agent-passport-system 4.1.1 → 4.2.0

package/dist/src/profiles/a2a/identity-v1.d.ts

@@ -0,0 +1,44 @@
+import type { HistoricalKeyResolver } from '../../v2/identity-binding/types.js';
+export declare const APS_A2A_IDENTITY_EXTENSION = "https://agent-passport.org/a2a/extensions/identity/v1";
+export interface A2AApsIdentityParamsV1 {
+    agent_id: string;
+    passport_uri: string;
+    passport_sha256: string;
+    principal_binding_uri?: string;
+    principal_binding_sha256?: string;
+    issued_at: string;
+    expires_at: string;
+}
+export interface A2AAgentCardSignature {
+    protected: string;
+    signature: string;
+    header?: Record<string, unknown>;
+}
+export type A2AAgentCardObject = Record<string, unknown> & {
+    capabilities: Record<string, unknown> & {
+        extensions?: unknown[];
+    };
+    signatures?: A2AAgentCardSignature[];
+};
+export interface A2AApsIdentityVerification {
+    state: 'valid' | 'invalid' | 'indeterminate' | 'unsupported';
+    code: string;
+    agent_id?: string;
+    card_signature: 'verified' | 'rejected' | 'unresolved';
+    passport: 'resolved' | 'mismatch' | 'unresolved';
+    principal_binding: 'resolved' | 'mismatch' | 'unresolved' | 'absent';
+}
+export declare function attachApsIdentityExtensionV1(card: A2AAgentCardObject, params: A2AApsIdentityParamsV1, required?: boolean): A2AAgentCardObject;
+export declare function signA2AAgentCardV1(card: A2AAgentCardObject, privateKeyHex: string, kid: string): A2AAgentCardObject;
+export declare function verifyApsA2AAgentCardV1(candidate: unknown, options: {
+    resolve_key: HistoricalKeyResolver;
+    resolve_artifact?: (uri: string) => Uint8Array | Promise<Uint8Array>;
+    now?: string;
+}): Promise<A2AApsIdentityVerification>;
+/** Legacy custom fields do not carry the A2A JWS payload and cannot verify. */
+export declare function assessLegacyAgentPassportExtension(_candidate: unknown): {
+    state: 'legacy_unverifiable';
+    code: 'A2A_LEGACY_EXTENSION_UNSIGNED_PROJECTION';
+};
+export declare function getApsIdentityParamsV1(card: A2AAgentCardObject): A2AApsIdentityParamsV1;
+//# sourceMappingURL=identity-v1.d.ts.map

package/dist/src/profiles/a2a/identity-v1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-v1.d.ts","sourceRoot":"","sources":["../../../../src/profiles/a2a/identity-v1.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAA;AAS/E,eAAO,MAAM,0BAA0B,0DAA0D,CAAA;AAEjG,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,EAAE,MAAM,CAAA;IACvB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IACzD,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;QAAE,UAAU,CAAC,EAAE,OAAO,EAAE,CAAA;KAAE,CAAA;IAClE,UAAU,CAAC,EAAE,qBAAqB,EAAE,CAAA;CACrC,CAAA;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,eAAe,GAAG,aAAa,CAAA;IAC5D,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,UAAU,GAAG,UAAU,GAAG,YAAY,CAAA;IACtD,QAAQ,EAAE,UAAU,GAAG,UAAU,GAAG,YAAY,CAAA;IAChD,iBAAiB,EAAE,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,QAAQ,CAAA;CACrE;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,sBAAsB,EAC9B,QAAQ,UAAQ,GACf,kBAAkB,CAqBpB;AAED,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,kBAAkB,EACxB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,GACV,kBAAkB,CAcpB;AAED,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE;IACP,WAAW,EAAE,qBAAqB,CAAA;IAClC,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACpE,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GACA,OAAO,CAAC,0BAA0B,CAAC,CA6FrC;AAED,+EAA+E;AAC/E,wBAAgB,kCAAkC,CAAC,UAAU,EAAE,OAAO,GAAG;IACvE,KAAK,EAAE,qBAAqB,CAAA;IAC5B,IAAI,EAAE,0CAA0C,CAAA;CACjD,CAEA;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,kBAAkB,GAAG,sBAAsB,CAQvF"}

package/dist/src/profiles/a2a/identity-v1.js

@@ -0,0 +1,208 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { createHash } from 'node:crypto';
+import { canonicalizeJCS } from '../../core/canonical-jcs.js';
+import { sign, verify } from '../../crypto/keys.js';
+import { assertExactKeys, assertHex, assertIJson, assertPlainRecord, assertUtcMilliseconds, } from '../../v2/identity-binding/validation.js';
+export const APS_A2A_IDENTITY_EXTENSION = 'https://agent-passport.org/a2a/extensions/identity/v1';
+export function attachApsIdentityExtensionV1(card, params, required = false) {
+    validateParams(params);
+    const existing = Array.isArray(card.capabilities.extensions)
+        ? card.capabilities.extensions.filter((entry) => !isExtensionWithUri(entry, APS_A2A_IDENTITY_EXTENSION))
+        : [];
+    const result = {
+        ...card,
+        capabilities: {
+            ...card.capabilities,
+            extensions: [...existing, {
+                    uri: APS_A2A_IDENTITY_EXTENSION,
+                    description: 'APS verifiable agent identity and principal-binding references',
+                    required,
+                    params,
+                }],
+        },
+    };
+    delete result.signatures;
+    assertIJson(result);
+    return result;
+}
+export function signA2AAgentCardV1(card, privateKeyHex, kid) {
+    const unsigned = withoutSignatures(card);
+    assertIJson(unsigned);
+    const extension = getApsIdentityParamsV1(unsigned);
+    if (!kid.startsWith(`${extension.agent_id}#`))
+        throw new Error('A2A signature kid is not controlled by agent_id');
+    const protectedHeader = canonicalizeJCS({ alg: 'EdDSA', kid, typ: 'JOSE' });
+    const protectedB64 = base64url(Buffer.from(protectedHeader, 'utf8'));
+    const payloadB64 = base64url(Buffer.from(canonicalizeJCS(unsigned), 'utf8'));
+    const signatureHex = sign(`${protectedB64}.${payloadB64}`, privateKeyHex);
+    const signature = {
+        protected: protectedB64,
+        signature: base64url(Buffer.from(signatureHex, 'hex')),
+    };
+    return { ...unsigned, signatures: [signature] };
+}
+export async function verifyApsA2AAgentCardV1(candidate, options) {
+    let card;
+    let params;
+    try {
+        assertPlainRecord(candidate, 'Agent Card');
+        card = candidate;
+        assertIJson(card);
+        params = getApsIdentityParamsV1(card);
+        if (!Array.isArray(card.signatures) || card.signatures.length === 0)
+            throw new Error('missing signatures');
+    }
+    catch {
+        return result('invalid', 'A2A_CARD_MALFORMED', 'rejected');
+    }
+    const now = options.now ?? new Date().toISOString();
+    if (now < params.issued_at || now >= params.expires_at) {
+        return result('invalid', 'A2A_IDENTITY_EXTENSION_NOT_CURRENT', 'rejected', params.agent_id);
+    }
+    const unsigned = withoutSignatures(card);
+    const payloadB64 = base64url(Buffer.from(canonicalizeJCS(unsigned), 'utf8'));
+    let unresolvedKey = false;
+    let verifiedSignature = false;
+    for (const signature of card.signatures ?? []) {
+        let header;
+        try {
+            const raw = Buffer.from(signature.protected, 'base64url').toString('utf8');
+            header = JSON.parse(raw);
+            assertExactKeys(header, ['alg', 'kid', 'typ'], [], 'JWS protected header');
+            if (header.alg !== 'EdDSA' || header.typ !== 'JOSE' || typeof header.kid !== 'string')
+                continue;
+            if (!header.kid.startsWith(`${params.agent_id}#`))
+                continue;
+        }
+        catch {
+            continue;
+        }
+        const resolution = await options.resolve_key({
+            controller: params.agent_id,
+            verification_method: String(header.kid),
+            at: params.issued_at,
+        });
+        if (resolution.state === 'unreachable')
+            unresolvedKey = true;
+        if (resolution.state !== 'resolved' || !resolution.public_key_hex)
+            continue;
+        let signatureHex;
+        try {
+            signatureHex = Buffer.from(signature.signature, 'base64url').toString('hex');
+        }
+        catch {
+            continue;
+        }
+        if (verify(`${signature.protected}.${payloadB64}`, signatureHex, resolution.public_key_hex)) {
+            verifiedSignature = true;
+            break;
+        }
+    }
+    if (!verifiedSignature) {
+        return result(unresolvedKey ? 'indeterminate' : 'invalid', unresolvedKey ? 'A2A_SIGNING_KEY_UNREACHABLE' : 'A2A_SIGNATURE_INVALID', unresolvedKey ? 'unresolved' : 'rejected', params.agent_id);
+    }
+    if (!options.resolve_artifact) {
+        return {
+            ...result('indeterminate', 'A2A_IDENTITY_ARTIFACTS_UNRESOLVED', 'verified', params.agent_id),
+            passport: 'unresolved',
+            principal_binding: params.principal_binding_uri ? 'unresolved' : 'absent',
+        };
+    }
+    const passport = await resolveDigest(options.resolve_artifact, params.passport_uri, params.passport_sha256);
+    const principal = params.principal_binding_uri && params.principal_binding_sha256
+        ? await resolveDigest(options.resolve_artifact, params.principal_binding_uri, params.principal_binding_sha256)
+        : 'absent';
+    if (passport === 'mismatch' || principal === 'mismatch') {
+        return {
+            ...result('invalid', 'A2A_IDENTITY_ARTIFACT_DIGEST_MISMATCH', 'verified', params.agent_id),
+            passport,
+            principal_binding: principal,
+        };
+    }
+    if (passport === 'unresolved' || principal === 'unresolved') {
+        return {
+            ...result('indeterminate', 'A2A_IDENTITY_ARTIFACT_UNREACHABLE', 'verified', params.agent_id),
+            passport,
+            principal_binding: principal,
+        };
+    }
+    return {
+        state: 'valid',
+        code: 'OK',
+        agent_id: params.agent_id,
+        card_signature: 'verified',
+        passport,
+        principal_binding: principal,
+    };
+}
+/** Legacy custom fields do not carry the A2A JWS payload and cannot verify. */
+export function assessLegacyAgentPassportExtension(_candidate) {
+    return { state: 'legacy_unverifiable', code: 'A2A_LEGACY_EXTENSION_UNSIGNED_PROJECTION' };
+}
+export function getApsIdentityParamsV1(card) {
+    const extensions = card.capabilities?.extensions;
+    if (!Array.isArray(extensions))
+        throw new Error('A2A Agent Card has no extensions');
+    const matches = extensions.filter((entry) => isExtensionWithUri(entry, APS_A2A_IDENTITY_EXTENSION));
+    if (matches.length !== 1)
+        throw new Error('A2A Agent Card must carry exactly one APS identity extension');
+    const extension = matches[0];
+    validateParams(extension.params);
+    return extension.params;
+}
+function validateParams(value) {
+    assertPlainRecord(value, 'APS A2A identity params');
+    assertExactKeys(value, [
+        'agent_id', 'passport_uri', 'passport_sha256', 'issued_at', 'expires_at',
+    ], ['principal_binding_uri', 'principal_binding_sha256'], 'APS A2A identity params');
+    if (typeof value.agent_id !== 'string' || !value.agent_id.startsWith('did:'))
+        throw new Error('agent_id');
+    if (typeof value.passport_uri !== 'string' || !/^https:\/\//.test(value.passport_uri))
+        throw new Error('passport_uri');
+    assertHex(String(value.passport_sha256), 64, 'passport_sha256');
+    const hasBindingUri = typeof value.principal_binding_uri === 'string';
+    const hasBindingHash = typeof value.principal_binding_sha256 === 'string';
+    if (hasBindingUri !== hasBindingHash)
+        throw new Error('principal binding URI and digest must appear together');
+    if (hasBindingUri && !/^https:\/\//.test(String(value.principal_binding_uri)))
+        throw new Error('principal_binding_uri');
+    if (hasBindingHash)
+        assertHex(String(value.principal_binding_sha256), 64, 'principal_binding_sha256');
+    assertUtcMilliseconds(String(value.issued_at), 'issued_at');
+    assertUtcMilliseconds(String(value.expires_at), 'expires_at');
+    if (String(value.issued_at) >= String(value.expires_at))
+        throw new Error('A2A extension time window');
+}
+function withoutSignatures(card) {
+    const { signatures: _signatures, ...unsigned } = card;
+    return structuredClone(unsigned);
+}
+function isExtensionWithUri(value, uri) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) &&
+        value.uri === uri;
+}
+async function resolveDigest(resolve, uri, expected) {
+    try {
+        const bytes = await resolve(uri);
+        const actual = createHash('sha256').update(bytes).digest('hex');
+        return actual === expected ? 'resolved' : 'mismatch';
+    }
+    catch {
+        return 'unresolved';
+    }
+}
+function base64url(value) {
+    return Buffer.from(value).toString('base64url');
+}
+function result(state, code, signature, agentId) {
+    return {
+        state,
+        code,
+        ...(agentId === undefined ? {} : { agent_id: agentId }),
+        card_signature: signature,
+        passport: 'unresolved',
+        principal_binding: 'unresolved',
+    };
+}
+//# sourceMappingURL=identity-v1.js.map

package/dist/src/profiles/a2a/identity-v1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-v1.js","sourceRoot":"","sources":["../../../../src/profiles/a2a/identity-v1.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAEnD,OAAO,EACL,eAAe,EACf,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,yCAAyC,CAAA;AAEhD,MAAM,CAAC,MAAM,0BAA0B,GAAG,uDAAuD,CAAA;AAgCjG,MAAM,UAAU,4BAA4B,CAC1C,IAAwB,EACxB,MAA8B,EAC9B,QAAQ,GAAG,KAAK;IAEhB,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC;QAC1D,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAC9C,CAAC,kBAAkB,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;QACzD,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,MAAM,GAAuB;QACjC,GAAG,IAAI;QACP,YAAY,EAAE;YACZ,GAAG,IAAI,CAAC,YAAY;YACpB,UAAU,EAAE,CAAC,GAAG,QAAQ,EAAE;oBACxB,GAAG,EAAE,0BAA0B;oBAC/B,WAAW,EAAE,gEAAgE;oBAC7E,QAAQ;oBACR,MAAM;iBACP,CAAC;SACH;KACF,CAAA;IACD,OAAO,MAAM,CAAC,UAAU,CAAA;IACxB,WAAW,CAAC,MAAM,CAAC,CAAA;IACnB,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,IAAwB,EACxB,aAAqB,EACrB,GAAW;IAEX,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACxC,WAAW,CAAC,QAAQ,CAAC,CAAA;IACrB,MAAM,SAAS,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAClD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC,QAAQ,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACjH,MAAM,eAAe,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;IAC3E,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAA;IACpE,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;IAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,YAAY,IAAI,UAAU,EAAE,EAAE,aAAa,CAAC,CAAA;IACzE,MAAM,SAAS,GAA0B;QACvC,SAAS,EAAE,YAAY;QACvB,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;KACvD,CAAA;IACD,OAAO,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,CAAA;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAkB,EAClB,OAIC;IAED,IAAI,IAAwB,CAAA;IAC5B,IAAI,MAA8B,CAAA;IAClC,IAAI,CAAC;QACH,iBAAiB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;QAC1C,IAAI,GAAG,SAA+B,CAAA;QACtC,WAAW,CAAC,IAAI,CAAC,CAAA;QACjB,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;QACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IAC5G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,SAAS,EAAE,oBAAoB,EAAE,UAAU,CAAC,CAAA;IAC5D,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACnD,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACvD,OAAO,MAAM,CAAC,SAAS,EAAE,oCAAoC,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC7F,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACxC,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;IAC5E,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,IAAI,iBAAiB,GAAG,KAAK,CAAA;IAC7B,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QAC9C,IAAI,MAA+B,CAAA;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAC1E,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAA;YACnD,eAAe,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,sBAAsB,CAAC,CAAA;YAC1E,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;gBAAE,SAAQ;YAC/F,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC;gBAAE,SAAQ;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC;YAC3C,UAAU,EAAE,MAAM,CAAC,QAAQ;YAC3B,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;YACvC,EAAE,EAAE,MAAM,CAAC,SAAS;SACrB,CAAC,CAAA;QACF,IAAI,UAAU,CAAC,KAAK,KAAK,aAAa;YAAE,aAAa,GAAG,IAAI,CAAA;QAC5D,IAAI,UAAU,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,UAAU,CAAC,cAAc;YAAE,SAAQ;QAC3E,IAAI,YAAoB,CAAA;QACxB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,SAAS,IAAI,UAAU,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC5F,iBAAiB,GAAG,IAAI,CAAA;YACxB,MAAK;QACP,CAAC;IACH,CAAC;IACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,MAAM,CACX,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,EAC3C,aAAa,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,uBAAuB,EACvE,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,EACzC,MAAM,CAAC,QAAQ,CAChB,CAAA;IACH,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC9B,OAAO;YACL,GAAG,MAAM,CAAC,eAAe,EAAE,mCAAmC,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YAC5F,QAAQ,EAAE,YAAY;YACtB,iBAAiB,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ;SAC1E,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC,CAAA;IAC3G,MAAM,SAAS,GAAG,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,wBAAwB;QAC/E,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,wBAAwB,CAAC;QAC9G,CAAC,CAAC,QAAQ,CAAA;IACZ,IAAI,QAAQ,KAAK,UAAU,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QACxD,OAAO;YACL,GAAG,MAAM,CAAC,SAAS,EAAE,uCAAuC,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YAC1F,QAAQ;YACR,iBAAiB,EAAE,SAAS;SAC7B,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,YAAY,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC5D,OAAO;YACL,GAAG,MAAM,CAAC,eAAe,EAAE,mCAAmC,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YAC5F,QAAQ;YACR,iBAAiB,EAAE,SAAS;SAC7B,CAAA;IACH,CAAC;IACD,OAAO;QACL,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,UAAU;QAC1B,QAAQ;QACR,iBAAiB,EAAE,SAAS;KAC7B,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kCAAkC,CAAC,UAAmB;IAIpE,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,0CAA0C,EAAE,CAAA;AAC3F,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAwB;IAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,UAAU,CAAA;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACnF,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC,CAAA;IACnG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;IACzG,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAA4B,CAAA;IACvD,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAChC,OAAO,SAAS,CAAC,MAA2C,CAAA;AAC9D,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAA;IACnD,eAAe,CAAC,KAAK,EAAE;QACrB,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,WAAW,EAAE,YAAY;KACzE,EAAE,CAAC,uBAAuB,EAAE,0BAA0B,CAAC,EAAE,yBAAyB,CAAC,CAAA;IACpF,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAA;IACzG,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;IACtH,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAA;IAC/D,MAAM,aAAa,GAAG,OAAO,KAAK,CAAC,qBAAqB,KAAK,QAAQ,CAAA;IACrE,MAAM,cAAc,GAAG,OAAO,KAAK,CAAC,wBAAwB,KAAK,QAAQ,CAAA;IACzE,IAAI,aAAa,KAAK,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC9G,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IACvH,IAAI,cAAc;QAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,EAAE,EAAE,0BAA0B,CAAC,CAAA;IACrG,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,CAAA;IAC3D,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAA;IAC7D,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;AACvG,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAwB;IACjD,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAA;IACrD,OAAO,eAAe,CAAC,QAAQ,CAAuB,CAAA;AACxD,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,GAAW;IACrD,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACxE,KAAiC,CAAC,GAAG,KAAK,GAAG,CAAA;AAClD,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,OAA0D,EAC1D,GAAW,EACX,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC/D,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,CAAA;IACrB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,MAAM,CACb,KAA0C,EAC1C,IAAY,EACZ,SAAuD,EACvD,OAAgB;IAEhB,OAAO;QACL,KAAK;QACL,IAAI;QACJ,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACvD,cAAc,EAAE,SAAS;QACzB,QAAQ,EAAE,YAAY;QACtB,iBAAiB,EAAE,YAAY;KAChC,CAAA;AACH,CAAC"}

package/dist/src/profiles/a2a/index.d.ts

@@ -0,0 +1,2 @@
+export * from './identity-v1.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/profiles/a2a/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/profiles/a2a/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAA"}

package/dist/src/profiles/a2a/index.js

@@ -0,0 +1,2 @@
+export * from './identity-v1.js';
+//# sourceMappingURL=index.js.map

package/dist/src/profiles/a2a/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/profiles/a2a/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAA"}

package/dist/src/profiles/mcp/authorization-v1.d.ts

@@ -0,0 +1,88 @@
+import type { HistoricalKeyResolver } from '../../v2/identity-binding/types.js';
+export declare const APS_MCP_AUTHORIZATION_META = "org.agent-passport/authorization";
+export declare const APS_MCP_RECEIPT_META = "org.agent-passport/receipt";
+export interface ApsMcpSpendV1 {
+    unit: string;
+    amount: string;
+}
+export interface ApsMcpAuthorizationV1 {
+    profile: 'aps-mcp-1';
+    agent_id: string;
+    verification_method: string;
+    delegation_ref: string;
+    mcp_server: string;
+    method: 'tools/call';
+    tool_name: string;
+    arguments_hash: string;
+    scope_required: string[];
+    spend?: ApsMcpSpendV1;
+    nonce: string;
+    issued_at: string;
+    expires_at: string;
+    action_ref: string;
+    signature: string;
+}
+export interface McpToolCallRequest {
+    method: 'tools/call';
+    params: {
+        name: string;
+        arguments?: Record<string, unknown>;
+        _meta?: Record<string, unknown>;
+    };
+}
+export interface McpToolCallResult extends Record<string, unknown> {
+    _meta?: Record<string, unknown>;
+}
+export interface ApsMcpAuthorityDecision {
+    state: 'permit' | 'deny' | 'indeterminate';
+    code: string;
+    decision_ref?: string;
+}
+export interface ApsMcpMiddlewareContext {
+    /** Set only after MCP transport OAuth/resource validation has succeeded. */
+    transport_authenticated: boolean;
+}
+export declare class ApsMcpAuthorizationError extends Error {
+    readonly code: string;
+    constructor(code: string);
+}
+export declare function computeMcpArgumentsHashV1(argumentsValue: Record<string, unknown>): string;
+export declare function issueApsMcpAuthorizationV1(input: {
+    agent_id: string;
+    verification_method: string;
+    delegation_ref: string;
+    mcp_server: string;
+    tool_name: string;
+    arguments: Record<string, unknown>;
+    scope_required: readonly string[];
+    spend?: ApsMcpSpendV1;
+    nonce: string;
+    issued_at: string;
+    expires_at: string;
+    private_key_hex: string;
+}): ApsMcpAuthorizationV1;
+export declare function verifyApsMcpAuthorizationV1(candidate: unknown, expected: {
+    mcp_server: string;
+    tool_name: string;
+    arguments: Record<string, unknown>;
+    now?: string;
+    resolve_key: HistoricalKeyResolver;
+}): Promise<{
+    state: 'valid' | 'invalid' | 'indeterminate';
+    code: string;
+    authorization?: ApsMcpAuthorizationV1;
+}>;
+/**
+ * Creates an unavoidable pre-dispatch guard for an MCP tools/call handler.
+ * Transport OAuth is checked first. The APS intent, replay claim, authority
+ * decision, and budget reservation all complete before dispatch is invoked.
+ */
+export declare function createApsMcpToolCallMiddleware(options: {
+    mcp_server: string;
+    resolve_key: HistoricalKeyResolver;
+    consume_action_ref: (actionRef: string, expiresAt: string) => boolean | Promise<boolean>;
+    evaluate_authority: (authorization: ApsMcpAuthorizationV1, request: McpToolCallRequest) => ApsMcpAuthorityDecision | Promise<ApsMcpAuthorityDecision>;
+    emit_receipt: (authorization: ApsMcpAuthorizationV1, authority: ApsMcpAuthorityDecision, result: McpToolCallResult) => unknown | Promise<unknown>;
+}): (request: McpToolCallRequest, context: ApsMcpMiddlewareContext, dispatch: (request: McpToolCallRequest) => McpToolCallResult | Promise<McpToolCallResult>) => Promise<McpToolCallResult>;
+export declare function canonicalMcpServerUri(value: string): string;
+//# sourceMappingURL=authorization-v1.d.ts.map

package/dist/src/profiles/mcp/authorization-v1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-v1.d.ts","sourceRoot":"","sources":["../../../../src/profiles/mcp/authorization-v1.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAA;AAW/E,eAAO,MAAM,0BAA0B,qCAAqC,CAAA;AAC5E,eAAO,MAAM,oBAAoB,+BAA+B,CAAA;AAIhE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,WAAW,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,YAAY,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,KAAK,CAAC,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,YAAY,CAAA;IACpB,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAA;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACnC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAChC,CAAA;CACF;AAED,MAAM,WAAW,iBAAkB,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,QAAQ,GAAG,MAAM,GAAG,eAAe,CAAA;IAC1C,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,4EAA4E;IAC5E,uBAAuB,EAAE,OAAO,CAAA;CACjC;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAjC,YAAqB,IAAI,EAAE,MAAM,EAGhC;CACF;AAED,wBAAgB,yBAAyB,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAKzF;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,QAAQ,EAAE,MAAM,CAAA;IAChB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,KAAK,CAAC,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;CACxB,GAAG,qBAAqB,CAqCxB;AAED,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,OAAO,EAClB,QAAQ,EAAE;IACR,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,qBAAqB,CAAA;CACnC,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,eAAe,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,qBAAqB,CAAA;CAAE,CAAC,CA+ChH;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE;IACtD,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,qBAAqB,CAAA;IAClC,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACxF,kBAAkB,EAAE,CAClB,aAAa,EAAE,qBAAqB,EACpC,OAAO,EAAE,kBAAkB,KACxB,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;IAC/D,YAAY,EAAE,CACZ,aAAa,EAAE,qBAAqB,EACpC,SAAS,EAAE,uBAAuB,EAClC,MAAM,EAAE,iBAAiB,KACtB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAChC,aAEY,kBAAkB,WAClB,uBAAuB,YACtB,CAAC,OAAO,EAAE,kBAAkB,KAAK,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,KACxF,OAAO,CAAC,iBAAiB,CAAC,CAgC9B;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAU3D"}

package/dist/src/profiles/mcp/authorization-v1.js

@@ -0,0 +1,215 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { createHash } from 'node:crypto';
+import { canonicalizeJCS } from '../../core/canonical-jcs.js';
+import { sign, verify } from '../../crypto/keys.js';
+import { computeActionRefV2, createActionReferenceInputV2, } from '../../v2/action-reference/v2.js';
+import { assertExactKeys, assertHex, assertIJson, assertPlainRecord, assertSortedUnique, assertUtcMilliseconds, sortedUnique, } from '../../v2/identity-binding/validation.js';
+export const APS_MCP_AUTHORIZATION_META = 'org.agent-passport/authorization';
+export const APS_MCP_RECEIPT_META = 'org.agent-passport/receipt';
+const INTENT_DOMAIN = 'APS-MCP-INTENT-V1\0';
+const ARGUMENTS_DOMAIN = 'APS-MCP-ARGUMENTS-V1\0';
+export class ApsMcpAuthorizationError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = 'ApsMcpAuthorizationError';
+    }
+}
+export function computeMcpArgumentsHashV1(argumentsValue) {
+    assertIJson(argumentsValue);
+    return createHash('sha256')
+        .update(ARGUMENTS_DOMAIN + canonicalizeJCS(argumentsValue), 'utf8')
+        .digest('hex');
+}
+export function issueApsMcpAuthorizationV1(input) {
+    const server = canonicalMcpServerUri(input.mcp_server);
+    const argumentsHash = computeMcpArgumentsHashV1(input.arguments);
+    const scopes = sortedUnique(input.scope_required.map((scope) => scope.normalize('NFC')), 'scope_required');
+    const actionRef = computeActionRefV2(createActionReferenceInputV2({
+        agent_id: input.agent_id,
+        action_type: 'mcp:tools/call',
+        target: `${server}#tool=${encodeURIComponent(input.tool_name)}`,
+        payload_ref: argumentsHash,
+        scope_required: scopes,
+        issued_at: input.issued_at,
+        nonce: input.nonce,
+    }));
+    const unsigned = {
+        profile: 'aps-mcp-1',
+        agent_id: input.agent_id,
+        verification_method: input.verification_method,
+        delegation_ref: input.delegation_ref,
+        mcp_server: server,
+        method: 'tools/call',
+        tool_name: input.tool_name,
+        arguments_hash: argumentsHash,
+        scope_required: scopes,
+        ...(input.spend === undefined ? {} : { spend: input.spend }),
+        nonce: input.nonce,
+        issued_at: input.issued_at,
+        expires_at: input.expires_at,
+        action_ref: actionRef,
+    };
+    validateAuthorizationUnsigned(unsigned);
+    return {
+        ...unsigned,
+        signature: sign(INTENT_DOMAIN + canonicalizeJCS(unsigned), input.private_key_hex),
+    };
+}
+export async function verifyApsMcpAuthorizationV1(candidate, expected) {
+    let authorization;
+    try {
+        authorization = validateAuthorization(candidate);
+    }
+    catch {
+        return { state: 'invalid', code: 'MCP_AUTHORIZATION_MALFORMED' };
+    }
+    const expectedServer = canonicalMcpServerUri(expected.mcp_server);
+    if (authorization.mcp_server !== expectedServer || authorization.tool_name !== expected.tool_name) {
+        return { state: 'invalid', code: 'MCP_TARGET_MISMATCH' };
+    }
+    const argumentsHash = computeMcpArgumentsHashV1(expected.arguments);
+    if (argumentsHash !== authorization.arguments_hash) {
+        return { state: 'invalid', code: 'MCP_ARGUMENTS_MISMATCH' };
+    }
+    const recomputedActionRef = computeActionRefV2(createActionReferenceInputV2({
+        agent_id: authorization.agent_id,
+        action_type: 'mcp:tools/call',
+        target: `${authorization.mcp_server}#tool=${encodeURIComponent(authorization.tool_name)}`,
+        payload_ref: authorization.arguments_hash,
+        scope_required: authorization.scope_required,
+        issued_at: authorization.issued_at,
+        nonce: authorization.nonce,
+    }));
+    if (recomputedActionRef !== authorization.action_ref) {
+        return { state: 'invalid', code: 'MCP_ACTION_REF_MISMATCH' };
+    }
+    const now = expected.now ?? new Date().toISOString();
+    if (now < authorization.issued_at || now >= authorization.expires_at) {
+        return { state: 'invalid', code: 'MCP_AUTHORIZATION_NOT_CURRENT' };
+    }
+    const resolution = await expected.resolve_key({
+        controller: authorization.agent_id,
+        verification_method: authorization.verification_method,
+        at: authorization.issued_at,
+    });
+    if (resolution.state !== 'resolved' || !resolution.public_key_hex) {
+        return {
+            state: resolution.state === 'unreachable' ? 'indeterminate' : 'invalid',
+            code: `MCP_SIGNING_KEY_${resolution.state.toUpperCase()}`,
+        };
+    }
+    const unsigned = omit(authorization, ['signature']);
+    if (!verify(INTENT_DOMAIN + canonicalizeJCS(unsigned), authorization.signature, resolution.public_key_hex)) {
+        return { state: 'invalid', code: 'MCP_SIGNATURE_INVALID' };
+    }
+    return { state: 'valid', code: 'OK', authorization };
+}
+/**
+ * Creates an unavoidable pre-dispatch guard for an MCP tools/call handler.
+ * Transport OAuth is checked first. The APS intent, replay claim, authority
+ * decision, and budget reservation all complete before dispatch is invoked.
+ */
+export function createApsMcpToolCallMiddleware(options) {
+    return async function apsMcpToolCall(request, context, dispatch) {
+        if (!context.transport_authenticated)
+            throw new ApsMcpAuthorizationError('MCP_TRANSPORT_UNAUTHENTICATED');
+        if (request.method !== 'tools/call')
+            throw new ApsMcpAuthorizationError('MCP_METHOD_UNSUPPORTED');
+        const metadata = request.params._meta;
+        const candidate = metadata?.[APS_MCP_AUTHORIZATION_META];
+        const verification = await verifyApsMcpAuthorizationV1(candidate, {
+            mcp_server: options.mcp_server,
+            tool_name: request.params.name,
+            arguments: request.params.arguments ?? {},
+            resolve_key: options.resolve_key,
+        });
+        if (verification.state !== 'valid' || !verification.authorization) {
+            throw new ApsMcpAuthorizationError(verification.code);
+        }
+        if (!await options.consume_action_ref(verification.authorization.action_ref, verification.authorization.expires_at))
+            throw new ApsMcpAuthorizationError('MCP_ACTION_REPLAY');
+        const authority = await options.evaluate_authority(verification.authorization, request);
+        if (authority.state !== 'permit')
+            throw new ApsMcpAuthorizationError(authority.code);
+        const dispatched = await dispatch(request);
+        const receipt = await options.emit_receipt(verification.authorization, authority, dispatched);
+        return {
+            ...dispatched,
+            _meta: {
+                ...(dispatched._meta ?? {}),
+                [APS_MCP_RECEIPT_META]: receipt,
+            },
+        };
+    };
+}
+export function canonicalMcpServerUri(value) {
+    const parsed = new URL(value);
+    if (!['https:', 'http:'].includes(parsed.protocol) || parsed.username || parsed.password || parsed.hash) {
+        throw new Error('Invalid MCP server resource URI');
+    }
+    if (parsed.protocol === 'http:' && !['localhost', '127.0.0.1', '[::1]'].includes(parsed.hostname)) {
+        throw new Error('MCP server resource URI requires HTTPS outside localhost');
+    }
+    if (parsed.pathname === '/' && !parsed.search)
+        parsed.pathname = '';
+    return parsed.toString().replace(/\/$/, '');
+}
+function validateAuthorization(candidate) {
+    assertPlainRecord(candidate, 'MCP authorization');
+    assertExactKeys(candidate, [
+        'profile', 'agent_id', 'verification_method', 'delegation_ref', 'mcp_server',
+        'method', 'tool_name', 'arguments_hash', 'scope_required', 'nonce',
+        'issued_at', 'expires_at', 'action_ref', 'signature',
+    ], ['spend'], 'MCP authorization');
+    const unsigned = omit(candidate, ['signature']);
+    validateAuthorizationUnsigned(unsigned);
+    assertHex(String(candidate.signature), 128, 'signature');
+    return candidate;
+}
+function validateAuthorizationUnsigned(value) {
+    assertIJson(value);
+    if (value.profile !== 'aps-mcp-1' || value.method !== 'tools/call')
+        throw new Error('MCP profile');
+    if (!/^did:[a-z0-9]+:.+$/.test(value.agent_id))
+        throw new Error('agent_id');
+    if (!value.verification_method.startsWith(`${value.agent_id}#`))
+        throw new Error('verification_method');
+    if (typeof value.delegation_ref !== 'string' || value.delegation_ref.length === 0)
+        throw new Error('delegation_ref');
+    if (canonicalMcpServerUri(value.mcp_server) !== value.mcp_server)
+        throw new Error('non-canonical mcp_server');
+    if (!/^[A-Za-z0-9_.-]{1,128}$/.test(value.tool_name))
+        throw new Error('tool_name');
+    assertHex(value.arguments_hash, 64, 'arguments_hash');
+    if (!Array.isArray(value.scope_required))
+        throw new Error('scope_required');
+    assertSortedUnique(value.scope_required, 'scope_required');
+    for (const scope of value.scope_required)
+        if (scope !== scope.normalize('NFC'))
+            throw new Error('scope_required NFC');
+    if (value.spend !== undefined) {
+        assertPlainRecord(value.spend, 'spend');
+        assertExactKeys(value.spend, ['unit', 'amount'], [], 'spend');
+        if (!/^[A-Za-z0-9:._-]{1,64}$/.test(value.spend.unit))
+            throw new Error('spend unit');
+        if (!/^(0|[1-9]\d{0,18})$/.test(value.spend.amount))
+            throw new Error('spend amount');
+    }
+    assertHex(value.nonce, 32, 'nonce');
+    assertUtcMilliseconds(value.issued_at, 'issued_at');
+    assertUtcMilliseconds(value.expires_at, 'expires_at');
+    if (value.issued_at >= value.expires_at)
+        throw new Error('authorization time window');
+    assertHex(value.action_ref, 64, 'action_ref');
+}
+function omit(value, keys) {
+    const result = {};
+    for (const [key, entry] of Object.entries(value))
+        if (!keys.includes(key))
+            result[key] = entry;
+    return result;
+}
+//# sourceMappingURL=authorization-v1.js.map

package/dist/src/profiles/mcp/authorization-v1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-v1.js","sourceRoot":"","sources":["../../../../src/profiles/mcp/authorization-v1.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EACL,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,iCAAiC,CAAA;AAExC,OAAO,EACL,eAAe,EACf,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,YAAY,GACb,MAAM,yCAAyC,CAAA;AAEhD,MAAM,CAAC,MAAM,0BAA0B,GAAG,kCAAkC,CAAA;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,4BAA4B,CAAA;AAChE,MAAM,aAAa,GAAG,qBAAqB,CAAA;AAC3C,MAAM,gBAAgB,GAAG,wBAAwB,CAAA;AAiDjD,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAC5B,IAAI;IAAzB,YAAqB,IAAY;QAC/B,KAAK,CAAC,IAAI,CAAC,CAAA;oBADQ,IAAI;QAEvB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAED,MAAM,UAAU,yBAAyB,CAAC,cAAuC;IAC/E,WAAW,CAAC,cAAc,CAAC,CAAA;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,gBAAgB,GAAG,eAAe,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;SAClE,MAAM,CAAC,KAAK,CAAC,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAa1C;IACC,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IACtD,MAAM,aAAa,GAAG,yBAAyB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAChE,MAAM,MAAM,GAAG,YAAY,CACzB,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAC3D,gBAAgB,CACjB,CAAA;IACD,MAAM,SAAS,GAAG,kBAAkB,CAAC,4BAA4B,CAAC;QAChE,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,gBAAgB;QAC7B,MAAM,EAAE,GAAG,MAAM,SAAS,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE;QAC/D,WAAW,EAAE,aAAa;QAC1B,cAAc,EAAE,MAAM;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC,CAAA;IACH,MAAM,QAAQ,GAA6C;QACzD,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU,EAAE,MAAM;QAClB,MAAM,EAAE,YAAY;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,aAAa;QAC7B,cAAc,EAAE,MAAM;QACtB,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5D,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,SAAS;KACtB,CAAA;IACD,6BAA6B,CAAC,QAAQ,CAAC,CAAA;IACvC,OAAO;QACL,GAAG,QAAQ;QACX,SAAS,EAAE,IAAI,CAAC,aAAa,GAAG,eAAe,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC;KAClF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,SAAkB,EAClB,QAMC;IAED,IAAI,aAAoC,CAAA;IACxC,IAAI,CAAC;QACH,aAAa,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAA;IAClE,CAAC;IACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;IACjE,IAAI,aAAa,CAAC,UAAU,KAAK,cAAc,IAAI,aAAa,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;QAClG,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAA;IAC1D,CAAC;IACD,MAAM,aAAa,GAAG,yBAAyB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IACnE,IAAI,aAAa,KAAK,aAAa,CAAC,cAAc,EAAE,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAA;IAC7D,CAAC;IACD,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,4BAA4B,CAAC;QAC1E,QAAQ,EAAE,aAAa,CAAC,QAAQ;QAChC,WAAW,EAAE,gBAAgB;QAC7B,MAAM,EAAE,GAAG,aAAa,CAAC,UAAU,SAAS,kBAAkB,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE;QACzF,WAAW,EAAE,aAAa,CAAC,cAAc;QACzC,cAAc,EAAE,aAAa,CAAC,cAAc;QAC5C,SAAS,EAAE,aAAa,CAAC,SAAS;QAClC,KAAK,EAAE,aAAa,CAAC,KAAK;KAC3B,CAAC,CAAC,CAAA;IACH,IAAI,mBAAmB,KAAK,aAAa,CAAC,UAAU,EAAE,CAAC;QACrD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAA;IAC9D,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACpD,IAAI,GAAG,GAAG,aAAa,CAAC,SAAS,IAAI,GAAG,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;QACrE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAA;IACpE,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC;QAC5C,UAAU,EAAE,aAAa,CAAC,QAAQ;QAClC,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;QACtD,EAAE,EAAE,aAAa,CAAC,SAAS;KAC5B,CAAC,CAAA;IACF,IAAI,UAAU,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;QAClE,OAAO;YACL,KAAK,EAAE,UAAU,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YACvE,IAAI,EAAE,mBAAmB,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE;SAC1D,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IACnD,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,eAAe,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3G,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAA;IAC5D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAa9C;IACC,OAAO,KAAK,UAAU,cAAc,CAClC,OAA2B,EAC3B,OAAgC,EAChC,QAAyF;QAEzF,IAAI,CAAC,OAAO,CAAC,uBAAuB;YAAE,MAAM,IAAI,wBAAwB,CAAC,+BAA+B,CAAC,CAAA;QACzG,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY;YAAE,MAAM,IAAI,wBAAwB,CAAC,wBAAwB,CAAC,CAAA;QACjG,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAA;QACrC,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC,0BAA0B,CAAC,CAAA;QACxD,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC,SAAS,EAAE;YAChE,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;YAC9B,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE;YACzC,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAA;QACF,IAAI,YAAY,CAAC,KAAK,KAAK,OAAO,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC;YAClE,MAAM,IAAI,wBAAwB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QACvD,CAAC;QACD,IAAI,CAAC,MAAM,OAAO,CAAC,kBAAkB,CACnC,YAAY,CAAC,aAAa,CAAC,UAAU,EACrC,YAAY,CAAC,aAAa,CAAC,UAAU,CACtC;YAAE,MAAM,IAAI,wBAAwB,CAAC,mBAAmB,CAAC,CAAA;QAE1D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;QACvF,IAAI,SAAS,CAAC,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,wBAAwB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAEpF,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;QAC1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;QAC7F,OAAO;YACL,GAAG,UAAU;YACb,KAAK,EAAE;gBACL,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3B,CAAC,oBAAoB,CAAC,EAAE,OAAO;aAChC;SACF,CAAA;IACH,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAC7B,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACpD,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClG,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAA;IACnE,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAC7C,CAAC;AAED,SAAS,qBAAqB,CAAC,SAAkB;IAC/C,iBAAiB,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAA;IACjD,eAAe,CAAC,SAAS,EAAE;QACzB,SAAS,EAAE,UAAU,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,YAAY;QAC5E,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,OAAO;QAClE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW;KACrD,EAAE,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC,CAAA;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,CAAwD,CAAA;IACtG,6BAA6B,CAAC,QAAQ,CAAC,CAAA;IACvC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;IACxD,OAAO,SAA6C,CAAA;AACtD,CAAC;AAED,SAAS,6BAA6B,CAAC,KAA+C;IACpF,WAAW,CAAC,KAAK,CAAC,CAAA;IAClB,IAAI,KAAK,CAAC,OAAO,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;IAClG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAA;IAC3E,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,QAAQ,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IACvG,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAA;IACpH,IAAI,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;IAC7G,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAA;IAClF,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,EAAE,gBAAgB,CAAC,CAAA;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAA;IAC3E,kBAAkB,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAA;IAC1D,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,cAAc;QAAE,IAAI,KAAK,KAAK,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACrH,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QACvC,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;QAC7D,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAA;QACpF,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;IACtF,CAAC;IACD,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;IACnC,qBAAqB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IACnD,qBAAqB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;IACrD,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IACrF,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,YAAY,CAAC,CAAA;AAC/C,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,IAAuB;IAClD,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC9F,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/src/profiles/mcp/index.d.ts

@@ -0,0 +1,2 @@
+export * from './authorization-v1.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/profiles/mcp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/profiles/mcp/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAA"}

package/dist/src/profiles/mcp/index.js

@@ -0,0 +1,2 @@
+export * from './authorization-v1.js';
+//# sourceMappingURL=index.js.map

package/dist/src/profiles/mcp/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/profiles/mcp/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAA"}

package/dist/src/v2/action-reference/index.d.ts

@@ -0,0 +1,2 @@
+export * from './v2.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/v2/action-reference/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/v2/action-reference/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAA"}

package/dist/src/v2/action-reference/index.js

@@ -0,0 +1,2 @@
+export * from './v2.js';
+//# sourceMappingURL=index.js.map