kavachos 0.2.1 → 0.4.0

package/dist/mcp/index.d.ts

@@ -1,5 +1,5 @@
-import { M as McpAuthContext, R as Result, a as McpAuthorizeResult, A as ApproveConsentParams, b as McpServerMetadata, c as McpProtectedResourceMetadata, d as McpClientRegistrationResponse, e as McpSession, f as McpConfig, g as McpAuthModule, h as McpTokenResponse } from '../types-BuHrZcjE.js';
-export { K as KavachError, i as McpAccessToken, j as McpAuthorizationCode, k as McpAuthorizeRequest, l as McpAuthorizeRequestSchema, m as McpClient, n as McpClientRegistrationRequest, o as McpClientRegistrationSchema, p as McpTokenPayload, q as McpTokenRequest, r as McpTokenRequestParsed, s as McpTokenRequestSchema } from '../types-BuHrZcjE.js';
+import { M as McpAuthContext, R as Result, a as McpAuthorizeResult, A as ApproveConsentParams, b as McpServerMetadata, c as McpProtectedResourceMetadata, d as McpClientRegistrationResponse, e as McpSession, f as McpConfig, g as McpAuthModule, h as McpTokenResponse } from '../types-BiUe9e8u.js';
+export { K as KavachError, i as McpAccessToken, j as McpAuthorizationCode, k as McpAuthorizeRequest, l as McpAuthorizeRequestSchema, m as McpClient, n as McpClientRegistrationRequest, o as McpClientRegistrationSchema, p as McpTokenPayload, q as McpTokenRequest, r as McpTokenRequestParsed, s as McpTokenRequestSchema } from '../types-BiUe9e8u.js';
 import 'zod';
 
 /**

package/dist/mcp/index.js

@@ -784,6 +784,29 @@ async function requireScopes(ctx, request, requiredScopes) {
   }
   return { authorized: true, session };
 }
+
+// src/standards/claims.ts
+var AGENTIC_JWT_CLAIMS = {
+  /**
+   * Stable identifier of the agent making the call.
+   *
+   * @see draft-goswami-agentic-jwt-00 §3.1
+   */
+  AGENT_ID: "agent_id",
+  /**
+   * Operational mode of the agent: `autonomous`, `delegated`, or `supervised`.
+   *
+   * @see draft-goswami-agentic-jwt-00 §3.2
+   */
+  AGENT_TYPE: "agent_type",
+  /**
+   * Trust score band at token issuance (e.g. `standard`, `elevated`).
+   *
+   * @see draft-goswami-agentic-jwt-00 §3.6
+   */
+  TRUST_TIER: "trust_tier"};
+
+// src/mcp/token.ts
 async function getSigningKey(secret) {
   const encoder = new TextEncoder();
   return globalThis.crypto.subtle.importKey(
@@ -805,11 +828,25 @@ async function issueAccessTokenJwt(ctx, userId, clientId, scopes, resource) {
   const exp = now + ctx.config.accessTokenTtl;
   const expiresAt = new Date(exp * 1e3);
   const audience = resource ?? ctx.config.issuer;
+  const agenticClaims = {};
+  if (ctx.config.emitAgenticJwtClaims === true && ctx.config.getAgenticContext !== void 0) {
+    const ac = await ctx.config.getAgenticContext(userId);
+    if (ac.agentId !== void 0) {
+      agenticClaims[AGENTIC_JWT_CLAIMS.AGENT_ID] = ac.agentId;
+    }
+    if (ac.agentType !== void 0) {
+      agenticClaims[AGENTIC_JWT_CLAIMS.AGENT_TYPE] = ac.agentType;
+    }
+    if (ac.trustTier !== void 0) {
+      agenticClaims[AGENTIC_JWT_CLAIMS.TRUST_TIER] = ac.trustTier;
+    }
+  }
   const jwt = await new SignJWT({
     sub: userId,
     client_id: clientId,
     scope: scopes.join(" "),
-    jti
+    jti,
+    ...agenticClaims
   }).setProtectedHeader({ alg: "HS256", typ: "at+jwt" }).setIssuer(ctx.config.issuer).setAudience(audience).setIssuedAt(now).setExpirationTime(exp).sign(key);
   return { jwt, jti, expiresAt };
 }