@capxul/mcp 4.20.0-beta.3 → 4.20.0-beta.31

package/dist/permission-approvals-B2xmvEKE.mjs

@@ -0,0 +1,137 @@
+import { Gn as CapxulError, H as asCapxulError, R as abandonPrepared, Wn as Errors, a as verifiedConfiguration, c as preparePermission, d as buildCommand, f as validateReplacementInput, i as prepareConfiguration, l as preparedIdentity, mt as CAPXUL_OPERATIONS, nn as absurd, r as authorInvitation, u as verifiedPreparation } from "./organizations-5k-F_fa-.mjs";
+//#region ../../packages/sdk/src/accounts/permission-approvals.ts
+/** Prepare a Permission write or an invitation's configuration for `signerAddress`, checked. */
+function prepareVerifiedPermissionChange(deps, input, signerAddress, signal) {
+	return "permission" in input ? prepareVerifiedPermissionWrite(deps, input, signerAddress, signal) : prepareVerifiedInvitation(deps, input, signerAddress, signal);
+}
+/**
+* Hand the verified identity to the caller before the approval opens. A
+* caller that refuses it has not authorized the command: close the prepared
+* command, so its nonce lane is free again.
+*/
+async function delivered(deps, executionId, deliver) {
+	let refused;
+	try {
+		const result = await deliver();
+		if (result !== void 0 && !result.ok) refused = result;
+	} catch (cause) {
+		refused = {
+			ok: false,
+			error: asCapxulError(cause)
+		};
+	}
+	return refused === void 0 ? {
+		ok: true,
+		value: { executionId }
+	} : abandonPrepared(deps, executionId, "prepared_mismatch", refused);
+}
+/** The command a write sends, decoded exactly as its `org(id).permissions` method decodes it. */
+function command(write) {
+	try {
+		switch (write.operation) {
+			case "create": return {
+				ok: true,
+				value: buildCommand.create(write)
+			};
+			case "change": return {
+				ok: true,
+				value: buildCommand.change(write)
+			};
+			case "assign": return {
+				ok: true,
+				value: buildCommand.assign(write)
+			};
+			case "revoke": return {
+				ok: true,
+				value: buildCommand.revoke(write)
+			};
+			case "replace": return {
+				ok: true,
+				value: {
+					operation: "replace",
+					requestKey: write.requestKey
+				}
+			};
+			default: return absurd(write);
+		}
+	} catch (cause) {
+		return {
+			ok: false,
+			error: asCapxulError(cause)
+		};
+	}
+}
+async function prepareVerifiedPermissionWrite(deps, input, signerAddress, signal) {
+	const session = deps.actor?.authSession() ?? null;
+	if (session === null || deps.chainId === void 0) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	const built = command(input.permission);
+	if (!built.ok) return built;
+	const orgId = input.organizationId;
+	const expectedSnapshotHash = input.permission.operation === "replace" ? input.permission.expectedSnapshotHash : void 0;
+	const admitted = validateReplacementInput(orgId, built.value, expectedSnapshotHash);
+	if (!admitted.ok) return admitted;
+	const preparation = {
+		orgId,
+		command: built.value,
+		signerAddress,
+		email: session.email,
+		chainId: deps.chainId,
+		expectedSnapshotHash
+	};
+	const prepared = await preparePermission(deps, preparation, signal, void 0);
+	if (!prepared.ok) return prepared;
+	const executionId = prepared.value.executionId;
+	const verified = verifiedPreparation(prepared.value, preparation);
+	if (!verified.ok) return abandonPrepared(deps, executionId, "prepared_mismatch", verified);
+	const { onPrepared } = input;
+	return onPrepared === void 0 ? {
+		ok: true,
+		value: { executionId }
+	} : delivered(deps, executionId, () => onPrepared(preparedIdentity(verified.value)));
+}
+async function prepareVerifiedInvitation(deps, input, signerAddress, signal) {
+	const session = deps.actor?.authSession() ?? null;
+	if (session === null || deps.chainId === void 0) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	const orgId = input.organizationId;
+	const authored = await authorInvitation(deps, orgId, input.invite, signal, void 0);
+	if (!authored.ok) return authored;
+	const view = authored.value;
+	if (view.phase !== "authorizing" || view.commandId === null) return {
+		ok: false,
+		error: new CapxulError("WRONG_STATE", "The invitation's rights are already set up, or it ended: nothing is left to sign.", { details: {
+			method: CAPXUL_OPERATIONS.approvals.prepare,
+			currentState: view.phase,
+			validStates: ["authorizing"],
+			invitationId: view.id
+		} })
+	};
+	const preparation = {
+		orgId,
+		view,
+		commandId: view.commandId,
+		signerAddress,
+		email: session.email,
+		chainId: deps.chainId
+	};
+	const built = await prepareConfiguration(deps, preparation, signal, void 0);
+	if (!built.ok) return built;
+	const { executionId, invitationId, commandId } = built.value;
+	const verified = verifiedConfiguration(built.value, preparation);
+	if (!verified.ok) return abandonPrepared(deps, executionId, "prepared_mismatch", verified);
+	const { onPrepared } = input;
+	return onPrepared === void 0 ? {
+		ok: true,
+		value: { executionId }
+	} : delivered(deps, executionId, () => onPrepared({
+		invitationId,
+		commandId
+	}));
+}
+//#endregion
+export { prepareVerifiedPermissionChange };

package/dist/secp256k1-BSimfttS.mjs

@@ -0,0 +1,2 @@
+import { t as secp256k1 } from "./secp256k1-b-_IancF.mjs";
+export { secp256k1 };

package/dist/{secp256k1-oe2FO-K6.mjs → secp256k1-b-_IancF.mjs}

@@ -1,130 +1,4 @@
-import * as nc from "node:crypto";
-//#region ../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/cryptoNode.js
-/**
-* Internal webcrypto alias.
-* We prefer WebCrypto aka globalThis.crypto, which exists in node.js 16+.
-* Falls back to Node.js built-in crypto for Node.js <=v14.
-* See utils.ts for details.
-* @module
-*/
-const crypto = nc && typeof nc === "object" && "webcrypto" in nc ? nc.webcrypto : nc && typeof nc === "object" && "randomBytes" in nc ? nc : void 0;
-//#endregion
-//#region ../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/utils.js
-/**
-* Utilities for hex, bytes, CSPRNG.
-* @module
-*/
-/*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-/** Checks if something is Uint8Array. Be careful: nodejs Buffer will return true. */
-function isBytes$1(a) {
-	return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
-}
-/** Asserts something is positive integer. */
-function anumber(n) {
-	if (!Number.isSafeInteger(n) || n < 0) throw new Error("positive integer expected, got " + n);
-}
-/** Asserts something is Uint8Array. */
-function abytes$1(b, ...lengths) {
-	if (!isBytes$1(b)) throw new Error("Uint8Array expected");
-	if (lengths.length > 0 && !lengths.includes(b.length)) throw new Error("Uint8Array expected of length " + lengths + ", got length=" + b.length);
-}
-/** Asserts something is hash */
-function ahash(h) {
-	if (typeof h !== "function" || typeof h.create !== "function") throw new Error("Hash should be wrapped by utils.createHasher");
-	anumber(h.outputLen);
-	anumber(h.blockLen);
-}
-/** Asserts a hash instance has not been destroyed / finished */
-function aexists(instance, checkFinished = true) {
-	if (instance.destroyed) throw new Error("Hash instance has been destroyed");
-	if (checkFinished && instance.finished) throw new Error("Hash#digest() has already been called");
-}
-/** Asserts output is properly-sized byte array */
-function aoutput(out, instance) {
-	abytes$1(out);
-	const min = instance.outputLen;
-	if (out.length < min) throw new Error("digestInto() expects output buffer of length at least " + min);
-}
-/** Cast u8 / u16 / u32 to u32. */
-function u32(arr) {
-	return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
-}
-/** Zeroize a byte array. Warning: JS provides no guarantees. */
-function clean(...arrays) {
-	for (let i = 0; i < arrays.length; i++) arrays[i].fill(0);
-}
-/** Create DataView of an array for easy byte-level manipulation. */
-function createView(arr) {
-	return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
-}
-/** The rotate right (circular right shift) operation for uint32 */
-function rotr(word, shift) {
-	return word << 32 - shift | word >>> shift;
-}
-/** Is current platform little-endian? Most are. Big-Endian platform: IBM */
-const isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68)();
-/** The byte swap operation for uint32 */
-function byteSwap(word) {
-	return word << 24 & 4278190080 | word << 8 & 16711680 | word >>> 8 & 65280 | word >>> 24 & 255;
-}
-/** In place byte swap for Uint32Array */
-function byteSwap32(arr) {
-	for (let i = 0; i < arr.length; i++) arr[i] = byteSwap(arr[i]);
-	return arr;
-}
-const swap32IfBE = isLE ? (u) => u : byteSwap32;
-/**
-* Converts string to bytes using UTF8 encoding.
-* @example utf8ToBytes('abc') // Uint8Array.from([97, 98, 99])
-*/
-function utf8ToBytes(str) {
-	if (typeof str !== "string") throw new Error("string expected");
-	return new Uint8Array(new TextEncoder().encode(str));
-}
-/**
-* Normalizes (non-hex) string or Uint8Array to Uint8Array.
-* Warning: when Uint8Array is passed, it would NOT get copied.
-* Keep in mind for future mutable operations.
-*/
-function toBytes(data) {
-	if (typeof data === "string") data = utf8ToBytes(data);
-	abytes$1(data);
-	return data;
-}
-/** Copies several Uint8Arrays into one. */
-function concatBytes$1(...arrays) {
-	let sum = 0;
-	for (let i = 0; i < arrays.length; i++) {
-		const a = arrays[i];
-		abytes$1(a);
-		sum += a.length;
-	}
-	const res = new Uint8Array(sum);
-	for (let i = 0, pad = 0; i < arrays.length; i++) {
-		const a = arrays[i];
-		res.set(a, pad);
-		pad += a.length;
-	}
-	return res;
-}
-/** For runtime check if class implements interface */
-var Hash = class {};
-/** Wraps hash function, creating an interface on top of it */
-function createHasher(hashCons) {
-	const hashC = (msg) => hashCons().update(toBytes(msg)).digest();
-	const tmp = hashCons();
-	hashC.outputLen = tmp.outputLen;
-	hashC.blockLen = tmp.blockLen;
-	hashC.create = () => hashCons();
-	return hashC;
-}
-/** Cryptographically secure PRNG. Uses internal OS-level `crypto.getRandomValues`. */
-function randomBytes(bytesLength = 32) {
-	if (crypto && typeof crypto.getRandomValues === "function") return crypto.getRandomValues(new Uint8Array(bytesLength));
-	if (crypto && typeof crypto.randomBytes === "function") return Uint8Array.from(crypto.randomBytes(bytesLength));
-	throw new Error("crypto.getRandomValues must be defined");
-}
-//#endregion
+import { a as anumber, c as concatBytes$1, d as randomBytes, f as rotr, i as ahash, l as createHasher, m as toBytes, n as abytes$1, o as aoutput, r as aexists, s as clean, t as Hash, u as createView } from "./utils-CenTnkL6.mjs";
 //#region ../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/_md.js
 /**
 * Internal Merkle-Damgard hash utils.
@@ -563,8 +437,8 @@ function aInRange(title, n, min, max) {
 * TODO: merge with nLength in modular
 */
 function bitLen(n) {
-	let len;
-	for (len = 0; n > _0n$4; n >>= _1n$4, len += 1);
+	let len = 0;
+	for (; n > _0n$4; n >>= _1n$4, len += 1);
 	return len;
 }
 /**
@@ -2340,4 +2214,4 @@ const secp256k1 = createCurve({
 	}
 }, sha256);
 //#endregion
-export { aexists as a, clean as c, toBytes as d, u32 as f, abytes$1 as i, createHasher as l, sha256 as n, anumber as o, Hash as r, aoutput as s, secp256k1 as t, swap32IfBE as u };
+export { sha256 as n, secp256k1 as t };

package/dist/utils-CenTnkL6.mjs

@@ -0,0 +1,128 @@
+import * as nc from "node:crypto";
+//#region ../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/cryptoNode.js
+/**
+* Internal webcrypto alias.
+* We prefer WebCrypto aka globalThis.crypto, which exists in node.js 16+.
+* Falls back to Node.js built-in crypto for Node.js <=v14.
+* See utils.ts for details.
+* @module
+*/
+const crypto = nc && typeof nc === "object" && "webcrypto" in nc ? nc.webcrypto : nc && typeof nc === "object" && "randomBytes" in nc ? nc : void 0;
+//#endregion
+//#region ../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/utils.js
+/**
+* Utilities for hex, bytes, CSPRNG.
+* @module
+*/
+/*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+/** Checks if something is Uint8Array. Be careful: nodejs Buffer will return true. */
+function isBytes(a) {
+	return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
+}
+/** Asserts something is positive integer. */
+function anumber(n) {
+	if (!Number.isSafeInteger(n) || n < 0) throw new Error("positive integer expected, got " + n);
+}
+/** Asserts something is Uint8Array. */
+function abytes(b, ...lengths) {
+	if (!isBytes(b)) throw new Error("Uint8Array expected");
+	if (lengths.length > 0 && !lengths.includes(b.length)) throw new Error("Uint8Array expected of length " + lengths + ", got length=" + b.length);
+}
+/** Asserts something is hash */
+function ahash(h) {
+	if (typeof h !== "function" || typeof h.create !== "function") throw new Error("Hash should be wrapped by utils.createHasher");
+	anumber(h.outputLen);
+	anumber(h.blockLen);
+}
+/** Asserts a hash instance has not been destroyed / finished */
+function aexists(instance, checkFinished = true) {
+	if (instance.destroyed) throw new Error("Hash instance has been destroyed");
+	if (checkFinished && instance.finished) throw new Error("Hash#digest() has already been called");
+}
+/** Asserts output is properly-sized byte array */
+function aoutput(out, instance) {
+	abytes(out);
+	const min = instance.outputLen;
+	if (out.length < min) throw new Error("digestInto() expects output buffer of length at least " + min);
+}
+/** Cast u8 / u16 / u32 to u32. */
+function u32(arr) {
+	return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
+}
+/** Zeroize a byte array. Warning: JS provides no guarantees. */
+function clean(...arrays) {
+	for (let i = 0; i < arrays.length; i++) arrays[i].fill(0);
+}
+/** Create DataView of an array for easy byte-level manipulation. */
+function createView(arr) {
+	return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+/** The rotate right (circular right shift) operation for uint32 */
+function rotr(word, shift) {
+	return word << 32 - shift | word >>> shift;
+}
+/** Is current platform little-endian? Most are. Big-Endian platform: IBM */
+const isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68)();
+/** The byte swap operation for uint32 */
+function byteSwap(word) {
+	return word << 24 & 4278190080 | word << 8 & 16711680 | word >>> 8 & 65280 | word >>> 24 & 255;
+}
+/** In place byte swap for Uint32Array */
+function byteSwap32(arr) {
+	for (let i = 0; i < arr.length; i++) arr[i] = byteSwap(arr[i]);
+	return arr;
+}
+const swap32IfBE = isLE ? (u) => u : byteSwap32;
+/**
+* Converts string to bytes using UTF8 encoding.
+* @example utf8ToBytes('abc') // Uint8Array.from([97, 98, 99])
+*/
+function utf8ToBytes(str) {
+	if (typeof str !== "string") throw new Error("string expected");
+	return new Uint8Array(new TextEncoder().encode(str));
+}
+/**
+* Normalizes (non-hex) string or Uint8Array to Uint8Array.
+* Warning: when Uint8Array is passed, it would NOT get copied.
+* Keep in mind for future mutable operations.
+*/
+function toBytes(data) {
+	if (typeof data === "string") data = utf8ToBytes(data);
+	abytes(data);
+	return data;
+}
+/** Copies several Uint8Arrays into one. */
+function concatBytes(...arrays) {
+	let sum = 0;
+	for (let i = 0; i < arrays.length; i++) {
+		const a = arrays[i];
+		abytes(a);
+		sum += a.length;
+	}
+	const res = new Uint8Array(sum);
+	for (let i = 0, pad = 0; i < arrays.length; i++) {
+		const a = arrays[i];
+		res.set(a, pad);
+		pad += a.length;
+	}
+	return res;
+}
+/** For runtime check if class implements interface */
+var Hash = class {};
+/** Wraps hash function, creating an interface on top of it */
+function createHasher(hashCons) {
+	const hashC = (msg) => hashCons().update(toBytes(msg)).digest();
+	const tmp = hashCons();
+	hashC.outputLen = tmp.outputLen;
+	hashC.blockLen = tmp.blockLen;
+	hashC.create = () => hashCons();
+	return hashC;
+}
+/** Cryptographically secure PRNG. Uses internal OS-level `crypto.getRandomValues`. */
+function randomBytes(bytesLength = 32) {
+	if (crypto && typeof crypto.getRandomValues === "function") return crypto.getRandomValues(new Uint8Array(bytesLength));
+	if (crypto && typeof crypto.randomBytes === "function") return Uint8Array.from(crypto.randomBytes(bytesLength));
+	throw new Error("crypto.getRandomValues must be defined");
+}
+//#endregion
+export { anumber as a, concatBytes as c, randomBytes as d, rotr as f, u32 as h, ahash as i, createHasher as l, toBytes as m, abytes as n, aoutput as o, swap32IfBE as p, aexists as r, clean as s, Hash as t, createView as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/mcp",
-  "version": "4.20.0-beta.3",
+  "version": "4.20.0-beta.31",
   "private": false,
   "description": "Capxul MCP server for auth, Account readiness, identity, Organizations, relationships, requests, destinations, and testnet funding over Streamable HTTP.",
   "keywords": [
@@ -32,6 +32,9 @@
     "README.md"
   ],
   "type": "module",
+  "imports": {
+    "#*": "./src/*.ts"
+  },
   "publishConfig": {
     "access": "public"
   },
@@ -39,26 +42,26 @@
     "@modelcontextprotocol/node": "^2.0.0",
     "@modelcontextprotocol/server": "^2.0.0",
     "@posthog/mcp": "0.13.0",
-    "effect": "4.0.0-rc.112",
+    "effect": "4.0.0",
     "posthog-node": "5.51.6",
     "zod": "^4.2.0"
   },
   "devDependencies": {
     "@modelcontextprotocol/client": "^2.0.0",
+    "@total-typescript/shoehorn": "0.1.2",
     "@types/node": "^22.15.3",
     "tsx": "^4.19.0",
     "typescript": "npm:@typescript/typescript6@6.0.2",
-    "vite": "npm:@voidzero-dev/vite-plus-core@0.3.0",
-    "vite-plus": "0.3.0",
-    "@capxul/config": "0.3.0",
-    "@capxul/typescript-config": "0.0.0",
-    "@capxul/sdk": "4.20.0-beta.3"
+    "vite": "npm:@voidzero-dev/vite-plus-core@1.0.0",
+    "vite-plus": "1.0.0",
+    "@capxul/protocol": "0.2.0-beta.4",
+    "@capxul/sdk": "4.20.0-beta.31",
+    "@capxul/typescript-config": "0.0.0"
   },
   "scripts": {
     "dev": "vp exec tsx src/main.ts serve",
-    "journey:staff": "vp exec bun run journeys/staff-proof.ts",
     "check-types": "vp exec ../../node_modules/@typescript/native/bin/tsc -p tsconfig.json --noEmit",
-    "lint": "vp lint --deny-warnings",
+    "lint": "vp lint -c ../../.oxlintrc.json .",
     "build": "NODE_OPTIONS=--max-old-space-size=12288 vp pack",
     "_vp-tasks-allowed": "vp-allowed: `test` + `test:coverage` are defined as cache-augmented tasks in vite.config.ts so vitest's self-writes don't bust input fingerprinting (#205)."
   }

package/dist/lib-BNmz42MT.mjs

@@ -1,3 +0,0 @@
-import { t as require_lib } from "./lib-vbuHK0v7.mjs";
-export default require_lib();
-export {};

package/dist/lib-DRIaj4W_.mjs

@@ -1,3 +0,0 @@
-import { t as require_lib } from "./lib-EFzR1_47.mjs";
-export default require_lib();
-export {};

package/dist/lib-DZmUoBjo.mjs

@@ -1,3 +0,0 @@
-import { t as require_lib } from "./lib-B8j6PH9L.mjs";
-export default require_lib();
-export {};

package/dist/lib-F14n2Pis.mjs

@@ -1,3 +0,0 @@
-import { t as require_lib } from "./lib-DO3Il55w.mjs";
-export default require_lib();
-export {};

package/dist/secp256k1-CYG6Mi0X.mjs

@@ -1,2 +0,0 @@
-import { t as secp256k1 } from "./secp256k1-oe2FO-K6.mjs";
-export { secp256k1 };