@smartpolicy/mcp 0.1.0

package/dist/http.js

@@ -0,0 +1,201 @@
+/**
+ * `smartpolicy-mcp serve` — Streamable HTTP transport with optional x402
+ * metering. Stateless: each POST /mcp gets a fresh McpServer + transport
+ * (Registry/GrantIssuer are shared; grant nonces are random, no state).
+ *
+ * Payments (x402, https://x402.org): enabled by setting
+ *   SMARTPOLICY_X402_PAY_TO      — USDC receiving address (enables metering)
+ *   SMARTPOLICY_X402_PRICE_USDC  — price per paid call in USDC (default 0.001)
+ *   SMARTPOLICY_X402_FACILITATOR — default https://x402.org/facilitator
+ *                                  (keyless, testnet; use CDP for mainnet)
+ *   SMARTPOLICY_PUBLIC_URL       — public base URL for the `resource` field
+ *   SMARTPOLICY_PORT             — default 3402
+ * Without PAY_TO every tool is free (the self-host default). Only
+ * grant_issue / policy_create / policy_update are ever metered; reads stay
+ * free per ARCHITECTURE.md §4.
+ *
+ * ponytail: payment is settled BEFORE the tool runs — a tool-level error can
+ * consume a payment. Acceptable at $0.001/call; refund-on-error needs an
+ * escrow pattern, add if anyone actually complains.
+ */
+import { createServer } from "node:http";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { loadConfig } from "./config.js";
+import { GrantIssuer } from "./grants.js";
+import { Registry } from "./registry.js";
+import { buildServer } from "./server.js";
+const PAID_TOOLS = new Set(["grant_issue", "policy_create", "policy_update"]);
+/** x402 `exact` scheme needs the chain's USDC contract + network slug. */
+const X402_NETWORKS = {
+    84532: { network: "base-sepolia", usdc: "0x036CbD53842c5426634e7929541eC2318f3dCF7e" },
+    8453: { network: "base", usdc: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913" },
+};
+function loadX402(config, port) {
+    const payTo = process.env.SMARTPOLICY_X402_PAY_TO;
+    if (!payTo)
+        return undefined;
+    const net = X402_NETWORKS[config.chainId];
+    if (!net) {
+        console.error(`WARNING: x402 metering not supported on chainId ${config.chainId}; running free.`);
+        return undefined;
+    }
+    const priceUsdc = Number(process.env.SMARTPOLICY_X402_PRICE_USDC ?? "0.001");
+    if (!Number.isFinite(priceUsdc) || priceUsdc <= 0) {
+        throw new Error(`invalid SMARTPOLICY_X402_PRICE_USDC: ${process.env.SMARTPOLICY_X402_PRICE_USDC}`);
+    }
+    return {
+        payTo,
+        priceAtomic: String(Math.round(priceUsdc * 1_000_000)),
+        facilitator: process.env.SMARTPOLICY_X402_FACILITATOR ?? "https://x402.org/facilitator",
+        network: net.network,
+        usdc: net.usdc,
+        publicUrl: process.env.SMARTPOLICY_PUBLIC_URL ?? `http://localhost:${port}`,
+    };
+}
+function paymentRequirements(x, toolName) {
+    return {
+        scheme: "exact",
+        network: x.network,
+        maxAmountRequired: x.priceAtomic,
+        resource: `${x.publicUrl}/mcp#${toolName}`,
+        description: `SmartPolicy MCP tool: ${toolName}`,
+        mimeType: "application/json",
+        payTo: x.payTo,
+        maxTimeoutSeconds: 60,
+        asset: x.usdc,
+        extra: { name: "USDC", version: "2" }, // EIP-712 domain of USDC transferWithAuthorization
+    };
+}
+async function facilitatorPost(x, path, paymentHeader, requirements) {
+    let paymentPayload;
+    try {
+        paymentPayload = JSON.parse(Buffer.from(paymentHeader, "base64").toString("utf8"));
+    }
+    catch {
+        return { ok: false, reason: "malformed X-PAYMENT header (expected base64 JSON)" };
+    }
+    const res = await fetch(`${x.facilitator}${path}`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ x402Version: 1, paymentPayload, paymentRequirements: requirements }),
+    });
+    if (!res.ok)
+        return { ok: false, reason: `facilitator ${path} returned HTTP ${res.status}` };
+    return { ok: true, body: (await res.json()) };
+}
+function sendJson(res, status, body) {
+    res.writeHead(status, { "content-type": "application/json" });
+    res.end(JSON.stringify(body));
+}
+function send402(res, x, toolName, error) {
+    sendJson(res, 402, { x402Version: 1, error, accepts: [paymentRequirements(x, toolName)] });
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        let data = "";
+        req.on("data", (chunk) => (data += chunk));
+        req.on("end", () => resolve(data));
+        req.on("error", reject);
+    });
+}
+export async function serve() {
+    const config = loadConfig();
+    const registry = new Registry(config);
+    const issuer = config.issuerKey ? new GrantIssuer(config) : undefined;
+    const port = Number(process.env.SMARTPOLICY_PORT ?? 3402);
+    const x402 = loadX402(config, port);
+    try {
+        await registry.assertChainId();
+    }
+    catch (error) {
+        console.error(`WARNING: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const httpServer = createServer(async (req, res) => {
+        // CORS: the API is public and stateless; browsers may call it directly.
+        res.setHeader("access-control-allow-origin", "*");
+        res.setHeader("access-control-allow-headers", "content-type, accept, x-payment, mcp-session-id, mcp-protocol-version");
+        res.setHeader("access-control-expose-headers", "x-payment-response");
+        if (req.method === "OPTIONS") {
+            res.writeHead(204).end();
+            return;
+        }
+        const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+        if (req.method === "GET" && url.pathname === "/healthz") {
+            sendJson(res, 200, {
+                ok: true,
+                chainId: config.chainId,
+                registry: config.registry,
+                verifier: config.verifier,
+                issuerEnabled: Boolean(issuer),
+                x402: x402 ? { network: x402.network, priceAtomicUsdc: x402.priceAtomic, paidTools: [...PAID_TOOLS] } : null,
+            });
+            return;
+        }
+        if (url.pathname !== "/mcp") {
+            sendJson(res, 404, { error: "not found; MCP endpoint is POST /mcp" });
+            return;
+        }
+        if (req.method !== "POST") {
+            // Stateless mode: no SSE stream, no sessions to delete.
+            sendJson(res, 405, { error: "stateless server: use POST /mcp" });
+            return;
+        }
+        try {
+            const raw = await readBody(req);
+            let body;
+            try {
+                body = raw ? JSON.parse(raw) : undefined;
+            }
+            catch {
+                sendJson(res, 400, { error: "invalid JSON body" });
+                return;
+            }
+            // x402 gate: meter tools/call on paid tools only.
+            const msg = body;
+            const toolName = msg?.method === "tools/call" ? msg.params?.name : undefined;
+            if (x402 && toolName && PAID_TOOLS.has(toolName)) {
+                const header = req.headers["x-payment"];
+                if (typeof header !== "string") {
+                    send402(res, x402, toolName, "X-PAYMENT header is required for this tool");
+                    return;
+                }
+                const requirements = paymentRequirements(x402, toolName);
+                const verified = await facilitatorPost(x402, "/verify", header, requirements);
+                if (!verified.ok || !verified.body?.isValid) {
+                    const reason = (!verified.ok && "reason" in verified && verified.reason) ||
+                        String(verified.body?.invalidReason ?? "payment invalid");
+                    send402(res, x402, toolName, reason);
+                    return;
+                }
+                const settled = await facilitatorPost(x402, "/settle", header, requirements);
+                if (!settled.ok || settled.body?.success === false) {
+                    const reason = (!settled.ok && "reason" in settled && settled.reason) ||
+                        String(settled.body?.errorReason ?? "settlement failed");
+                    send402(res, x402, toolName, reason);
+                    return;
+                }
+                res.setHeader("x-payment-response", Buffer.from(JSON.stringify(settled.body)).toString("base64"));
+            }
+            // Fresh server + transport per request (official stateless pattern).
+            const server = buildServer(config, registry, issuer);
+            const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+            res.on("close", () => {
+                void transport.close();
+                void server.close();
+            });
+            await server.connect(transport);
+            await transport.handleRequest(req, res, body);
+        }
+        catch (error) {
+            console.error("request failed:", error);
+            if (!res.headersSent) {
+                sendJson(res, 500, { error: "internal server error" });
+            }
+        }
+    });
+    httpServer.listen(port, () => {
+        console.error(`smartpolicy-mcp listening on :${port} — POST /mcp (chainId ${config.chainId}, ` +
+            `issuer ${issuer ? issuer.address : "disabled"}, x402 ${x402 ? `${x402.network} → ${x402.payTo}` : "off (all tools free)"})`);
+    });
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,UAAU,EAAe,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC;AAE9E,0EAA0E;AAC1E,MAAM,aAAa,GAAsD;IACvE,KAAK,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,4CAA4C,EAAE;IACtF,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,4CAA4C,EAAE;CAC9E,CAAC;AAWF,SAAS,QAAQ,CAAC,MAAc,EAAE,IAAY;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,mDAAmD,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;QAClG,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,OAAO,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,OAAO;QACL,KAAK;QACL,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;QACtD,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,8BAA8B;QACvF,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,oBAAoB,IAAI,EAAE;KAC5E,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAa,EAAE,QAAgB;IAC1D,OAAO;QACL,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,iBAAiB,EAAE,CAAC,CAAC,WAAW;QAChC,QAAQ,EAAE,GAAG,CAAC,CAAC,SAAS,QAAQ,QAAQ,EAAE;QAC1C,WAAW,EAAE,yBAAyB,QAAQ,EAAE;QAChD,QAAQ,EAAE,kBAAkB;QAC5B,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,iBAAiB,EAAE,EAAE;QACrB,KAAK,EAAE,CAAC,CAAC,IAAI;QACb,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,mDAAmD;KAC3F,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,CAAa,EAAE,IAAY,EAAE,aAAqB,EAAE,YAAqB;IACtG,IAAI,cAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mDAAmD,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,GAAG,IAAI,EAAE,EAAE;QACjD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,cAAc,EAAE,mBAAmB,EAAE,YAAY,EAAE,CAAC;KAC5F,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,IAAI,kBAAkB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;IAC7F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAClE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,OAAO,CAAC,GAAmB,EAAE,CAAa,EAAE,QAAgB,EAAE,KAAa;IAClF,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC;QAC3C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK;IACzB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAEpC,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,aAAa,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,YAAY,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjD,wEAAwE;QACxE,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,uEAAuE,CAAC,CAAC;QACvH,GAAG,CAAC,SAAS,CAAC,+BAA+B,EAAE,oBAAoB,CAAC,CAAC;QACrE,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;QAEjF,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YACxD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,EAAE,EAAE,IAAI;gBACR,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC;gBAC9B,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;aAC7G,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC5B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,wDAAwD;YACxD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YAED,kDAAkD;YAClD,MAAM,GAAG,GAAG,IAAmE,CAAC;YAChF,MAAM,QAAQ,GAAG,GAAG,EAAE,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,IAAI,IAAI,IAAI,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;gBACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC/B,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,4CAA4C,CAAC,CAAC;oBAC3E,OAAO;gBACT,CAAC;gBACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACzD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;gBAC9E,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAE,QAAQ,CAAC,IAA0C,EAAE,OAAO,EAAE,CAAC;oBACnF,MAAM,MAAM,GACV,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC;wBACzD,MAAM,CAAE,QAAQ,CAAC,IAA4C,EAAE,aAAa,IAAI,iBAAiB,CAAC,CAAC;oBACrG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;oBACrC,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;gBAC7E,IAAI,CAAC,OAAO,CAAC,EAAE,IAAK,OAAO,CAAC,IAA0C,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;oBAC1F,MAAM,MAAM,GACV,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,QAAQ,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;wBACtD,MAAM,CAAE,OAAO,CAAC,IAA4C,EAAE,WAAW,IAAI,mBAAmB,CAAC,CAAC;oBACpG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;oBACrC,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpG,CAAC;YAED,qEAAqE;YACrE,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;YACvF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;gBACvB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,CAAC,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QAC3B,OAAO,CAAC,KAAK,CACX,iCAAiC,IAAI,yBAAyB,MAAM,CAAC,OAAO,IAAI;YAC9E,UAAU,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,UAAU,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,sBAAsB,GAAG,CAC/H,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+/**
+ * SmartPolicy MCP server.
+ *
+ *   smartpolicy-mcp          — stdio transport (local MCP clients)
+ *   smartpolicy-mcp serve    — Streamable HTTP transport + optional x402 metering
+ *   smartpolicy-mcp deploy   — bootstrap Registry+Verifier on any chain
+ *
+ * Free reads:  policy_check, policy_get, policy_fees, grant_verify, grant_issuer_info
+ * Issuance:    grant_issue (requires SMARTPOLICY_ISSUER_KEY)
+ * Writes:      policy_create, policy_update — return unsigned calldata for the
+ *              caller's own wallet; this server never holds user keys.
+ */
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { loadConfig } from "./config.js";
+import { deploy } from "./deploy.js";
+import { GrantIssuer } from "./grants.js";
+import { serve } from "./http.js";
+import { Registry } from "./registry.js";
+import { buildServer } from "./server.js";
+// NOTE: no process.exit() anywhere in this package — on Windows it races
+// libuv's handle teardown (UV_HANDLE_CLOSING assertion, exit 0xC0000409)
+// while viem's keep-alive sockets are open. Let the event loop drain instead.
+async function startStdio() {
+    const config = loadConfig();
+    const registry = new Registry(config);
+    const issuer = config.issuerKey ? new GrantIssuer(config) : undefined;
+    // Best-effort chainId reconciliation at startup (M2): warn loudly if the
+    // configured chainId disagrees with the RPC, since grants would silently fail.
+    // Non-fatal — free reads still work even if the RPC is briefly unreachable.
+    try {
+        await registry.assertChainId();
+    }
+    catch (error) {
+        console.error(`WARNING: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const server = buildServer(config, registry, issuer);
+    await server.connect(new StdioServerTransport());
+}
+if (process.argv[2] === "deploy") {
+    await deploy();
+}
+else if (process.argv[2] === "serve") {
+    await serve();
+}
+else {
+    await startStdio();
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,yEAAyE;AACzE,yEAAyE;AACzE,8EAA8E;AAC9E,KAAK,UAAU,UAAU;IACvB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEtE,yEAAyE;IACzE,+EAA+E;IAC/E,4EAA4E;IAC5E,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,aAAa,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,YAAY,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;IACjC,MAAM,MAAM,EAAE,CAAC;AACjB,CAAC;KAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;IACvC,MAAM,KAAK,EAAE,CAAC;AAChB,CAAC;KAAM,CAAC;IACN,MAAM,UAAU,EAAE,CAAC;AACrB,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,104 @@
+import { type Address, type Hex, type PublicClient } from "viem";
+import { type ActionRuleName } from "./abi.js";
+import type { Config } from "./config.js";
+/** Mirrors IGrantVerifier.Grant for the grant_verify tool. */
+export interface GrantTuple {
+    policyId: string | number | bigint;
+    subject: Address;
+    action: Hex;
+    issuedAt: string | number | bigint;
+    expiresAt: string | number | bigint;
+    nonce: string | number | bigint;
+    issuer: Address;
+    target: Address;
+}
+export interface CheckResult {
+    allowed: boolean;
+    exists: boolean;
+    policyId: string;
+    subject: Address;
+    action: string;
+    actionId: Hex;
+    reasons: string[];
+}
+export interface PolicyInfo {
+    policyId: string;
+    exists: boolean;
+    owner: Address;
+    expiresAt: string;
+    active: boolean;
+    locked: boolean;
+    openMembership: boolean;
+    transferable: boolean;
+    memberCount: string;
+    metadataURI: string;
+    /** keccak256 commitment to the metadata document; 0x00…00 = none. Verify fetched metadata against this. */
+    metadataHash: Hex;
+}
+/** Unsigned transaction returned to the caller to sign with their own wallet. */
+export interface UnsignedTx {
+    to: Address;
+    value: string;
+    data: Hex;
+    description: string;
+}
+export declare class Registry {
+    private readonly config;
+    readonly client: PublicClient;
+    constructor(config: Config);
+    private read;
+    /** policy_check: the canonical question, with human/agent-readable reasons.
+     *  All four reads are pinned to one block so the cosmetic reasons[] can never
+     *  disagree with `allowed` under a sub-second race (N2). */
+    check(policyId: bigint, subject: Address, action: string): Promise<CheckResult>;
+    getPolicy(policyId: bigint): Promise<PolicyInfo>;
+    fees(): Promise<{
+        creationFee: bigint;
+        updateFee: bigint;
+    }>;
+    isAuthorizedIssuer(policyId: bigint, issuer: Address): Promise<boolean>;
+    /** M2: confirm the configured chainId matches the chain the RPC actually
+     *  serves — a mismatch silently makes every issued grant's EIP-712 signature
+     *  recover to the wrong address and revert on-chain. */
+    assertChainId(): Promise<void>;
+    /** grant_verify (idea #2): off-chain pre-flight of a grant before broadcast. */
+    verifyGrant(grant: GrantTuple, signature: Hex): Promise<{
+        valid: boolean;
+        nonceUsed: boolean;
+    }>;
+    /** policy_create: build the unsigned transaction; the caller signs it. */
+    buildCreatePolicy(opts: {
+        openMembership?: boolean;
+        transferable?: boolean;
+        expiresAt?: number;
+        metadataURI?: string;
+        metadataHash?: Hex;
+    }): Promise<UnsignedTx>;
+    /** policy_update: build the unsigned transaction for a rule change. */
+    buildUpdate(policyId: bigint, op: {
+        kind: "addMembers";
+        members: Address[];
+    } | {
+        kind: "removeMembers";
+        members: Address[];
+    } | {
+        kind: "setActionRule";
+        action: string;
+        rule: ActionRuleName;
+    } | {
+        kind: "addIssuer";
+        issuer: Address;
+    } | {
+        kind: "removeIssuer";
+        issuer: Address;
+    } | {
+        kind: "addAdmin";
+        admin: Address;
+    } | {
+        kind: "removeAdmin";
+        admin: Address;
+    } | {
+        kind: "setExpiry";
+        expiresAt: number;
+    }): Promise<UnsignedTx>;
+}

package/dist/registry.js

@@ -0,0 +1,208 @@
+import { createPublicClient, encodeFunctionData, http, } from "viem";
+import { actionRuleNames, registryAbi, verifierAbi } from "./abi.js";
+import { toActionId } from "./actions.js";
+export class Registry {
+    config;
+    client;
+    constructor(config) {
+        this.config = config;
+        this.client = createPublicClient({ transport: http(config.rpcUrl) });
+    }
+    read(functionName, args = []) {
+        return this.client.readContract({
+            address: this.config.registry,
+            abi: registryAbi,
+            functionName: functionName,
+            args: args,
+        });
+    }
+    /** policy_check: the canonical question, with human/agent-readable reasons.
+     *  All four reads are pinned to one block so the cosmetic reasons[] can never
+     *  disagree with `allowed` under a sub-second race (N2). */
+    async check(policyId, subject, action) {
+        const actionId = toActionId(action);
+        // cacheTime: 0 — viem caches getBlockNumber for ~pollingInterval, which would
+        // pin reads to a stale block and miss a just-mined update (worse than the
+        // cosmetic race N2 set out to fix).
+        const blockNumber = await this.client.getBlockNumber({ cacheTime: 0 });
+        const pinned = (functionName, args) => this.client.readContract({
+            address: this.config.registry,
+            abi: registryAbi,
+            functionName: functionName,
+            args: args,
+            blockNumber,
+        });
+        const [allowed, active, exists, member, ruleIdx] = (await Promise.all([
+            pinned("isAllowed", [policyId, subject, actionId]),
+            pinned("isPolicyActive", [policyId]),
+            pinned("policyCount", []).then((count) => policyId >= 1n && policyId <= count),
+            pinned("isMember", [policyId, subject]),
+            pinned("getActionRule", [policyId, actionId]),
+        ]));
+        const rule = actionRuleNames[ruleIdx] ?? "UNSET";
+        const reasons = [];
+        if (!exists) {
+            reasons.push("policy does not exist");
+        }
+        else if (!active) {
+            reasons.push("policy is expired");
+        }
+        else {
+            reasons.push(`action rule is ${rule}`);
+            if (rule === "ANYONE")
+                reasons.push("rule ANYONE: every address is allowed");
+            else if (rule === "NOBODY")
+                reasons.push("rule NOBODY: the action is disabled for everyone");
+            else
+                reasons.push(member ? "subject is a member" : "subject is not a member");
+        }
+        return { allowed, exists, policyId: policyId.toString(), subject, action, actionId, reasons };
+    }
+    async getPolicy(policyId) {
+        const count = await this.read("policyCount");
+        if (policyId < 1n || policyId > count) {
+            return {
+                policyId: policyId.toString(),
+                exists: false,
+                owner: `0x${"0".repeat(40)}`,
+                expiresAt: "never",
+                active: false,
+                locked: false,
+                openMembership: false,
+                transferable: false,
+                memberCount: "0",
+                metadataURI: "",
+                metadataHash: `0x${"0".repeat(64)}`,
+            };
+        }
+        const [policy, active, members] = await Promise.all([
+            this.read("getPolicy", [policyId]),
+            this.read("isPolicyActive", [policyId]),
+            this.read("memberCount", [policyId]),
+        ]);
+        return {
+            policyId: policyId.toString(),
+            exists: true,
+            owner: policy.owner,
+            expiresAt: policy.expiresAt === 0n ? "never" : new Date(Number(policy.expiresAt) * 1000).toISOString(),
+            active,
+            locked: policy.locked,
+            openMembership: (policy.flags & 1) !== 0,
+            transferable: (policy.flags & 2) !== 0,
+            memberCount: members.toString(),
+            metadataURI: policy.metadataURI,
+            metadataHash: policy.metadataHash,
+        };
+    }
+    async fees() {
+        const [creationFee, updateFee] = await Promise.all([
+            this.read("creationFee"),
+            this.read("updateFee"),
+        ]);
+        return { creationFee, updateFee };
+    }
+    async isAuthorizedIssuer(policyId, issuer) {
+        return this.read("isAuthorizedIssuer", [policyId, issuer]);
+    }
+    /** M2: confirm the configured chainId matches the chain the RPC actually
+     *  serves — a mismatch silently makes every issued grant's EIP-712 signature
+     *  recover to the wrong address and revert on-chain. */
+    async assertChainId() {
+        const live = await this.client.getChainId();
+        if (live !== this.config.chainId) {
+            throw new Error(`chainId mismatch: configured ${this.config.chainId} but RPC ${this.config.rpcUrl} serves ${live}. ` +
+                "Fix SMARTPOLICY_CHAIN_ID or SMARTPOLICY_RPC_URL — grants would otherwise be silently unverifiable.");
+        }
+    }
+    /** grant_verify (idea #2): off-chain pre-flight of a grant before broadcast. */
+    async verifyGrant(grant, signature) {
+        const tuple = {
+            policyId: BigInt(grant.policyId),
+            subject: grant.subject,
+            action: grant.action,
+            issuedAt: BigInt(grant.issuedAt),
+            expiresAt: BigInt(grant.expiresAt),
+            nonce: BigInt(grant.nonce),
+            issuer: grant.issuer,
+            target: grant.target,
+        };
+        const [valid, nonceUsed] = await Promise.all([
+            this.client.readContract({
+                address: this.config.verifier,
+                abi: verifierAbi,
+                functionName: "isGrantValid",
+                args: [tuple, signature],
+            }),
+            this.client.readContract({
+                address: this.config.verifier,
+                abi: verifierAbi,
+                functionName: "isNonceUsed",
+                args: [grant.issuer, BigInt(grant.nonce)],
+            }),
+        ]);
+        return { valid, nonceUsed };
+    }
+    /** policy_create: build the unsigned transaction; the caller signs it. */
+    async buildCreatePolicy(opts) {
+        const { creationFee } = await this.fees();
+        const flags = (opts.openMembership ? 1 : 0) | (opts.transferable ? 2 : 0);
+        const zeroHash = `0x${"0".repeat(64)}`;
+        return {
+            to: this.config.registry,
+            value: creationFee.toString(),
+            data: encodeFunctionData({
+                abi: registryAbi,
+                functionName: "createPolicy",
+                args: [flags, BigInt(opts.expiresAt ?? 0), opts.metadataURI ?? "", opts.metadataHash ?? zeroHash],
+            }),
+            description: "createPolicy — submit from the wallet that should OWN the policy. " +
+                "The new policyId is emitted in the PolicyCreated event (also: policyCount() after inclusion).",
+        };
+    }
+    /** policy_update: build the unsigned transaction for a rule change. */
+    async buildUpdate(policyId, op) {
+        const { updateFee } = await this.fees();
+        let data;
+        switch (op.kind) {
+            case "addMembers":
+                data = encodeFunctionData({ abi: registryAbi, functionName: "addMembers", args: [policyId, op.members] });
+                break;
+            case "removeMembers":
+                data = encodeFunctionData({ abi: registryAbi, functionName: "removeMembers", args: [policyId, op.members] });
+                break;
+            case "setActionRule":
+                data = encodeFunctionData({
+                    abi: registryAbi,
+                    functionName: "setActionRule",
+                    args: [policyId, toActionId(op.action), actionRuleNames.indexOf(op.rule)],
+                });
+                break;
+            case "addIssuer":
+                data = encodeFunctionData({ abi: registryAbi, functionName: "addIssuer", args: [policyId, op.issuer] });
+                break;
+            case "removeIssuer":
+                data = encodeFunctionData({ abi: registryAbi, functionName: "removeIssuer", args: [policyId, op.issuer] });
+                break;
+            case "addAdmin":
+                data = encodeFunctionData({ abi: registryAbi, functionName: "addAdmin", args: [policyId, op.admin] });
+                break;
+            case "removeAdmin":
+                data = encodeFunctionData({ abi: registryAbi, functionName: "removeAdmin", args: [policyId, op.admin] });
+                break;
+            case "setExpiry":
+                data = encodeFunctionData({
+                    abi: registryAbi,
+                    functionName: "setExpiry",
+                    args: [policyId, BigInt(op.expiresAt)],
+                });
+                break;
+        }
+        return {
+            to: this.config.registry,
+            value: updateFee.toString(),
+            data,
+            description: `${op.kind} on policy ${policyId} — submit from the policy owner or an admin wallet.`,
+        };
+    }
+}
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,IAAI,GAIL,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAuB,MAAM,UAAU,CAAC;AAC1F,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAgD1C,MAAM,OAAO,QAAQ;IAGU;IAFpB,MAAM,CAAe;IAE9B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QACzC,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAEO,IAAI,CAAI,YAAoB,EAAE,OAAkB,EAAE;QACxD,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAC9B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC7B,GAAG,EAAE,WAAW;YAChB,YAAY,EAAE,YAAqB;YACnC,IAAI,EAAE,IAAa;SACpB,CAAe,CAAC;IACnB,CAAC;IAED;;gEAE4D;IAC5D,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,OAAgB,EAAE,MAAc;QAC5D,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QACpC,8EAA8E;QAC9E,0EAA0E;QAC1E,oCAAoC;QACpC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,CAAC,YAAoB,EAAE,IAAe,EAAE,EAAE,CACvD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACvB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC7B,GAAG,EAAE,WAAW;YAChB,YAAY,EAAE,YAAqB;YACnC,IAAI,EAAE,IAAa;YACnB,WAAW;SACZ,CAAC,CAAC;QACL,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC;YACpE,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAClD,MAAM,CAAC,gBAAgB,EAAE,CAAC,QAAQ,CAAC,CAAC;YACpC,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,IAAI,EAAE,IAAI,QAAQ,IAAK,KAAgB,CAAC;YAC1F,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACvC,MAAM,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;SAC9C,CAAC,CAAiD,CAAC;QACpD,MAAM,IAAI,GAAmB,eAAe,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;QAEjE,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;YACvC,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;iBACxE,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;;gBACxF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC;QAChF,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAChG,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAS,aAAa,CAAC,CAAC;QACrD,IAAI,QAAQ,GAAG,EAAE,IAAI,QAAQ,GAAG,KAAK,EAAE,CAAC;YACtC,OAAO;gBACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;gBAC7B,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAa;gBACvC,SAAS,EAAE,OAAO;gBAClB,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,KAAK;gBACb,cAAc,EAAE,KAAK;gBACrB,YAAY,EAAE,KAAK;gBACnB,WAAW,EAAE,GAAG;gBAChB,WAAW,EAAE,EAAE;gBACf,YAAY,EAAE,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAS;aAC3C,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAClD,IAAI,CAAC,IAAI,CAON,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAU,gBAAgB,EAAE,CAAC,QAAQ,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI,CAAS,aAAa,EAAE,CAAC,QAAQ,CAAC,CAAC;SAC7C,CAAC,CAAC;QACH,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;YAC7B,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YACtG,MAAM;YACN,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,cAAc,EAAE,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;YACxC,YAAY,EAAE,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;YACtC,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACjD,IAAI,CAAC,IAAI,CAAS,aAAa,CAAC;YAChC,IAAI,CAAC,IAAI,CAAS,WAAW,CAAC;SAC/B,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAAgB,EAAE,MAAe;QACxD,OAAO,IAAI,CAAC,IAAI,CAAU,oBAAoB,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACtE,CAAC;IAED;;4DAEwD;IACxD,KAAK,CAAC,aAAa;QACjB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC5C,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,gCAAgC,IAAI,CAAC,MAAM,CAAC,OAAO,YAAY,IAAI,CAAC,MAAM,CAAC,MAAM,WAAW,IAAI,IAAI;gBAClG,oGAAoG,CACvG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,WAAW,CAAC,KAAiB,EAAE,SAAc;QACjD,MAAM,KAAK,GAAG;YACZ,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;YAChC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;YAChC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;YAClC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC;QACF,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;gBACvB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC7B,GAAG,EAAE,WAAW;gBAChB,YAAY,EAAE,cAAc;gBAC5B,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC;aACzB,CAAqB;YACtB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;gBACvB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC7B,GAAG,EAAE,WAAW;gBAChB,YAAY,EAAE,aAAa;gBAC3B,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;aAC1C,CAAqB;SACvB,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,iBAAiB,CAAC,IAMvB;QACC,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAS,CAAC;QAC9C,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YACxB,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;YAC7B,IAAI,EAAE,kBAAkB,CAAC;gBACvB,GAAG,EAAE,WAAW;gBAChB,YAAY,EAAE,cAAc;gBAC5B,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,IAAI,CAAC,YAAY,IAAI,QAAQ,CAAC;aAClG,CAAC;YACF,WAAW,EACT,oEAAoE;gBACpE,+FAA+F;SAClG,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,WAAW,CACf,QAAgB,EAChB,EAQ4C;QAE5C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,IAAS,CAAC;QACd,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;YAChB,KAAK,YAAY;gBACf,IAAI,GAAG,kBAAkB,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC1G,MAAM;YACR,KAAK,eAAe;gBAClB,IAAI,GAAG,kBAAkB,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC7G,MAAM;YACR,KAAK,eAAe;gBAClB,IAAI,GAAG,kBAAkB,CAAC;oBACxB,GAAG,EAAE,WAAW;oBAChB,YAAY,EAAE,eAAe;oBAC7B,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;iBAC1E,CAAC,CAAC;gBACH,MAAM;YACR,KAAK,WAAW;gBACd,IAAI,GAAG,kBAAkB,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxG,MAAM;YACR,KAAK,cAAc;gBACjB,IAAI,GAAG,kBAAkB,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC3G,MAAM;YACR,KAAK,UAAU;gBACb,IAAI,GAAG,kBAAkB,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACtG,MAAM;YACR,KAAK,aAAa;gBAChB,IAAI,GAAG,kBAAkB,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACzG,MAAM;YACR,KAAK,WAAW;gBACd,IAAI,GAAG,kBAAkB,CAAC;oBACxB,GAAG,EAAE,WAAW;oBAChB,YAAY,EAAE,WAAW;oBACzB,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;iBACvC,CAAC,CAAC;gBACH,MAAM;QACV,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YACxB,KAAK,EAAE,SAAS,CAAC,QAAQ,EAAE;YAC3B,IAAI;YACJ,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,cAAc,QAAQ,qDAAqD;SACnG,CAAC;IACJ,CAAC;CACF"}

package/dist/server.d.ts

@@ -0,0 +1,11 @@
+/**
+ * SmartPolicy MCP server construction — all tool registrations live here.
+ * Transports (stdio in index.ts, Streamable HTTP in http.ts) call buildServer
+ * per connection/request; Registry and GrantIssuer are shared singletons
+ * (grant nonces are random and stateless, so sharing is safe).
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { Config } from "./config.js";
+import type { GrantIssuer } from "./grants.js";
+import type { Registry } from "./registry.js";
+export declare function buildServer(config: Config, registry: Registry, issuer: GrantIssuer | undefined): McpServer;