@fidacy/mcp 0.1.4 → 0.1.6

package/dist/index.js

@@ -1,143 +1,759 @@
 #!/usr/bin/env node
+
+// src/index.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
-import { makeCore } from "./core.js";
-import { assessAction, AssessError } from "./assess.js";
-const core = makeCore();
-const subject = process.env.FIDACY_SUBJECT ?? "agent:demo";
-const server = new McpServer({ name: "fidacy", version: "0.1.0" });
-// ACTION FIREWALL. The agent calls this INSTEAD of any raw payment tool.
-// Fidacy verifies the action against the signed mandate BEFORE money can move.
-// ALLOW returns a short-lived Ed25519 grant the executor requires.
-// DENY returns no grant: the action is dead on arrival. Non-custodial: Fidacy
-// authorizes, it never holds funds.
-server.registerTool("request_payment", {
+
+// ../firewall/dist/util.js
+function stableStringify(obj) {
+  if (obj === null || typeof obj !== "object")
+    return JSON.stringify(obj);
+  if (Array.isArray(obj))
+    return "[" + obj.map(stableStringify).join(",") + "]";
+  const keys = Object.keys(obj).sort();
+  return "{" + keys.map((k) => JSON.stringify(k) + ":" + stableStringify(obj[k])).join(",") + "}";
+}
+
+// ../firewall/dist/signing.js
+import crypto from "node:crypto";
+function loadOrGenerateKeyPair() {
+  const b64 = process.env.FIDACY_SIGNING_KEY_B64;
+  if (b64) {
+    const pem = Buffer.from(b64, "base64").toString("utf8");
+    const privateKey2 = crypto.createPrivateKey(pem);
+    const publicKey2 = crypto.createPublicKey(privateKey2);
+    return { privateKey: privateKey2, publicKey: publicKey2, ephemeral: false };
+  }
+  const { privateKey, publicKey } = crypto.generateKeyPairSync("ed25519");
+  return { privateKey, publicKey, ephemeral: true };
+}
+function publicKeyPem(publicKey) {
+  return publicKey.export({ type: "spki", format: "pem" }).toString();
+}
+function sign(privateKey, message) {
+  return crypto.sign(null, Buffer.from(message, "utf8"), privateKey).toString("base64url");
+}
+function sha256(input) {
+  return crypto.createHash("sha256").update(input).digest("hex");
+}
+
+// ../firewall/dist/audit-store.js
+import fs from "node:fs";
+var FileAuditStore = class {
+  path;
+  chain = [];
+  constructor(path) {
+    this.path = path;
+    this.load();
+  }
+  load() {
+    if (!fs.existsSync(this.path))
+      return;
+    try {
+      const raw = fs.readFileSync(this.path, "utf8");
+      const parsed = [];
+      for (const line of raw.split("\n")) {
+        if (!line.trim())
+          continue;
+        parsed.push(JSON.parse(line));
+      }
+      this.chain = parsed;
+      if (!this.intact())
+        throw new Error("audit chain integrity broken");
+    } catch (err) {
+      this.chain = [];
+      try {
+        const quarantine = `${this.path}.corrupt-${Date.now()}`;
+        fs.renameSync(this.path, quarantine);
+        console.error(`[fidacy] audit log at ${this.path} is unreadable/tampered (${err.message}); quarantined to ${quarantine}, starting a fresh chain.`);
+      } catch {
+        console.error(`[fidacy] audit log at ${this.path} is unreadable/tampered and could not be quarantined; starting a fresh in-memory chain.`);
+      }
+    }
+  }
+  head() {
+    return this.chain.length ? this.chain[this.chain.length - 1].hash : "GENESIS";
+  }
+  append(decision) {
+    const prevHash = this.head();
+    const seq = this.chain.length;
+    const ts = decision.ts;
+    const digest = sha256(stableStringify({ decisionId: decision.decisionId, status: decision.status, request: decision.request, violatedRule: decision.violatedRule ?? null }));
+    const hash = sha256(`${prevHash}|${digest}|${seq}|${ts}`);
+    const record2 = { seq, decisionId: decision.decisionId, status: decision.status, subject: decision.subject, digest, prevHash, hash, ts };
+    fs.appendFileSync(this.path, JSON.stringify(record2) + "\n");
+    this.chain.push(record2);
+    return record2;
+  }
+  find(decisionId) {
+    return this.chain.find((r) => r.decisionId === decisionId);
+  }
+  intact() {
+    let prev = "GENESIS";
+    for (const r of this.chain) {
+      const expected = sha256(`${prev}|${r.digest}|${r.seq}|${r.ts}`);
+      if (expected !== r.hash || r.prevHash !== prev)
+        return false;
+      prev = r.hash;
+    }
+    return true;
+  }
+};
+
+// ../firewall/dist/evaluate.js
+function evaluate(mandate, req, spentSoFar) {
+  const now = Date.now();
+  if (mandate.revoked)
+    return "mandate_revoked";
+  if (now < Date.parse(mandate.window.notBefore))
+    return "before_mandate_window";
+  if (now > Date.parse(mandate.window.notAfter))
+    return "after_mandate_window";
+  if (req.currency !== mandate.allow.currency)
+    return `currency_not_allowed:${req.currency}`;
+  if (req.amount <= 0)
+    return "non_positive_amount";
+  if (req.amount > mandate.allow.perTxMax)
+    return `per_tx_cap_exceeded:${req.amount}>${mandate.allow.perTxMax}`;
+  if (spentSoFar + req.amount > mandate.allow.maxTotal)
+    return `total_cap_exceeded:${spentSoFar + req.amount}>${mandate.allow.maxTotal}`;
+  const payeeOk = mandate.allow.payees.includes("*") || mandate.allow.payees.includes(req.payee);
+  if (!payeeOk)
+    return `payee_not_in_allowlist:${req.payee}`;
+  const catOk = mandate.allow.categories.includes("*") || mandate.allow.categories.includes(req.category);
+  if (!catOk)
+    return `category_not_allowed:${req.category}`;
+  return null;
+}
+
+// ../firewall/dist/core.js
+import { randomUUID } from "node:crypto";
+function canonInvoice(ref) {
+  if (typeof ref !== "string")
+    return "";
+  return ref.normalize("NFC").replace(/[\s\u200B\u200C\u200D\uFEFF]+/g, "").toLowerCase();
+}
+function validateRequest(req) {
+  if (!req || typeof req !== "object")
+    return "invalid_request";
+  if (typeof req.amount !== "number" || !Number.isFinite(req.amount) || req.amount <= 0)
+    return "invalid_amount";
+  if (typeof req.payee !== "string" || req.payee.length === 0)
+    return "invalid_payee";
+  if (typeof req.currency !== "string" || req.currency.length === 0)
+    return "invalid_currency";
+  return null;
+}
+function requireHttpsBase(raw) {
+  const trimmed = String(raw ?? "").replace(/\/+$/, "");
+  let u;
+  try {
+    u = new URL(trimmed);
+  } catch {
+    throw new Error("FIDACY_API_URL is not a valid URL");
+  }
+  const localHttp = u.protocol === "http:" && (u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "[::1]");
+  if (u.protocol !== "https:" && !localHttp) {
+    throw new Error("FIDACY_API_URL must be https:// (the API key is sent to it)");
+  }
+  return trimmed;
+}
+var DevFidacyCore = class {
+  priv;
+  pubPem;
+  mandate;
+  store;
+  spent = 0;
+  claimedInvoices = /* @__PURE__ */ new Set();
+  onDecision;
+  constructor(opts) {
+    const kp = loadOrGenerateKeyPair();
+    this.priv = kp.privateKey;
+    this.pubPem = publicKeyPem(kp.publicKey);
+    if (kp.ephemeral)
+      console.error("[fidacy] dev mode: ephemeral signing key. Production: set FIDACY_SIGNING_KEY_B64, or FIDACY_MODE=http + FIDACY_API_URL + FIDACY_API_KEY to use the live core.");
+    this.mandate = opts.mandate;
+    this.store = new FileAuditStore(opts.auditLogPath ?? "./fidacy-audit.log");
+    this.onDecision = opts.onDecision;
+  }
+  async getMandate() {
+    return this.mandate;
+  }
+  async decide(req, subject2) {
+    const decisionId = randomUUID();
+    const ts = (/* @__PURE__ */ new Date()).toISOString();
+    const invalid = validateRequest(req);
+    if (invalid) {
+      const decision2 = { decisionId, status: "DENY", subject: subject2, mandateId: this.mandate.id, request: req, violatedRule: invalid, ts };
+      this.store.append(decision2);
+      this.onDecision?.(decision2);
+      return decision2;
+    }
+    const violated = evaluate(this.mandate, req, this.spent);
+    if (violated) {
+      const decision2 = { decisionId, status: "DENY", subject: subject2, mandateId: this.mandate.id, request: req, violatedRule: violated, ts };
+      this.store.append(decision2);
+      this.onDecision?.(decision2);
+      return decision2;
+    }
+    const invoice = canonInvoice(req.invoiceRef);
+    if (invoice) {
+      const k = `${subject2}|${invoice}`;
+      if (this.claimedInvoices.has(k)) {
+        const decision2 = { decisionId, status: "DENY", subject: subject2, mandateId: this.mandate.id, request: req, violatedRule: `duplicate_invoice:${invoice}`, ts };
+        this.store.append(decision2);
+        this.onDecision?.(decision2);
+        return decision2;
+      }
+      this.claimedInvoices.add(k);
+    }
+    const grantPayload = { decisionId, subject: subject2, payee: req.payee, amount: req.amount, currency: req.currency, exp: Date.now() + 12e4, ...req.invoiceRef ? { invoiceRef: req.invoiceRef } : {} };
+    const grantBody = Buffer.from(stableStringify(grantPayload), "utf8").toString("base64url");
+    const grant = `${grantBody}.${sign(this.priv, grantBody)}`;
+    const decision = { decisionId, status: "ALLOW", subject: subject2, mandateId: this.mandate.id, request: req, grant, ts };
+    this.spent += req.amount;
+    this.store.append(decision);
+    this.onDecision?.(decision);
+    return decision;
+  }
+  async getProof(decisionId) {
+    const record2 = this.store.find(decisionId);
+    if (!record2)
+      return null;
+    return { record: record2, chainIntact: this.store.intact(), verifiedAgainstPublicKey: this.pubPem };
+  }
+  publicKey() {
+    return this.pubPem;
+  }
+};
+var HttpFidacyCore = class {
+  apiKey;
+  subjectPub;
+  baseUrl;
+  // Enforce https before any key-bearing request — a hostile FIDACY_API_URL would
+  // otherwise exfiltrate the API key in the Authorization header.
+  constructor(baseUrl, apiKey, subjectPub = "") {
+    this.apiKey = apiKey;
+    this.subjectPub = subjectPub;
+    this.baseUrl = requireHttpsBase(baseUrl);
+  }
+  async call(path, body) {
+    const res = await fetch(`${this.baseUrl}${path}`, {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${this.apiKey}` },
+      body: JSON.stringify(body)
+    });
+    if (!res.ok)
+      throw new Error(`fidacy core ${path} -> ${res.status}`);
+    return await res.json();
+  }
+  async getMandate(subject2) {
+    return this.call("/v1/mandate/get", { subject: subject2 });
+  }
+  async decide(req, subject2) {
+    return this.call("/v1/decide", { req, subject: subject2 });
+  }
+  async getProof(decisionId) {
+    return this.call("/v1/audit/proof", { decisionId });
+  }
+  publicKey() {
+    return this.subjectPub;
+  }
+};
+
+// src/config.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync
+} from "node:fs";
+function configDir() {
+  return process.env.FIDACY_CONFIG_DIR ?? join(homedir(), ".fidacy");
+}
+function configPath() {
+  return join(configDir(), "config.json");
+}
+function auditLogPath() {
+  if (process.env.FIDACY_AUDIT_PATH) return process.env.FIDACY_AUDIT_PATH;
+  const dir = join(configDir(), "audit");
+  try {
+    mkdirSync(dir, { recursive: true, mode: 448 });
+  } catch {
+  }
+  return join(dir, "audit.log");
+}
+function readConfig() {
+  const p = configPath();
+  if (!existsSync(p)) return null;
+  try {
+    const raw = JSON.parse(readFileSync(p, "utf8"));
+    if (!raw || typeof raw.anon_id !== "string") return null;
+    return {
+      anon_id: raw.anon_id,
+      tier: raw.tier === "paid" ? "paid" : "free",
+      api_key: typeof raw.api_key === "string" ? raw.api_key : null,
+      mandate: raw.mandate
+    };
+  } catch {
+    return null;
+  }
+}
+function writeConfig(cfg) {
+  const dir = configDir();
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  writeFileSync(configPath(), JSON.stringify(cfg, null, 2), { mode: 384 });
+}
+function ensureState() {
+  const existing = readConfig();
+  if (existing) return { config: existing, firstRun: false };
+  const config = { anon_id: randomUUID2(), tier: "free", api_key: null };
+  try {
+    writeConfig(config);
+  } catch {
+  }
+  return { config, firstRun: true };
+}
+function resolveMandateRules(cfg) {
+  const m = cfg?.mandate ?? {};
+  const envList = (v) => v === void 0 ? void 0 : v.split(",").map((s) => s.trim()).filter(Boolean);
+  const envNum = (v) => v === void 0 || v === "" ? void 0 : Number(v);
+  return {
+    payees: envList(process.env.FIDACY_ALLOW_PAYEES) ?? m.payees ?? [],
+    categories: envList(process.env.FIDACY_ALLOW_CATEGORIES) ?? m.categories ?? ["*"],
+    currency: process.env.FIDACY_CURRENCY ?? m.currency ?? "USD",
+    perTxMax: envNum(process.env.FIDACY_PER_TX_MAX) ?? m.perTxMax ?? 2500,
+    maxTotal: envNum(process.env.FIDACY_MAX_TOTAL) ?? m.maxTotal ?? 1e4
+  };
+}
+
+// src/telemetry.ts
+var CLIENT_VERSION = "0.1.5";
+function telemetryEnabled() {
+  const v = (process.env.FIDACY_DISABLE_TELEMETRY ?? "").trim().toLowerCase();
+  return !(v === "1" || v === "true" || v === "yes");
+}
+function endpoint() {
+  const base = (process.env.FIDACY_ENGINE_URL ?? "https://api.fidacy.com").replace(/\/$/, "");
+  return `${base}/v1/telemetry`;
+}
+var anonIdCache = null;
+function anonId() {
+  if (anonIdCache) return anonIdCache;
+  anonIdCache = readConfig()?.anon_id ?? null;
+  return anonIdCache;
+}
+var buffer = [];
+var flushTimer = null;
+function resultOf(status, violatedRule) {
+  if (status === "ALLOW") return "allow";
+  const r = violatedRule ?? "";
+  if (r.startsWith("per_tx_cap") || r.startsWith("total_cap")) return "deny_cap";
+  if (r.startsWith("payee_not_in_allowlist")) return "deny_payee";
+  return "deny_scope";
+}
+function record(type, result) {
+  if (!telemetryEnabled()) return;
+  buffer.push({ type, ts: (/* @__PURE__ */ new Date()).toISOString(), client_version: CLIENT_VERSION, ...result ? { result } : {} });
+  if (!flushTimer) {
+    flushTimer = setTimeout(() => {
+      void flush();
+    }, 2e3);
+    if (typeof flushTimer.unref === "function") flushTimer.unref();
+  }
+}
+var recordInstall = () => record("install");
+var recordAgentActive = () => record("agent_active");
+var recordDecision = (status, violatedRule) => record("decision", resultOf(status, violatedRule));
+var recordUpgradeIntent = () => record("upgrade_intent");
+async function flush() {
+  if (flushTimer) {
+    clearTimeout(flushTimer);
+    flushTimer = null;
+  }
+  if (!telemetryEnabled() || buffer.length === 0) return;
+  const id = anonId();
+  if (!id) {
+    buffer = [];
+    return;
+  }
+  const events = buffer;
+  buffer = [];
+  try {
+    await fetch(endpoint(), {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ anon_id: id, events })
+    });
+  } catch {
+  }
+}
+
+// src/core.ts
+function buildMandate() {
+  if (process.env.FIDACY_MANDATE_JSON) {
+    try {
+      const parsed = JSON.parse(process.env.FIDACY_MANDATE_JSON);
+      if (parsed && typeof parsed === "object" && parsed.allow && parsed.window) return parsed;
+      console.error("[fidacy] FIDACY_MANDATE_JSON is missing allow/window; ignoring it and using the safe default mandate.");
+    } catch (err) {
+      console.error(`[fidacy] FIDACY_MANDATE_JSON is not valid JSON (${err.message}); ignoring it and using the safe default mandate.`);
+    }
+  }
+  const subject2 = process.env.FIDACY_SUBJECT ?? "agent:demo";
+  const rules = resolveMandateRules(readConfig());
+  return {
+    id: "mandate:local",
+    subject: subject2,
+    version: "ap2.v0.2.0",
+    allow: {
+      payees: rules.payees,
+      categories: rules.categories,
+      currency: rules.currency,
+      maxTotal: rules.maxTotal,
+      perTxMax: rules.perTxMax
+    },
+    window: {
+      notBefore: process.env.FIDACY_NOT_BEFORE ?? new Date(Date.now() - 36e5).toISOString(),
+      notAfter: process.env.FIDACY_NOT_AFTER ?? new Date(Date.now() + 30 * 864e5).toISOString()
+    },
+    revoked: false
+  };
+}
+function makeCore() {
+  if ((process.env.FIDACY_MODE ?? "dev") === "http") {
+    const url = process.env.FIDACY_API_URL;
+    const key = process.env.FIDACY_API_KEY;
+    if (!url || !key) throw new Error("FIDACY_MODE=http requires FIDACY_API_URL and FIDACY_API_KEY");
+    return new HttpFidacyCore(url, key, process.env.FIDACY_PUBLIC_KEY_PEM ?? "");
+  }
+  return new DevFidacyCore({
+    mandate: buildMandate(),
+    auditLogPath: auditLogPath(),
+    onDecision: (d) => recordDecision(d.status, d.violatedRule)
+  });
+}
+
+// src/assess.ts
+var AssessError = class extends Error {
+  type;
+  status;
+  details;
+  rejection_reasons;
+  constructor(opts) {
+    super(`Fidacy assess error (${opts.type}, HTTP ${opts.status})`);
+    this.name = "AssessError";
+    this.type = opts.type;
+    this.status = opts.status;
+    this.details = opts.details;
+    this.rejection_reasons = opts.rejection_reasons;
+  }
+};
+var DEFAULT_TIMEOUT = 1e4;
+var DEFAULT_RETRIES = 2;
+var defaultBackoff = (n) => Math.min(200 * 2 ** n, 2e3);
+function isRecord(v) {
+  return typeof v === "object" && v !== null;
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function requireSafeBaseUrl(raw) {
+  const trimmed = String(raw ?? "").replace(/\/+$/, "");
+  let u;
+  try {
+    u = new URL(trimmed);
+  } catch {
+    throw new AssessError({ type: "config_error", status: 0 });
+  }
+  const isLocalHttp = u.protocol === "http:" && (u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "[::1]");
+  if (u.protocol !== "https:" && !isLocalHttp) {
+    throw new AssessError({ type: "config_error", status: 0 });
+  }
+  return trimmed;
+}
+async function assessAction(params, cfg) {
+  const fetchImpl = cfg.fetchImpl ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") {
+    throw new AssessError({ type: "config_error", status: 0 });
+  }
+  const baseUrl = requireSafeBaseUrl(cfg.engineUrl);
+  const url = `${baseUrl}/v1/assess`;
+  const timeoutMs = cfg.timeoutMs ?? DEFAULT_TIMEOUT;
+  const maxRetries = cfg.maxRetries ?? DEFAULT_RETRIES;
+  const backoffMs = cfg.backoffMs ?? defaultBackoff;
+  const body = {
+    kind: params.kind ?? "ap2_payment",
+    mandate: params.mandate
+  };
+  if (params.mandateType !== void 0) body.mandateType = params.mandateType;
+  if (params.a2a !== void 0) body.a2a = params.a2a;
+  if (params.spendingMandate !== void 0) body.spending_mandate = params.spendingMandate;
+  if (params.idempotencyKey !== void 0) body.idempotency_key = params.idempotencyKey;
+  const payload = JSON.stringify(body);
+  if (payload.length > 256 * 1024) {
+    throw new AssessError({ type: "config_error", status: 0 });
+  }
+  const headers = {
+    "content-type": "application/json",
+    authorization: `Bearer ${cfg.apiKey}`
+  };
+  if (params.a2a !== void 0) headers["A2A-Version"] = "0.1.0";
+  const canRetryTransient = params.idempotencyKey !== void 0;
+  let attempt = 0;
+  for (; ; ) {
+    try {
+      return await postOnce(fetchImpl, url, headers, payload, timeoutMs);
+    } catch (err) {
+      const isTransient = err instanceof AssessError && (err.status === 0 || err.status === 429 || err.status >= 500);
+      const canRetry = isTransient && canRetryTransient && attempt < maxRetries;
+      if (!canRetry) throw err;
+      await sleep(backoffMs(attempt));
+      attempt += 1;
+    }
+  }
+}
+async function postOnce(fetchImpl, url, headers, payload, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  let res;
+  try {
+    res = await fetchImpl(url, {
+      method: "POST",
+      headers,
+      body: payload,
+      signal: controller.signal
+    });
+  } catch (err) {
+    const aborted = controller.signal.aborted;
+    throw new AssessError({ type: aborted ? "timeout" : "network_error", status: 0 });
+  } finally {
+    clearTimeout(timer);
+  }
+  const text = await res.text();
+  let parsed = void 0;
+  if (text) {
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+    }
+  }
+  if (!res.ok) {
+    const type = isRecord(parsed) && typeof parsed.error === "string" && parsed.error || `http_${res.status}`;
+    const details = isRecord(parsed) ? parsed.details : void 0;
+    const rejection_reasons = isRecord(parsed) && Array.isArray(parsed.rejection_reasons) ? parsed.rejection_reasons : void 0;
+    throw new AssessError({ type, status: res.status, details, rejection_reasons });
+  }
+  if (!isRecord(parsed)) {
+    throw new AssessError({ type: "invalid_response", status: res.status });
+  }
+  return parsed;
+}
+
+// src/provision.ts
+var CLIENT_VERSION2 = "0.1.5";
+function provisionEnabled() {
+  const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
+  return !(v === "1" || v === "true" || v === "yes");
+}
+function endpoint2() {
+  const base = (process.env.FIDACY_ENGINE_URL ?? "https://api.fidacy.com").replace(/\/$/, "");
+  return `${base}/v1/provision`;
+}
+async function autoProvision() {
+  if (!provisionEnabled()) return "skipped";
+  const cfg = readConfig();
+  if (!cfg) return "skipped";
+  if (cfg.api_key) return "skipped";
+  try {
+    const res = await fetch(endpoint2(), {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ anon_id: cfg.anon_id, client_version: CLIENT_VERSION2 })
+    });
+    if (res.status === 429) return "rate_limited";
+    if (!res.ok) return "failed";
+    const data = await res.json();
+    if (typeof data.api_key !== "string" || !data.api_key) return "failed";
+    writeConfig({
+      ...cfg,
+      api_key: data.api_key,
+      tier: data.tier === "paid" ? "paid" : "free"
+    });
+    return "provisioned";
+  } catch {
+    return "failed";
+  }
+}
+
+// src/upgrade.ts
+function upgradeUrl() {
+  const base = (process.env.FIDACY_APP_URL ?? "https://app.fidacy.com").replace(/\/$/, "");
+  const anon = readConfig()?.anon_id ?? "";
+  return `${base}/upgrade?anon=${encodeURIComponent(anon)}`;
+}
+function requestUpgrade() {
+  recordUpgradeIntent();
+  const anonId2 = readConfig()?.anon_id ?? "";
+  return { url: upgradeUrl(), anonId: anonId2 };
+}
+
+// src/index.ts
+var state = ensureState();
+var core = makeCore();
+var subject = process.env.FIDACY_SUBJECT ?? "agent:demo";
+var server = new McpServer({ name: "fidacy", version: "0.1.0" });
+server.registerTool(
+  "request_payment",
+  {
     title: "Request Payment Authorization",
     description: "Authorize a payment action against the active Fidacy mandate. Returns an ALLOW with a signed grant, or a DENY with the violated rule. The downstream executor MUST require the grant. Call this before any payment; never pay without it.",
     inputSchema: {
-        payee: z.string().describe("Payee identifier"),
-        amount: z.number().positive().describe("Amount in the mandate currency"),
-        currency: z.string().length(3).describe("ISO 4217 currency code"),
-        purpose: z.string().describe("Human-readable purpose"),
-        category: z.string().describe("Purpose category (must be allowed by the mandate)"),
-        idempotencyKey: z.string().describe("Caller-supplied idempotency key"),
-        invoiceRef: z
-            .string()
-            .describe("Optional invoice identity. When set, Fidacy enforces one payment per invoice: a second request for the same invoiceRef is DENIED, at any amount.")
-            .optional(),
+      payee: z.string().describe("Payee identifier"),
+      amount: z.number().positive().describe("Amount in the mandate currency"),
+      currency: z.string().length(3).describe("ISO 4217 currency code"),
+      purpose: z.string().describe("Human-readable purpose"),
+      category: z.string().describe("Purpose category (must be allowed by the mandate)"),
+      idempotencyKey: z.string().describe("Caller-supplied idempotency key"),
+      invoiceRef: z.string().describe(
+        "Optional invoice identity. When set, Fidacy enforces one payment per invoice: a second request for the same invoiceRef is DENIED, at any amount."
+      ).optional()
     },
     outputSchema: {
-        status: z.enum(["ALLOW", "DENY"]),
-        decisionId: z.string(),
-        grant: z.string().optional(),
-        violatedRule: z.string().optional(),
+      status: z.enum(["ALLOW", "DENY"]),
+      decisionId: z.string(),
+      grant: z.string().optional(),
+      violatedRule: z.string().optional()
     },
-    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
-}, async (args) => {
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true }
+  },
+  async (args) => {
     const req = args;
     const d = await core.decide(req, subject);
     const out = { status: d.status, decisionId: d.decisionId, grant: d.grant, violatedRule: d.violatedRule };
-    // The grant string MUST be in the text, not only in structuredContent: many
-    // MCP hosts surface only the text content to the model, so an agent that sees
-    // just the decisionId has no grant to present and the executor (correctly)
-    // refuses. We print the exact grant the executor expects.
-    const human = d.status === "ALLOW"
-        ? `ALLOW (decision ${d.decisionId})${req.invoiceRef ? ` for invoice ${req.invoiceRef}` : ""}. To settle, call execute_payment with the SAME payee, amount, currency, and idempotencyKey, and set "grant" to EXACTLY this signed value:\n${d.grant}`
-        : `DENY (decision ${d.decisionId}). Rule violated: ${d.violatedRule}. No grant issued, this payment cannot proceed. The denial itself is recorded immutably in the hash-chained audit: call get_audit_proof with decisionId ${d.decisionId} for the proof of what was blocked.`;
+    const human = d.status === "ALLOW" ? `ALLOW (decision ${d.decisionId})${req.invoiceRef ? ` for invoice ${req.invoiceRef}` : ""}. To settle, call execute_payment with the SAME payee, amount, currency, and idempotencyKey, and set "grant" to EXACTLY this signed value:
+${d.grant}` : `DENY (decision ${d.decisionId}). Rule violated: ${d.violatedRule}. No grant issued, this payment cannot proceed. The denial itself is recorded in the tamper-evident, hash-chained audit: call get_audit_proof with decisionId ${d.decisionId} for the proof of what was blocked.`;
     return { content: [{ type: "text", text: human }], structuredContent: out };
-});
-// Read-only: surface the guardrails so the agent/human can see the envelope and
-// pin Fidacy's public key for grant verification.
-server.registerTool("verify_mandate", {
+  }
+);
+server.registerTool(
+  "verify_mandate",
+  {
     title: "Verify Active Mandate",
     description: "Return the active mandate envelope (caps, allowed payees/categories, window, revocation) and Fidacy's Ed25519 public key for grant verification.",
     inputSchema: {},
-    annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
-}, async () => {
+    annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
+  },
+  async () => {
     const m = await core.getMandate(subject);
     const payload = { mandate: m, fidacyPublicKey: core.publicKey() };
     return { content: [{ type: "text", text: JSON.stringify(payload, null, 2) }], structuredContent: payload };
-});
-// Read-only: portable, hash-chained proof for a decision. The non-repudiation
-// artifact for audit, reinsurance, or dispute.
-server.registerTool("get_audit_proof", {
+  }
+);
+server.registerTool(
+  "get_audit_proof",
+  {
     title: "Get Audit Proof",
-    description: "Return the immutable, hash-chained proof for a decision id, including whether the chain is intact and the public key it verifies against.",
+    description: "Return the tamper-evident, hash-chained proof for a decision id, including whether the chain is intact and the public key it verifies against.",
     inputSchema: { decisionId: z.string().describe("Decision id returned by request_payment") },
-    annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
-}, async ({ decisionId }) => {
+    annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
+  },
+  async ({ decisionId }) => {
     const proof = await core.getProof(decisionId);
-    if (!proof)
-        return { content: [{ type: "text", text: `No proof found for ${decisionId}` }], isError: true };
+    if (!proof) return { content: [{ type: "text", text: `No proof found for ${decisionId}` }], isError: true };
     return { content: [{ type: "text", text: JSON.stringify(proof, null, 2) }], structuredContent: proof };
-});
-// VERDICT LAYER (advisory). Calls the LIVE Fidacy engine POST /v1/assess and
-// returns the SIGNED trust verdict. This complements the payment-firewall tools
-// above: one install of @fidacy/mcp ships both backends. assess_action moves no
-// money; it returns a judgment whose proof (riskPayloadJws + signingKeyId) is
-// verifiable by anyone via @fidacy/verify against the engine JWKS.
-//
-// Tool registration NEVER requires a key: only CALLING it without one returns a
-// helpful error, so the server still boots with no FIDACY_ENGINE_API_KEY set.
-server.registerTool("assess_action", {
+  }
+);
+server.registerTool(
+  "assess_action",
+  {
     title: "Assess Action (Signed Trust Verdict)",
     description: "Return a SIGNED Fidacy trust verdict from the live engine (default https://api.fidacy.com) for a proposed action. The signed proof is `riskPayloadJws` + `signingKeyId`, verifiable by anyone via @fidacy/verify against the engine JWKS at /.well-known/jwks.json. `kind` is one of ap2_payment, message_send, voice_call, custom, claim_document; `mandate` is the action/mandate object for that kind. This is the verdict (advisory) layer and moves no money; it complements the payment-firewall tools (request_payment et al.) in the same install.",
     inputSchema: {
-        kind: z
-            .enum(["ap2_payment", "message_send", "voice_call", "custom", "claim_document"])
-            .optional(),
-        mandate: z.record(z.unknown()),
-        mandateType: z.string().optional(),
-        idempotencyKey: z.string().optional(),
-        spendingMandate: z.record(z.unknown()).optional(),
-        a2a: z.object({ task_id: z.string() }).optional(),
+      kind: z.enum(["ap2_payment", "message_send", "voice_call", "custom", "claim_document"]).optional(),
+      mandate: z.record(z.unknown()),
+      mandateType: z.string().optional(),
+      idempotencyKey: z.string().optional(),
+      spendingMandate: z.record(z.unknown()).optional(),
+      a2a: z.object({ task_id: z.string() }).optional()
     },
-    annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
-}, async ({ kind, mandate, mandateType, idempotencyKey, spendingMandate, a2a }) => {
+    annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true }
+  },
+  async ({ kind, mandate, mandateType, idempotencyKey, spendingMandate, a2a }) => {
     const engineUrl = process.env.FIDACY_ENGINE_URL ?? "https://api.fidacy.com";
     const apiKey = (process.env.FIDACY_ENGINE_API_KEY ?? "").trim();
     if (!apiKey) {
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: "assess_action requires FIDACY_ENGINE_API_KEY (an fky_live_/fky_test_ key with assess:write). Set it to enable signed verdicts.",
-                },
-            ],
-            isError: true,
-        };
+      return {
+        content: [
+          {
+            type: "text",
+            text: "assess_action requires FIDACY_ENGINE_API_KEY (an fky_live_/fky_test_ key with assess:write). Set it to enable signed verdicts."
+          }
+        ],
+        isError: true
+      };
     }
     try {
-        const r = await assessAction({ kind, mandate, mandateType, idempotencyKey, spendingMandate, a2a }, { engineUrl, apiKey });
+      const r = await assessAction(
+        { kind, mandate, mandateType, idempotencyKey, spendingMandate, a2a },
+        { engineUrl, apiKey }
+      );
+      return {
+        content: [{ type: "text", text: `${r.decision} (score ${r.score}) signed by ${r.signingKeyId}` }],
+        structuredContent: r
+      };
+    } catch (e) {
+      if (e instanceof AssessError) {
+        const reasons = e.rejection_reasons?.length ? " (" + e.rejection_reasons.map((x) => x.key).join(",") + ")" : "";
         return {
-            content: [{ type: "text", text: `${r.decision} (score ${r.score}) signed by ${r.signingKeyId}` }],
-            structuredContent: r,
+          content: [{ type: "text", text: `ASSESS ${e.status}: ${e.type}${reasons}` }],
+          isError: true
         };
+      }
+      return {
+        content: [{ type: "text", text: "ASSESS failed: unexpected error" }],
+        isError: true
+      };
     }
-    catch (e) {
-        if (e instanceof AssessError) {
-            const reasons = e.rejection_reasons?.length
-                ? " (" + e.rejection_reasons.map((x) => x.key).join(",") + ")"
-                : "";
-            return {
-                content: [{ type: "text", text: `ASSESS ${e.status}: ${e.type}${reasons}` }],
-                isError: true,
-            };
-        }
-        return {
-            content: [{ type: "text", text: "ASSESS failed: unexpected error" }],
-            isError: true,
-        };
-    }
-});
+  }
+);
+server.registerTool(
+  "upgrade",
+  {
+    title: "Upgrade to a Fidacy account",
+    description: "Start upgrading this local install to a real Fidacy account (server-backed signed verdicts, anchored proof, higher volume). Returns a link to open; your anonymous usage is preserved and migrated to the new account.",
+    inputSchema: {},
+    annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true }
+  },
+  async () => {
+    const { url } = requestUpgrade();
+    return {
+      content: [{ type: "text", text: `To upgrade, open:
+${url}
+
+Your local protection keeps working meanwhile; your usage history migrates to the new account on completion.` }],
+      structuredContent: { upgradeUrl: url }
+    };
+  }
+);
 async function main() {
-    const transport = new StdioServerTransport();
-    await server.connect(transport);
-    console.error("[fidacy] action firewall running on stdio");
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  if (state.firstRun) recordInstall();
+  recordAgentActive();
+  process.once("beforeExit", () => {
+    void flush();
+  });
+  void autoProvision();
+  const verdictHint = process.env.FIDACY_ENGINE_API_KEY ? "" : " Set FIDACY_ENGINE_API_KEY to enable verdicts (assess_action).";
+  const tierHint = state.firstRun ? " First run: free local tier active (deny-unknown payee + cap). Add trusted payees in ~/.fidacy/config.json." : ` Tier: ${state.config.tier} (local-first).`;
+  console.error("[fidacy] @fidacy/mcp ready on stdio: signed verdict + payment firewall." + tierHint + verdictHint);
 }
 main().catch((e) => {
-    console.error("[fidacy] fatal:", e);
-    process.exit(1);
+  console.error("[fidacy] fatal:", e);
+  process.exit(1);
 });
-//# sourceMappingURL=index.js.map