return {
+      text: `Verification failed: ${err instanceof Error ? err.message : String(err)}`,
+      structured: {
+        ok: false,
+        code,
+        message: err instanceof Error ? err.message : String(err),
+        checks: []
+      },
+      isError: true
+    };
+  }
+  const result = await verifyLocal(input.jws, publicKey, {
+    issuer: input.issuer,
+    audience: input.audience
+  });
+  if (result.valid) {
+    const checks2 = [
+      { name: "signature", passed: true },
+      { name: "schema", passed: true },
+      { name: "expiry", passed: true }
+    ];
+    if (input.issuer) {
+      checks2.push({ name: "issuer_binding", passed: true });
+    }
+    if (input.audience) {
+      checks2.push({ name: "audience_binding", passed: true });
+    }
+    const claims = result.claims;
+    const claimsSummary = {
+      iss: claims.iss,
+      aud: claims.aud,
+      rid: claims.rid,
+      variant: result.variant
+    };
+    if (result.variant === "commerce") {
+      claimsSummary.amt = claims.amt;
+      claimsSummary.cur = claims.cur;
+    }
+    const tr = truncateResponse(
+      `Verification PASSED (${result.variant} receipt, kid=${result.kid})`,
+      policy
+    );
+    return {
+      text: tr.text,
+      structured: {
+        ok: true,
+        variant: result.variant,
+        checks: checks2,
+        claimsSummary,
+        keySource,
+        ...tr.truncated ? {
+          _truncation: {
+            truncated: tr.truncated,
+            originalBytes: tr.originalBytes,
+            returnedBytes: tr.returnedBytes
+          }
+        } : {}
+      }
+    };
+  }
+  const checks = [];
+  if (result.code === "E_INVALID_SIGNATURE") {
+    checks.push({ name: "signature", passed: false, message: result.message });
+  } else if (result.code === "E_INVALID_FORMAT") {
+    checks.push({ name: "signature", passed: true });
+    checks.push({ name: "schema", passed: false, message: result.message });
+  } else if (result.code === "E_EXPIRED") {
+    checks.push({ name: "signature", passed: true });
+    checks.push({ name: "schema", passed: true });
+    checks.push({ name: "expiry", passed: false, message: result.message });
+  } else if (result.code === "E_INVALID_ISSUER") {
+    checks.push({ name: "signature", passed: true });
+    checks.push({ name: "schema", passed: true });
+    checks.push({ name: "issuer_binding", passed: false, message: result.message });
+  } else if (result.code === "E_INVALID_AUDIENCE") {
+    checks.push({ name: "signature", passed: true });
+    checks.push({ name: "schema", passed: true });
+    checks.push({ name: "audience_binding", passed: false, message: result.message });
+  } else {
+    checks.push({ name: result.code, passed: false, message: result.message });
+  }
+  const trFail = truncateResponse(
+    `Verification FAILED: ${result.code} -- ${result.message}`,
+    policy
+  );
+  return {
+    text: trFail.text,
+    structured: {
+      ok: false,
+      code: result.code,
+      message: result.message,
+      checks,
+      keySource,
+      ...trFail.truncated ? {
+        _truncation: {
+          truncated: trFail.truncated,
+          originalBytes: trFail.originalBytes,
+          returnedBytes: trFail.returnedBytes
+        }
+      } : {}
+    }
+  };
+}
+async function handleInspect(params) {
+  const { input, policy } = params;
+  const disabledResult = checkToolEnabled("peac_inspect", policy);
+  if (disabledResult) return disabledResult;
+  const sizeResult = checkJwsSize(input.jws, policy);
+  if (sizeResult) return sizeResult;
+  let header;
+  let payload;
+  try {
+    const decoded = decode(input.jws);
+    header = decoded.header;
+    payload = decoded.payload;
+  } catch (err) {
+    return {
+      text: `Inspect failed: ${err instanceof Error ? err.message : String(err)}`,
+      structured: {
+        error: err instanceof Error ? err.message : String(err),
+        code: "E_MCP_INVALID_INPUT"
+      },
+      isError: true
+    };
+  }
+  let variant = "unknown";
+  try {
+    const pr = parseReceiptClaims(payload);
+    if (pr.ok) {
+      variant = pr.variant;
+    }
+  } catch {
+  }
+  const payloadMeta = {
+    variant,
+    issuer: payload.iss,
+    audience: payload.aud
+  };
+  if (typeof payload.iat === "number") {
+    payloadMeta.issuedAt = new Date(payload.iat * 1e3).toISOString();
+  }
+  if (typeof payload.exp === "number") {
+    payloadMeta.expiresAt = new Date(payload.exp * 1e3).toISOString();
+  }
+  if (typeof payload.rid === "string") {
+    payloadMeta.receiptId = payload.rid;
+  }
+  let redacted = false;
+  let fullPayload;
+  const effectiveFullClaims = input.full_claims && policy.redaction.inspect_full_claims;
+  if (effectiveFullClaims) {
+    fullPayload = { ...payload };
+    if (policy.redaction.strip_evidence && "evidence" in fullPayload) {
+      fullPayload.evidence = "[REDACTED by policy]";
+      redacted = true;
+    }
+    if (policy.redaction.strip_payment && "payment" in fullPayload) {
+      fullPayload.payment = "[REDACTED by policy]";
+      redacted = true;
+    }
+  }
+  const lines = [
+    "WARNING: Signature NOT verified (use peac_verify to verify)",
+    "",
+    `Variant: ${variant}`,
+    `Issuer: ${payload.iss ?? "N/A"}`,
+    `Audience: ${payload.aud ?? "N/A"}`
+  ];
+  if (payloadMeta.issuedAt) lines.push(`Issued At: ${payloadMeta.issuedAt}`);
+  if (payloadMeta.expiresAt) lines.push(`Expires At: ${payloadMeta.expiresAt}`);
+  if (payloadMeta.receiptId) lines.push(`Receipt ID: ${payloadMeta.receiptId}`);
+  if (redacted) lines.push("", "Note: Some fields redacted by policy");
+  const tr = truncateResponse(lines.join("\n"), policy);
+  return {
+    text: tr.text,
+    structured: {
+      header,
+      payloadMeta,
+      ...fullPayload !== void 0 ? { fullPayload } : {},
+      redacted,
+      verified: false,
+      ...tr.truncated ? {
+        _truncation: {
+          truncated: tr.truncated,
+          originalBytes: tr.originalBytes,
+          returnedBytes: tr.returnedBytes
+        }
+      } : {}
+    }
+  };
+}
+async function handleDecode(params) {
+  const { input, policy } = params;
+  const disabledResult = checkToolEnabled("peac_decode", policy);
+  if (disabledResult) return disabledResult;
+  const sizeResult = checkJwsSize(input.jws, policy);
+  if (sizeResult) return sizeResult;
+  try {
+    const decoded = decode(input.jws);
+    const header = decoded.header;
+    const payload = decoded.payload;
+    const tr = truncateResponse(
+      [
+        "WARNING: Signature NOT verified",
+        "",
+        `Header: ${JSON.stringify(header, null, 2)}`,
+        "",
+        `Payload: ${JSON.stringify(payload, null, 2)}`
+      ].join("\n"),
+      policy
+    );
+    return {
+      text: tr.text,
+      structured: {
+        header,
+        payload,
+        verified: false,
+        ...tr.truncated ? {
+          _truncation: {
+            truncated: tr.truncated,
+            originalBytes: tr.originalBytes,
+            returnedBytes: tr.returnedBytes
+          }
+        } : {}
+      }
+    };
+  } catch (err) {
+    return {
+      text: `Decode failed: ${err instanceof Error ? err.message : String(err)}`,
+      structured: {
+        error: err instanceof Error ? err.message : String(err),
+        code: "E_MCP_INVALID_INPUT"
+      },
+      isError: true
+    };
+  }
+}
+function buildKeyPatterns(privateKey, publicKey) {
+  const privB64 = base64urlEncode(privateKey);
+  const pubB64 = base64urlEncode(publicKey);
+  const escPriv = privB64.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const escPub = pubB64.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return [new RegExp(escPriv, "g"), new RegExp(escPub, "g")];
+}
+async function handleIssue(params) {
+  const { input, policy, context } = params;
+  const disabledResult = checkToolEnabled("peac_issue", policy);
+  if (disabledResult) return disabledResult;
+  if (!context.issuerKey || !context.issuerId) {
+    return {
+      text: "Issue failed: server not configured with issuer key and ID (--issuer-key + --issuer-id)",
+      structured: {
+        ok: false,
+        code: "E_MCP_KEY_REQUIRED",
+        message: "Server requires --issuer-key and --issuer-id for peac_issue"
+      },
+      isError: true
+    };
+  }
+  const inputJson = JSON.stringify(input);
+  const inputBytes = new TextEncoder().encode(inputJson).length;
+  if (inputBytes > policy.limits.max_claims_bytes) {
+    return {
+      text: `Input rejected: claims are ${inputBytes} bytes, exceeding limit of ${policy.limits.max_claims_bytes} bytes`,
+      structured: {
+        ok: false,
+        code: "E_MCP_INPUT_TOO_LARGE",
+        message: `Claims input is ${inputBytes} bytes, limit is ${policy.limits.max_claims_bytes}`
+      },
+      isError: true
+    };
+  }
+  if (input.ttl_seconds !== void 0 && input.ttl_seconds > policy.limits.max_ttl_seconds) {
+    return {
+      text: `Input rejected: ttl_seconds ${input.ttl_seconds} exceeds max_ttl_seconds ${policy.limits.max_ttl_seconds}`,
+      structured: {
+        ok: false,
+        code: "E_MCP_INVALID_INPUT",
+        message: `ttl_seconds ${input.ttl_seconds} exceeds policy max of ${policy.limits.max_ttl_seconds}`
+      },
+      isError: true
+    };
+  }
+  const keyPatterns = buildKeyPatterns(context.issuerKey.privateKey, context.issuerKey.publicKey);
+  const now = Math.floor(Date.now() / 1e3);
+  const exp = input.ttl_seconds !== void 0 ? now + input.ttl_seconds : void 0;
+  try {
+    const result = await issue({
+      iss: context.issuerId,
+      aud: input.aud,
+      amt: input.amt,
+      cur: input.cur,
+      rail: input.rail,
+      reference: input.reference,
+      asset: input.asset,
+      env: input.env,
+      network: input.network,
+      evidence: input.evidence,
+      subject: input.subject,
+      exp,
+      privateKey: context.issuerKey.privateKey,
+      kid: context.issuerKey.kid
+    });
+    const { payload } = decode(result.jws);
+    const claimsSummary = {
+      iss: payload.iss,
+      aud: payload.aud,
+      iat: payload.iat,
+      ...payload.exp !== void 0 ? { exp: payload.exp } : {},
+      rid: payload.rid,
+      amt: payload.amt,
+      cur: payload.cur
+    };
+    const tr = truncateResponse(
+      `Receipt issued: rid=${claimsSummary.rid}, ${claimsSummary.amt} ${claimsSummary.cur}`,
+      policy
+    );
+    const safeText = sanitizeOutput(tr.text, keyPatterns);
+    return {
+      text: safeText,
+      structured: {
+        ok: true,
+        jws: result.jws,
+        claimsSummary
+      }
+    };
+  } catch (err) {
+    const rawMessage = err instanceof Error ? err.message : String(err);
+    const safeMessage = sanitizeOutput(rawMessage, keyPatterns);
+    if (err instanceof IssueError) {
+      return {
+        text: `Issue failed: ${safeMessage}`,
+        structured: {
+          ok: false,
+          code: "E_MCP_ISSUE_FAILED",
+          message: safeMessage
+        },
+        isError: true
+      };
+    }
+    if (err instanceof McpServerError) {
+      return {
+        text: `Issue failed: ${safeMessage}`,
+        structured: {
+          ok: false,
+          code: err.code,
+          message: safeMessage
+        },
+        isError: true
+      };
+    }
+    return {
+      text: `Issue failed: ${safeMessage}`,
+      structured: {
+        ok: false,
+        code: "E_MCP_ISSUE_FAILED",
+        message: safeMessage
+      },
+      isError: true
+    };
+  }
+}
+function assertRelativePath(p) {
+  if (!p || p.trim().length === 0) {
+    throw new PathTraversalError("Path must not be empty");
+  }
+  if (nodePath.isAbsolute(p)) {
+    throw new PathTraversalError("Absolute paths are not allowed");
+  }
+  const normalized = nodePath.normalize(p);
+  if (normalized.startsWith("..") || normalized.includes("/..") || normalized.includes("\\..")) {
+    throw new PathTraversalError("Path traversal (..) is not allowed");
+  }
+  if (p.includes("/") || p.includes("\\")) {
+    throw new PathTraversalError("Nested directories are not allowed (single segment only)");
+  }
+  if (p.length > 255) {
+    throw new PathTraversalError(`Path segment exceeds 255 characters (got ${p.length})`);
+  }
+  if (p.startsWith(".")) {
+    throw new PathTraversalError("Hidden paths (starting with .) are not allowed");
+  }
+}
+function resolveOutputPath(basePath, relativePath) {
+  assertRelativePath(relativePath);
+  const normalizedBase = nodePath.resolve(basePath);
+  const resolved = nodePath.resolve(normalizedBase, relativePath);
+  const rel = nodePath.relative(normalizedBase, resolved);
+  if (rel.startsWith("..") || rel.startsWith("/") || nodePath.isAbsolute(rel)) {
+    throw new PathTraversalError("Resolved path escapes base directory");
+  }
+  return resolved;
+}
+async function assertNotSymlink(componentPath) {
+  try {
+    const stats = await lstat(componentPath);
+    if (stats.isSymbolicLink()) {
+      throw new PathTraversalError(`Symlink detected at ${componentPath}`);
+    }
+  } catch (err) {
+    if (err instanceof PathTraversalError) throw err;
+    if (err.code === "ENOENT") return;
+    throw err;
+  }
+}
+async function safeMkdir(basePath, relativePath) {
+  const resolved = resolveOutputPath(basePath, relativePath);
+  await assertNotSymlink(basePath);
+  await assertNotSymlink(resolved);
+  await mkdir(resolved, { recursive: false, mode: 448 });
+  return resolved;
+}
+async function atomicWriteDir(tempDir, finalPath) {
+  try {
+    await rename(tempDir, finalPath);
+  } catch (err) {
+    try {
+      await rm(tempDir, { recursive: true, force: true });
+    } catch {
+    }
+    throw err;
+  }
+}
+async function createTempDir(basePath) {
+  await assertNotSymlink(basePath);
+  const prefix = nodePath.join(basePath, `.tmp-${randomUUID().slice(0, 8)}-`);
+  return mkdtemp(prefix);
+}
+
+// src/handlers/bundle.ts
+function stableJsonStringify(value) {
+  return JSON.stringify(
+    value,
+    (_key, val) => {
+      if (val !== null && typeof val === "object" && !Array.isArray(val)) {
+        const sorted = {};
+        for (const k of Object.keys(val).sort()) {
+          sorted[k] = val[k];
+        }
+        return sorted;
+      }
+      return val;
+    },
+    2
+  ) + "\n";
+}
+function buildKeyPatterns2(privateKey, publicKey) {
+  const privB64 = base64urlEncode(privateKey);
+  const pubB64 = base64urlEncode(publicKey);
+  const escPriv = privB64.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const escPub = pubB64.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return [new RegExp(escPriv, "g"), new RegExp(escPub, "g")];
+}
+function generateBundleName() {
+  const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const rand = randomUUID().slice(0, 8);
+  return `bundle-${ts}-${rand}`;
+}
+async function handleCreateBundle(params) {
+  const { input, policy, context } = params;
+  const disabledResult = checkToolEnabled("peac_create_bundle", policy);
+  if (disabledResult) return disabledResult;
+  if (!context.bundleDir) {
+    return {
+      text: "Bundle creation failed: server not configured with --bundle-dir",
+      structured: {
+        ok: false,
+        code: "E_MCP_BUNDLE_DIR_REQUIRED",
+        message: "Server requires --bundle-dir for peac_create_bundle"
+      },
+      isError: true
+    };
+  }
+  if (!context.issuerKey || !context.issuerId) {
+    return {
+      text: "Bundle creation failed: server not configured with issuer key and ID",
+      structured: {
+        ok: false,
+        code: "E_MCP_KEY_REQUIRED",
+        message: "Server requires --issuer-key and --issuer-id for peac_create_bundle"
+      },
+      isError: true
+    };
+  }
+  if (input.receipts.length > policy.limits.max_bundle_receipts) {
+    return {
+      text: `Input rejected: ${input.receipts.length} receipts exceeds limit of ${policy.limits.max_bundle_receipts}`,
+      structured: {
+        ok: false,
+        code: "E_MCP_INPUT_TOO_LARGE",
+        message: `${input.receipts.length} receipts exceeds limit of ${policy.limits.max_bundle_receipts}`
+      },
+      isError: true
+    };
+  }
+  let totalReceiptBytes = 0;
+  for (const r of input.receipts) {
+    totalReceiptBytes += new TextEncoder().encode(r).length;
+  }
+  if (totalReceiptBytes > policy.limits.max_bundle_bytes) {
+    return {
+      text: `Input rejected: total receipt bytes ${totalReceiptBytes} exceeds limit of ${policy.limits.max_bundle_bytes}`,
+      structured: {
+        ok: false,
+        code: "E_MCP_INPUT_TOO_LARGE",
+        message: `Total receipt bytes ${totalReceiptBytes} exceeds limit of ${policy.limits.max_bundle_bytes}`
+      },
+      isError: true
+    };
+  }
+  const outputName = input.output_path ?? generateBundleName();
+  try {
+    assertRelativePath(outputName);
+  } catch (err) {
+    return {
+      text: `Bundle creation failed: ${err instanceof Error ? err.message : String(err)}`,
+      structured: {
+        ok: false,
+        code: "E_MCP_PATH_TRAVERSAL",
+        message: err instanceof Error ? err.message : String(err)
+      },
+      isError: true
+    };
+  }
+  const keyPatterns = buildKeyPatterns2(context.issuerKey.privateKey, context.issuerKey.publicKey);
+  let tempDir;
+  try {
+    tempDir = await createTempDir(context.bundleDir);
+    const receiptsDir = join(tempDir, "receipts");
+    await mkdir(receiptsDir, { mode: 448 });
+    const entries = [];
+    let totalBytes = 0;
+    const seenHashes = /* @__PURE__ */ new Set();
+    const receiptHashes = [];
+    for (let i = 0; i < input.receipts.length; i++) {
+      if (params.signal?.aborted) {
+        throw new McpServerError("E_MCP_CANCELLED", "Request cancelled during bundle creation");
+      }
+      const jws = input.receipts[i];
+      const data = new TextEncoder().encode(jws);
+      const hash = await sha256Hex(data);
+      if (seenHashes.has(hash)) continue;
+      seenHashes.add(hash);
+      receiptHashes.push(hash);
+      const fileName = `${hash}.jws`;
+      const filePath = join(receiptsDir, fileName);
+      await writeFile(filePath, data, { mode: 384 });
+      entries.push({
+        index: i,
+        file: `receipts/${fileName}`,
+        sha256: hash,
+        length: data.length
+      });
+      totalBytes += data.length;
+    }
+    entries.sort((a, b) => a.sha256.localeCompare(b.sha256));
+    const sortedHashes = [...receiptHashes].sort();
+    const bundleIdInput = `${context.policyHash}:${sortedHashes.join(":")}`;
+    const bundleId = await sha256Hex(new TextEncoder().encode(bundleIdInput));
+    const manifest = {
+      bundle_id: bundleId,
+      tool_version: SERVER_VERSION,
+      created_at: (/* @__PURE__ */ new Date()).toISOString(),
+      policy_hash: context.policyHash,
+      receipt_count: entries.length,
+      receipts: entries,
+      ...input.metadata ? { metadata: input.metadata } : {}
+    };
+    const manifestJson = stableJsonStringify(manifest);
+    await writeFile(join(tempDir, "manifest.json"), manifestJson, { mode: 384 });
+    totalBytes += new TextEncoder().encode(manifestJson).length;
+    const manifestBytes = new TextEncoder().encode(manifestJson);
+    const manifestSha256 = await sha256Hex(manifestBytes);
+    const canonicalManifest = JSON.parse(manifestJson);
+    const manifestJws = await sign(
+      canonicalManifest,
+      context.issuerKey.privateKey,
+      context.issuerKey.kid
+    );
+    await writeFile(join(tempDir, "manifest.jws"), manifestJws, { mode: 384 });
+    totalBytes += new TextEncoder().encode(manifestJws).length;
+    const fileCount = entries.length + 2;
+    const finalPath = join(context.bundleDir, outputName);
+    try {
+      await stat(finalPath);
+      return {
+        text: `Bundle creation failed: output path already exists: ${outputName}`,
+        structured: {
+          ok: false,
+          code: "E_MCP_BUNDLE_FAILED",
+          message: `Output path already exists: ${outputName}`
+        },
+        isError: true
+      };
+    } catch (err) {
+      if (err.code !== "ENOENT") {
+        throw err;
+      }
+    }
+    await atomicWriteDir(tempDir, finalPath);
+    tempDir = void 0;
+    const tr = truncateResponse(
+      `Bundle created: ${outputName} (${fileCount} files, ${totalBytes} bytes)`,
+      policy
+    );
+    const safeText = sanitizeOutput(tr.text, keyPatterns);
+    return {
+      text: safeText,
+      structured: {
+        ok: true,
+        bundleId,
+        bundleName: outputName,
+        receiptCount: entries.length,
+        fileCount,
+        totalBytes,
+        createdAt: manifest.created_at,
+        manifestSha256
+      }
+    };
+  } catch (err) {
+    if (tempDir) {
+      try {
+        await rm(tempDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+    const rawMessage = err instanceof Error ? err.message : String(err);
+    const safeMessage = sanitizeOutput(rawMessage, keyPatterns);
+    if (err instanceof McpServerError) {
+      return {
+        text: `Bundle creation failed: ${safeMessage}`,
+        structured: {
+          ok: false,
+          code: err.code,
+          message: safeMessage
+        },
+        isError: true
+      };
+    }
+    return {
+      text: `Bundle creation failed: ${safeMessage}`,
+      structured: {
+        ok: false,
+        code: "E_MCP_BUNDLE_FAILED",
+        message: safeMessage
+      },
+      isError: true
+    };
+  }
+}
+var VerifyInputSchema = z.object({
+  jws: z.string().describe("JWS compact serialization (header.payload.signature)"),
+  public_key_base64url: z.string().optional().describe("Ed25519 public key in base64url encoding (32 bytes)"),
+  jwks: z.string().optional().describe("Inline JWKS JSON containing the verifying key"),
+  issuer: z.string().optional().describe("Expected issuer URI for binding check"),
+  audience: z.string().optional().describe("Expected audience URI for binding check")
+});
+var MetaSchema = z.object({
+  serverVersion: z.string(),
+  policyHash: z.string(),
+  protocolVersion: z.string()
+});
+var CheckSchema = z.object({
+  name: z.string(),
+  passed: z.boolean(),
+  message: z.string().optional()
+});
+var VerifyOutputSchema = z.object({
+  _meta: MetaSchema,
+  ok: z.boolean(),
+  code: z.string().optional(),
+  message: z.string().optional(),
+  variant: z.string().optional(),
+  checks: z.array(CheckSchema),
+  claimsSummary: z.record(z.string(), z.unknown()).optional(),
+  keySource: z.string().optional()
+});
+var InspectInputSchema = z.object({
+  jws: z.string().describe("JWS compact serialization to inspect"),
+  full_claims: z.boolean().optional().default(false).describe("Include full decoded claims (may be redacted by policy)")
+});
+var MetaSchema2 = z.object({
+  serverVersion: z.string(),
+  policyHash: z.string(),
+  protocolVersion: z.string()
+});
+var InspectOutputSchema = z.object({
+  _meta: MetaSchema2,
+  header: z.record(z.string(), z.unknown()),
+  payloadMeta: z.object({
+    variant: z.string(),
+    issuer: z.string().optional(),
+    audience: z.string().optional(),
+    issuedAt: z.string().optional(),
+    expiresAt: z.string().optional(),
+    receiptId: z.string().optional()
+  }),
+  fullPayload: z.record(z.string(), z.unknown()).optional(),
+  redacted: z.boolean(),
+  verified: z.literal(false)
+});
+var DecodeInputSchema = z.object({
+  jws: z.string().describe("JWS compact serialization to decode")
+});
+var MetaSchema3 = z.object({
+  serverVersion: z.string(),
+  policyHash: z.string(),
+  protocolVersion: z.string()
+});
+var DecodeOutputSchema = z.object({
+  _meta: MetaSchema3,
+  header: z.record(z.string(), z.unknown()),
+  payload: z.record(z.string(), z.unknown()),
+  verified: z.literal(false)
+});
+var IssueInputSchema = z.object({
+  aud: z.string().url().describe("Audience / resource URI (https://)"),
+  amt: z.number().int().nonnegative().describe("Amount in smallest currency unit"),
+  cur: z.string().regex(/^[A-Z]{3}$/).describe("ISO 4217 currency code (uppercase, e.g. USD)"),
+  rail: z.string().describe("Payment rail identifier"),
+  reference: z.string().describe("Unique payment reference"),
+  asset: z.string().optional().describe("Asset transferred (e.g. USDC) -- defaults to currency"),
+  env: z.enum(["live", "test"]).default("test").describe("Environment"),
+  network: z.string().optional().describe("Network/chain identifier"),
+  evidence: z.unknown().optional().describe("Rail-specific evidence (JSON-safe)"),
+  subject: z.string().url().optional().describe("Subject URI (https://)"),
+  ttl_seconds: z.number().int().positive().optional().describe("Time-to-live in seconds (computes exp = iat + ttl)"),
+  kind: z.string().optional().describe("Receipt kind for policy filtering")
+});
+var MetaSchema4 = z.object({
+  serverVersion: z.string(),
+  policyHash: z.string(),
+  protocolVersion: z.string()
+});
+var ClaimsSummarySchema = z.object({
+  iss: z.string(),
+  aud: z.string(),
+  iat: z.number(),
+  exp: z.number().optional(),
+  rid: z.string(),
+  amt: z.number(),
+  cur: z.string()
+});
+var IssueOutputSchema = z.object({
+  _meta: MetaSchema4,
+  ok: z.boolean(),
+  jws: z.string(),
+  claimsSummary: ClaimsSummarySchema
+});
+var BundleInputSchema = z.object({
+  receipts: z.array(z.string().max(16384)).min(1).max(256).describe("Receipt JWS strings to bundle (1-256)"),
+  metadata: z.record(z.unknown()).optional().describe("Optional metadata to include in the manifest"),
+  output_path: z.string().max(255).optional().describe("Output directory name (single segment within --bundle-dir)")
+});
+var MetaSchema5 = z.object({
+  serverVersion: z.string(),
+  policyHash: z.string(),
+  protocolVersion: z.string()
+});
+var BundleOutputSchema = z.object({
+  _meta: MetaSchema5,
+  ok: z.boolean(),
+  bundleId: z.string(),
+  bundleName: z.string(),
+  receiptCount: z.number(),
+  fileCount: z.number(),
+  totalBytes: z.number(),
+  createdAt: z.string(),
+  manifestSha256: z.string()
+});
+
+// src/server.ts
+function makeMeta(ctx, serverName) {
+  return {
+    serverName,
+    serverVersion: ctx.version,
+    policyHash: ctx.policyHash,
+    protocolVersion: ctx.protocolVersion
+  };
+}
+function handlerResultToCallToolResult(result, meta) {
+  return {
+    content: [{ type: "text", text: result.text }],
+    structuredContent: { _meta: meta, ...result.structured },
+    isError: result.isError
+  };
+}
+var PURE_TOOL_ANNOTATIONS = {
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: false
+};
+var ISSUE_TOOL_ANNOTATIONS = {
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: false,
+  openWorldHint: false
+};
+var BUNDLE_TOOL_ANNOTATIONS = {
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: false,
+  openWorldHint: true
+};
+var MAX_INPUT_DEPTH = 10;
+function errorCallToolResult(meta, code, message) {
+  return {
+    content: [{ type: "text", text: message }],
+    structuredContent: { _meta: meta, ok: false, code, message },
+    isError: true
+  };
+}
+function createPeacMcpServer(options) {
+  const { version, policy, context } = options;
+  const registeredTools = ["peac_verify", "peac_inspect", "peac_decode"];
+  if (context.issuerKey && context.issuerId) {
+    registeredTools.push("peac_issue");
+    if (context.bundleDir) {
+      registeredTools.push("peac_create_bundle");
+    }
+  }
+  const meta = { ...makeMeta(context, SERVER_NAME), registeredTools };
+  const maxConcurrency = policy.limits.max_concurrency;
+  let activeHandlers = 0;
+  async function wrapHandler(toolName, args, handlerFn, signal) {
+    if (signal?.aborted) {
+      return errorCallToolResult(meta, "E_MCP_CANCELLED", "Request cancelled");
+    }
+    if (activeHandlers >= maxConcurrency) {
+      return errorCallToolResult(
+        meta,
+        "E_MCP_CONCURRENCY_LIMIT",
+        `Server at capacity (${maxConcurrency} concurrent handlers)`
+      );
+    }
+    if (!checkObjectDepth(args, MAX_INPUT_DEPTH)) {
+      return errorCallToolResult(
+        meta,
+        "E_MCP_INPUT_TOO_DEEP",
+        `Input exceeds maximum nesting depth of ${MAX_INPUT_DEPTH}`
+      );
+    }
+    const inputSizeResult = checkInputSizes(args, policy);
+    if (inputSizeResult) {
+      return handlerResultToCallToolResult(inputSizeResult, meta);
+    }
+    activeHandlers++;
+    const handlerPromise = handlerFn(signal);
+    void handlerPromise.finally(() => {
+      activeHandlers--;
+    }).catch(() => {
+    });
+    let timedOut = false;
+    let cancelled = false;
+    let timer;
+    const timeoutPromise = new Promise((_resolve, reject) => {
+      timer = setTimeout(() => {
+        timedOut = true;
+        reject(new Error(`Tool "${toolName}" timed out after ${policy.limits.tool_timeout_ms}ms`));
+      }, policy.limits.tool_timeout_ms);
+      timer.unref?.();
+    });
+    const raceParticipants = [handlerPromise, timeoutPromise];
+    let abortCleanup;
+    if (signal && !signal.aborted) {
+      const cancelPromise = new Promise((_resolve, reject) => {
+        const onAbort = () => {
+          cancelled = true;
+          reject(new Error("Request cancelled"));
+        };
+        signal.addEventListener("abort", onAbort, { once: true });
+        abortCleanup = () => signal.removeEventListener("abort", onAbort);
+      });
+      raceParticipants.push(cancelPromise);
+    }
+    try {
+      const result = await Promise.race(raceParticipants);
+      const callResult = handlerResultToCallToolResult(result, meta);
+      const outputBytes = measureEnvelopeBytes(callResult);
+      if (outputBytes > policy.limits.max_response_bytes) {
+        return errorCallToolResult(
+          meta,
+          "E_MCP_OUTPUT_TOO_LARGE",
+          `Response is ${outputBytes} bytes, exceeding limit of ${policy.limits.max_response_bytes}`
+        );
+      }
+      return callResult;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (cancelled) {
+        return errorCallToolResult(meta, "E_MCP_CANCELLED", "Request cancelled");
+      }
+      if (timedOut) {
+        return errorCallToolResult(meta, "E_MCP_TOOL_TIMEOUT", message);
+      }
+      return errorCallToolResult(meta, "E_MCP_INTERNAL", message);
+    } finally {
+      clearTimeout(timer);
+      abortCleanup?.();
+    }
+  }
+  const server = new McpServer(
+    { name: SERVER_NAME, version },
+    // listChanged: false -- tool set is static per server instance (determined
+    // at startup from CLI flags). The server never emits notifications/tools/list_changed.
+    { capabilities: { tools: { listChanged: false } } }
+  );
+  const register = server.registerTool.bind(server);
+  register(
+    "peac_verify",
+    {
+      title: "Verify PEAC Receipt",
+      description: "Verify a PEAC receipt JWS signature and validate claims. Returns structured check results.",
+      inputSchema: VerifyInputSchema,
+      outputSchema: VerifyOutputSchema,
+      annotations: PURE_TOOL_ANNOTATIONS
+    },
+    async (args, extra) => wrapHandler(
+      "peac_verify",
+      args,
+      (signal) => handleVerify({ input: args, policy, context, signal }),
+      extra.signal
+    )
+  );
+  register(
+    "peac_inspect",
+    {
+      title: "Inspect PEAC Receipt",
+      description: "Decode and inspect a PEAC receipt without verifying the signature. Shows header, payload metadata, and optionally full claims.",
+      inputSchema: InspectInputSchema,
+      outputSchema: InspectOutputSchema,
+      annotations: PURE_TOOL_ANNOTATIONS
+    },
+    async (args, extra) => wrapHandler(
+      "peac_inspect",
+      args,
+      (signal) => handleInspect({ input: args, policy}),
+      extra.signal
+    )
+  );
+  register(
+    "peac_decode",
+    {
+      title: "Decode PEAC Receipt",
+      description: "Raw decode of a PEAC receipt JWS. Returns header and payload without signature verification.",
+      inputSchema: DecodeInputSchema,
+      outputSchema: DecodeOutputSchema,
+      annotations: PURE_TOOL_ANNOTATIONS
+    },
+    async (args, extra) => wrapHandler(
+      "peac_decode",
+      args,
+      (signal) => handleDecode({ input: args, policy}),
+      extra.signal
+    )
+  );
+  if (context.issuerKey && context.issuerId) {
+    register(
+      "peac_issue",
+      {
+        title: "Issue PEAC Receipt",
+        description: "Sign and return a PEAC receipt JWS. Requires server to be configured with --issuer-key and --issuer-id.",
+        inputSchema: IssueInputSchema,
+        outputSchema: IssueOutputSchema,
+        annotations: ISSUE_TOOL_ANNOTATIONS
+      },
+      async (args, extra) => wrapHandler(
+        "peac_issue",
+        args,
+        (signal) => handleIssue({ input: args, policy, context}),
+        extra.signal
+      )
+    );
+    if (context.bundleDir) {
+      register(
+        "peac_create_bundle",
+        {
+          title: "Create Evidence Bundle",
+          description: "Create a signed evidence bundle directory from receipt JWS strings. Requires --issuer-key, --issuer-id, and --bundle-dir.",
+          inputSchema: BundleInputSchema,
+          outputSchema: BundleOutputSchema,
+          annotations: BUNDLE_TOOL_ANNOTATIONS
+        },
+        async (args, extra) => wrapHandler(
+          "peac_create_bundle",
+          args,
+          (signal) => handleCreateBundle({ input: args, policy, context, signal }),
+          extra.signal
+        )
+      );
+    }
+  }
+  return server;
+}
+var ToolPolicySchema = z.object({
+  enabled: z.boolean().default(true),
+  allowed_kinds: z.array(z.string()).optional()
+});
+var RedactionSchema = z.object({
+  strip_evidence: z.boolean().default(false),
+  strip_payment: z.boolean().default(false),
+  inspect_full_claims: z.boolean().default(false)
+});
+var LimitsSchema = z.object({
+  max_jws_bytes: z.number().int().positive().default(16384),
+  max_response_bytes: z.number().int().positive().default(65536),
+  tool_timeout_ms: z.number().int().positive().default(3e4),
+  max_concurrency: z.number().int().positive().default(10),
+  max_claims_bytes: z.number().int().positive().default(262144),
+  max_bundle_receipts: z.number().int().positive().default(256),
+  max_bundle_bytes: z.number().int().positive().default(16777216),
+  max_ttl_seconds: z.number().int().positive().default(86400)
+});
+var JwksConfigSchema = z.object({
+  file: z.string().optional()
+});
+var PolicySchema = z.object({
+  version: z.literal("1"),
+  allow_network: z.boolean().default(false),
+  redaction: RedactionSchema.default({}),
+  tools: z.record(z.string(), ToolPolicySchema).default({}),
+  limits: LimitsSchema.default({}),
+  jwks: JwksConfigSchema.optional()
+});
+var DEFAULT_POLICY = {
+  version: "1",
+  allow_network: false,
+  redaction: { strip_evidence: false, strip_payment: false, inspect_full_claims: false },
+  tools: {},
+  limits: {
+    max_jws_bytes: 16384,
+    max_response_bytes: 65536,
+    tool_timeout_ms: 3e4,
+    max_concurrency: 10,
+    max_claims_bytes: 262144,
+    max_bundle_receipts: 256,
+    max_bundle_bytes: 16777216,
+    max_ttl_seconds: 86400
+  }
+};
+function getDefaultPolicy() {
+  return structuredClone(DEFAULT_POLICY);
+}
+function deepStableStringify(value) {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return "[" + value.map(deepStableStringify).join(",") + "]";
+  }
+  const obj = value;
+  const keys = Object.keys(obj).sort();
+  const pairs = keys.map((k) => JSON.stringify(k) + ":" + deepStableStringify(obj[k]));
+  return "{" + pairs.join(",") + "}";
+}
+async function computePolicyHash(input) {
+  const canonical = typeof input === "string" ? input : deepStableStringify(input);
+  return sha256Hex(canonical);
+}
+async function loadPolicy(filePath) {
+  let raw;
+  try {
+    raw = await readFile(filePath, "utf-8");
+  } catch (err) {
+    throw new PolicyLoadError(
+      `Failed to read policy file: ${filePath} -- ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  try {
+    const s = await stat(filePath);
+    if (s.mode & 2) {
+      process.stderr.write(
+        `[peac-mcp-server] WARNING: Policy file ${filePath} is world-writable
+`
+      );
+    }
+  } catch {
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new PolicyLoadError(`Policy file is not valid JSON: ${filePath}`);
+  }
+  const result = PolicySchema.safeParse(parsed);
+  if (!result.success) {
+    const issues = result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
+    throw new PolicyLoadError(`Policy validation failed: ${issues}`);
+  }
+  const hash = await computePolicyHash(result.data);
+  return { policy: result.data, hash };
+}
+async function loadIssuerKey(schemeUri) {
+  let raw;
+  if (schemeUri.startsWith("env:")) {
+    const varName = schemeUri.slice(4);
+    const envValue = process.env[varName];
+    if (!envValue) {
+      throw new KeyLoadError(`Environment variable ${varName} is not set or empty`);
+    }
+    raw = envValue;
+  } else if (schemeUri.startsWith("file:")) {
+    const filePath = schemeUri.slice(5);
+    try {
+      raw = await readFile(filePath, "utf-8");
+    } catch (err) {
+      throw new KeyLoadError(
+        `Failed to read key file: ${filePath} -- ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  } else {
+    throw new KeyLoadError(
+      `Unsupported key scheme: ${schemeUri} (expected env:VAR_NAME or file:/path)`
+    );
+  }
+  let jwk;
+  try {
+    jwk = JSON.parse(raw);
+  } catch {
+    throw new KeyLoadError("Key data is not valid JSON");
+  }
+  if (typeof jwk !== "object" || jwk === null || !("kty" in jwk) || !("crv" in jwk) || !("d" in jwk)) {
+    throw new KeyLoadError("JWK must contain kty, crv, and d fields");
+  }
+  const j = jwk;
+  if (j.kty !== "OKP" || j.crv !== "Ed25519") {
+    throw new KeyLoadError(
+      `JWK must be Ed25519 (kty: OKP, crv: Ed25519), got kty=${String(j.kty)} crv=${String(j.crv)}`
+    );
+  }
+  if (typeof j.d !== "string" || typeof j.x !== "string") {
+    throw new KeyLoadError("JWK d and x fields must be base64url strings");
+  }
+  const ed25519Jwk = {
+    kty: "OKP",
+    crv: "Ed25519",
+    x: j.x,
+    d: j.d
+  };
+  const valid = await validateKeypair(ed25519Jwk);
+  if (!valid) {
+    throw new KeyLoadError("JWK keypair validation failed: d does not derive to x");
+  }
+  const privateKey = base64urlDecode(ed25519Jwk.d);
+  const publicKey = await derivePublicKey(privateKey);
+  let kid;
+  if (typeof j.kid === "string") {
+    kid = j.kid;
+  } else {
+    const pubB64 = base64urlEncode(publicKey);
+    const hash = await sha256Hex(pubB64);
+    kid = hash.slice(0, 16);
+  }
+  return { privateKey, publicKey, kid };
+}
+
+// src/stdout-fence.ts
+var MAX_LINE_BYTES = 4 * 1024 * 1024;
+function installStdoutFence() {
+  const originalWrite = process.stdout.write.bind(process.stdout);
+  let buffer = "";
+  let bufferBytes = 0;
+  function validateJsonRpcLine(line) {
+    const lineBytes = new TextEncoder().encode(line).length;
+    if (lineBytes > MAX_LINE_BYTES) {
+      throw new McpServerError(
+        "E_MCP_STDOUT_FENCE_VIOLATION",
+        `Stdout fence: line is ${lineBytes} bytes, exceeding limit of ${MAX_LINE_BYTES}`
+      );
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      throw new McpServerError(
+        "E_MCP_STDOUT_FENCE_VIOLATION",
+        `Stdout fence: non-JSON line detected: ${line.slice(0, 100)}`
+      );
+    }
+    if (typeof parsed !== "object" || parsed === null) {
+      throw new McpServerError(
+        "E_MCP_STDOUT_FENCE_VIOLATION",
+        `Stdout fence: non-JSON-RPC 2.0 object on stdout: ${line.slice(0, 100)}`
+      );
+    }
+    const obj = parsed;
+    if (obj.jsonrpc !== "2.0") {
+      throw new McpServerError(
+        "E_MCP_STDOUT_FENCE_VIOLATION",
+        `Stdout fence: non-JSON-RPC 2.0 object on stdout: ${line.slice(0, 100)}`
+      );
+    }
+    const hasId = "id" in obj;
+    const hasResult = "result" in obj;
+    const hasError = "error" in obj;
+    const hasMethod = "method" in obj;
+    if (hasId && (hasResult || hasError)) {
+      return;
+    }
+    if (hasMethod && !hasId) {
+      return;
+    }
+    throw new McpServerError(
+      "E_MCP_STDOUT_FENCE_VIOLATION",
+      `Stdout fence: malformed JSON-RPC 2.0 message (expected response or notification): ${line.slice(0, 100)}`
+    );
+  }
+  function processBuffer() {
+    const lines = buffer.split("\n");
+    buffer = lines.pop();
+    bufferBytes = new TextEncoder().encode(buffer).length;
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (trimmed.length === 0) continue;
+      validateJsonRpcLine(trimmed);
+    }
+  }
+  const patchedWrite = function(chunk, encodingOrCallback, callback) {
+    let encoding;
+    let cb;
+    if (typeof encodingOrCallback === "function") {
+      cb = encodingOrCallback;
+    } else {
+      encoding = encodingOrCallback;
+      cb = callback;
+    }
+    const str = typeof chunk === "string" ? chunk : new TextDecoder().decode(chunk);
+    const chunkBytes = new TextEncoder().encode(str).length;
+    if (bufferBytes + chunkBytes > MAX_LINE_BYTES) {
+      throw new McpServerError(
+        "E_MCP_STDOUT_FENCE_VIOLATION",
+        `Stdout fence: buffer exceeded ${MAX_LINE_BYTES} bytes without a newline`
+      );
+    }
+    buffer += str;
+    bufferBytes += chunkBytes;
+    processBuffer();
+    if (encoding) {
+      return originalWrite(chunk, encoding, cb);
+    }
+    return originalWrite(chunk, cb);
+  };
+  process.stdout.write = patchedWrite;
+  return function teardown() {
+    if (buffer.trim().length > 0) {
+      validateJsonRpcLine(buffer.trim());
+    }
+    buffer = "";
+    bufferBytes = 0;
+    process.stdout.write = originalWrite;
+  };
+}
+
+export { BundleToolError, DEFAULT_MAX_BUNDLE_BYTES, DEFAULT_MAX_BUNDLE_RECEIPTS, DEFAULT_MAX_CLAIMS_BYTES, DEFAULT_MAX_JWS_BYTES, DEFAULT_MAX_RESPONSE_BYTES, DEFAULT_MAX_TTL_SECONDS, DEFAULT_TOOL_TIMEOUT_MS, IssueToolError, JwksLoadError, KeyLoadError, MCP_PROTOCOL_VERSION, McpServerError, PathTraversalError, PolicyLoadError, SERVER_NAME, SERVER_VERSION, assertRelativePath, atomicWriteDir, checkInputSizes, checkJwsSize, checkObjectDepth, checkToolEnabled, computePolicyHash, createPeacMcpServer, createTempDir, getDefaultPolicy, handleCreateBundle, handleDecode, handleInspect, handleIssue, handleVerify, installStdoutFence, loadIssuerKey, loadJwksFile, loadPolicy, measureEnvelopeBytes, resolveKeyByKid, resolveOutputPath, safeMkdir, sanitizeOutput, truncateResponse };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map