@forestrie/mcp-register 0.0.0-stage → 0.1.0

package/dist/net/http.js

@@ -0,0 +1,52 @@
+/**
+ * The one request helper the write path uses. Same contract as
+ * `@forestrie/mcp-resolve/net`'s readers, whose `NetError` and
+ * `RawResponse` it reuses: `redirect: "manual"` (a 303 is the answer, not
+ * something to follow), every non-2xx returned rather than thrown, and
+ * `NetError` only when no response was obtained.
+ */
+import { NetError, } from "@forestrie/mcp-resolve/net";
+export const DEFAULT_TIMEOUT_MS = 30_000;
+export async function rawRequest(url, init, opts) {
+    const fetchImpl = opts?.fetchImpl ?? globalThis.fetch;
+    const timeoutMs = opts?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const at = new Date().toISOString();
+    const controller = new AbortController();
+    let timer;
+    const timeout = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => {
+            controller.abort();
+            reject(new NetError("timeout", `timed out after ${timeoutMs}ms`));
+        }, timeoutMs);
+    });
+    try {
+        const res = await Promise.race([
+            fetchImpl(url, {
+                method: init.method,
+                redirect: "manual",
+                signal: controller.signal,
+                ...(init.headers ? { headers: init.headers } : {}),
+                ...(init.body !== undefined ? { body: init.body } : {}),
+            }),
+            timeout,
+        ]);
+        const body = new Uint8Array(await Promise.race([res.arrayBuffer(), timeout]));
+        const headers = {};
+        res.headers.forEach((value, key) => {
+            headers[key.toLowerCase()] = value;
+        });
+        return { url, status: res.status, headers, body, at };
+    }
+    catch (err) {
+        if (err instanceof NetError)
+            throw err;
+        throw new NetError("network", `network error on ${init.method} ${url}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export function trimBase(url) {
+    return url.replace(/\/+$/, "");
+}
+//# sourceMappingURL=http.js.map

package/dist/net/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/net/http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,QAAQ,GAGT,MAAM,4BAA4B,CAAC;AAEpC,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAQzC,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAW,EACX,IAAiB,EACjB,IAAmB;IAEnB,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACtD,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,kBAAkB,CAAC;IACxD,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,KAAgD,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACtD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,QAAQ,CAAC,SAAS,EAAE,mBAAmB,SAAS,IAAI,CAAC,CAAC,CAAC;QACpE,CAAC,EAAE,SAAS,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC7B,SAAS,CAAC,GAAG,EAAE;gBACb,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpE,CAAC;YACF,OAAO;SACR,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,UAAU,CACzB,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC,CACjD,CAAC;QACF,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ;YAAE,MAAM,GAAG,CAAC;QACvC,MAAM,IAAI,QAAQ,CAChB,SAAS,EACT,oBAAoB,IAAI,CAAC,MAAM,IAAI,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC7F,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC"}

package/dist/net/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `@forestrie/mcp-register/net` — the ONLY place `fetch` is called.
+ *
+ * Every function here takes `opts.fetchImpl` (defaulting to
+ * `globalThis.fetch`) and never calls a bare `fetch`, so unit tests inject a
+ * fake under the forbidden-fetch global. Reads that mcp-resolve already
+ * does (receipts, genesis) are imported from `@forestrie/mcp-resolve/net`,
+ * not reimplemented.
+ */
+export { DEFAULT_TIMEOUT_MS, rawRequest } from "./http.js";
+export { getPendingDelegation, getRegistrationStatus, postDelegationCertificate, postGrant, postStatement, registerGrantUrl, prepareChildLog, } from "./write.js";
+export { delegateSealing } from "./delegate.js";
+export type { DelegateSealingInput, DelegateSealingOutcome, DelegateStage, } from "./delegate.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/net/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/net/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,SAAS,EACT,aAAa,EACb,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,YAAY,EACV,oBAAoB,EACpB,sBAAsB,EACtB,aAAa,GACd,MAAM,eAAe,CAAC"}

package/dist/net/index.js

@@ -0,0 +1,13 @@
+/**
+ * `@forestrie/mcp-register/net` — the ONLY place `fetch` is called.
+ *
+ * Every function here takes `opts.fetchImpl` (defaulting to
+ * `globalThis.fetch`) and never calls a bare `fetch`, so unit tests inject a
+ * fake under the forbidden-fetch global. Reads that mcp-resolve already
+ * does (receipts, genesis) are imported from `@forestrie/mcp-resolve/net`,
+ * not reimplemented.
+ */
+export { DEFAULT_TIMEOUT_MS, rawRequest } from "./http.js";
+export { getPendingDelegation, getRegistrationStatus, postDelegationCertificate, postGrant, postStatement, registerGrantUrl, prepareChildLog, } from "./write.js";
+export { delegateSealing } from "./delegate.js";
+//# sourceMappingURL=index.js.map

package/dist/net/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/net/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,SAAS,EACT,aAAa,EACb,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC"}

package/dist/net/write.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The write path's requests. Thin: each builds one request, returns the
+ * raw response, and leaves reading it to `src/core/scrapi.ts` or
+ * `src/core/delegation.ts`. Every function takes `fetchImpl` through
+ * `opts`.
+ *
+ * Endpoints, all public and none needing an operator token:
+ *
+ *  - canopy `POST /register/{R}/entries`, the statement as
+ *    `application/cose`, authorised by `Forestrie-Grant <base64>`;
+ *  - canopy `POST /register/{R}/grants`, the child grant as
+ *    `Forestrie-Grant <base64>`, the parent grant in a CBOR body, and an
+ *    `X-PAYMENT` when paying canopy's 402;
+ *  - canopy `POST /api/forest/{childLogId}/prepare`, no body, the same
+ *    grant: publishes the child log's public root to the delegation
+ *    coordinator when register-grant's auto-forward did not;
+ *  - coordinator `GET /api/logs/{logId}/pending-delegation`;
+ *  - coordinator `POST /api/delegations/certificate`, JSON.
+ */
+import type { FetchOptions, RawResponse } from "@forestrie/mcp-resolve/net";
+import type { CertificateSubmission } from "../core/delegation.js";
+export declare function postStatement(input: {
+    baseUrl: string;
+    rootLogId: string;
+    statement: Uint8Array;
+    grantB64: string;
+}, opts?: FetchOptions): Promise<RawResponse>;
+/** The URL `postGrant` POSTs: also the x402 resource a payment is for. */
+export declare function registerGrantUrl(baseUrl: string, rootLogId: string): string;
+export declare function postGrant(input: {
+    baseUrl: string;
+    rootLogId: string;
+    grantB64: string;
+    /** `registerGrantBody(parentGrant)`: canonical CBOR `{parentGrant}`. */
+    body: Uint8Array;
+    /** The `X-PAYMENT` header value, when paying. */
+    payment?: string;
+}, opts?: FetchOptions): Promise<RawResponse>;
+export declare function getRegistrationStatus(input: {
+    statusUrl: string;
+}, opts?: FetchOptions): Promise<RawResponse>;
+export declare function prepareChildLog(input: {
+    baseUrl: string;
+    logId: string;
+    grantB64: string;
+}, opts?: FetchOptions): Promise<RawResponse>;
+export declare function getPendingDelegation(input: {
+    coordinatorUrl: string;
+    logId: string;
+}, opts?: FetchOptions): Promise<RawResponse>;
+export declare function postDelegationCertificate(input: {
+    coordinatorUrl: string;
+    submission: CertificateSubmission;
+}, opts?: FetchOptions): Promise<RawResponse>;
+//# sourceMappingURL=write.d.ts.map

package/dist/net/write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write.d.ts","sourceRoot":"","sources":["../../src/net/write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAGnE,wBAAgB,aAAa,CAC3B,KAAK,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,UAAU,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CAClB,EACD,IAAI,CAAC,EAAE,YAAY,GAClB,OAAO,CAAC,WAAW,CAAC,CAatB;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,wBAAgB,SAAS,CACvB,KAAK,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,IAAI,EAAE,UAAU,CAAC;IACjB,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,EACD,IAAI,CAAC,EAAE,YAAY,GAClB,OAAO,CAAC,WAAW,CAAC,CActB;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC5B,IAAI,CAAC,EAAE,YAAY,GAClB,OAAO,CAAC,WAAW,CAAC,CAEtB;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAC3D,IAAI,CAAC,EAAE,YAAY,GAClB,OAAO,CAAC,WAAW,CAAC,CAStB;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAChD,IAAI,CAAC,EAAE,YAAY,GAClB,OAAO,CAAC,WAAW,CAAC,CAMtB;AAED,wBAAgB,yBAAyB,CACvC,KAAK,EAAE;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,qBAAqB,CAAA;CAAE,EACpE,IAAI,CAAC,EAAE,YAAY,GAClB,OAAO,CAAC,WAAW,CAAC,CAUtB"}

package/dist/net/write.js

@@ -0,0 +1,46 @@
+import { rawRequest, trimBase } from "./http.js";
+export function postStatement(input, opts) {
+    return rawRequest(`${trimBase(input.baseUrl)}/register/${encodeURIComponent(input.rootLogId)}/entries`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/cose",
+            authorization: `Forestrie-Grant ${input.grantB64}`,
+        },
+        body: input.statement,
+    }, opts);
+}
+/** The URL `postGrant` POSTs: also the x402 resource a payment is for. */
+export function registerGrantUrl(baseUrl, rootLogId) {
+    return `${trimBase(baseUrl)}/register/${encodeURIComponent(rootLogId)}/grants`;
+}
+export function postGrant(input, opts) {
+    return rawRequest(registerGrantUrl(input.baseUrl, input.rootLogId), {
+        method: "POST",
+        headers: {
+            "content-type": "application/cbor",
+            authorization: `Forestrie-Grant ${input.grantB64}`,
+            ...(input.payment !== undefined ? { "x-payment": input.payment } : {}),
+        },
+        body: input.body,
+    }, opts);
+}
+export function getRegistrationStatus(input, opts) {
+    return rawRequest(input.statusUrl, { method: "GET" }, opts);
+}
+export function prepareChildLog(input, opts) {
+    return rawRequest(`${trimBase(input.baseUrl)}/api/forest/${encodeURIComponent(input.logId)}/prepare`, {
+        method: "POST",
+        headers: { authorization: `Forestrie-Grant ${input.grantB64}` },
+    }, opts);
+}
+export function getPendingDelegation(input, opts) {
+    return rawRequest(`${trimBase(input.coordinatorUrl)}/api/logs/${encodeURIComponent(input.logId)}/pending-delegation`, { method: "GET", headers: { accept: "application/json" } }, opts);
+}
+export function postDelegationCertificate(input, opts) {
+    return rawRequest(`${trimBase(input.coordinatorUrl)}/api/delegations/certificate`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(input.submission),
+    }, opts);
+}
+//# sourceMappingURL=write.js.map

package/dist/net/write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write.js","sourceRoot":"","sources":["../../src/net/write.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEjD,MAAM,UAAU,aAAa,CAC3B,KAKC,EACD,IAAmB;IAEnB,OAAO,UAAU,CACf,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,EACpF;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,mBAAmB,KAAK,CAAC,QAAQ,EAAE;SACnD;QACD,IAAI,EAAE,KAAK,CAAC,SAAS;KACtB,EACD,IAAI,CACL,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,SAAiB;IACjE,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,KAQC,EACD,IAAmB;IAEnB,OAAO,UAAU,CACf,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,EAChD;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,mBAAmB,KAAK,CAAC,QAAQ,EAAE;YAClD,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE;QACD,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,EACD,IAAI,CACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAA4B,EAC5B,IAAmB;IAEnB,OAAO,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,KAA2D,EAC3D,IAAmB;IAEnB,OAAO,UAAU,CACf,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAClF;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,aAAa,EAAE,mBAAmB,KAAK,CAAC,QAAQ,EAAE,EAAE;KAChE,EACD,IAAI,CACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAgD,EAChD,IAAmB;IAEnB,OAAO,UAAU,CACf,GAAG,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,aAAa,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,qBAAqB,EAClG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAC1D,IAAI,CACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAoE,EACpE,IAAmB;IAEnB,OAAO,UAAU,CACf,GAAG,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,8BAA8B,EAC/D;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC;KACvC,EACD,IAAI,CACL,CAAC;AACJ,CAAC"}

package/dist/node/cli.d.ts

@@ -0,0 +1,8 @@
+export declare const HELP: string;
+export declare function main(argv: readonly string[]): Promise<number>;
+/**
+ * Entry point. `process.exitCode` rather than `process.exit()`: node then
+ * drains stdout before exiting, which a hard exit would not.
+ */
+export declare function run(): Promise<void>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/node/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/node/cli.ts"],"names":[],"mappings":"AA+CA,eAAO,MAAM,IAAI,QAgDhB,CAAC;AAOF,wBAAsB,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAkDnE;AAED;;;GAGG;AACH,wBAAsB,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CASzC"}

package/dist/node/cli.js

@@ -0,0 +1,143 @@
+/**
+ * The bin entry, reached via `bin/mcp-register.mjs`.
+ *
+ *   <no args>          → StdioServerTransport; this is what
+ *                        `npx -y @forestrie/mcp-register` does.
+ *   --help | --version → text on stdout, exit 0.
+ *
+ * TWO RULES, both silent-corruption bugs if broken:
+ *
+ * 1. **Nothing may write to stdout in stdio mode except the transport.** A
+ *    stray `console.log` does not produce a warning — it produces a malformed
+ *    JSON-RPC frame and an MCP client that mysteriously fails to initialise.
+ *    All logging goes to stderr. `scripts/check-stdio-clean.mjs` proves it
+ *    against a real spawned process on every CI run.
+ *
+ * 2. **`main` returns an exit code; it does not call `process.exit`.** Killing
+ *    the process mid-write truncates whatever the stdio transport had
+ *    buffered. The wrapper sets `process.exitCode` and lets node drain.
+ *
+ * Serves the tools `createServer()` (`server.ts`) registers. It is
+ * called with no `deps`, so it reads `process.env` and calls the real
+ * `globalThis.fetch` — exactly what `npx -y @forestrie/mcp-register` should do.
+ */
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { PACKAGE_VERSION, RESOLVE_VERSION, VERIFIER_VERSION, } from "../core/index.js";
+import { createServer } from "./server.js";
+import { PROMPT_NAMES, PROMPT_TITLES, TOOL_NAMES, TOOL_TITLES, } from "./text.js";
+/** One line per tool, generated from the same list the server registers
+ *  from — never a hand-typed block. */
+const TOOLS_BLOCK = TOOL_NAMES.map((name) => `  ${name.padEnd(26)} ${TOOL_TITLES[name]}`).join("\n");
+const PROMPTS_BLOCK = PROMPT_NAMES.map((name) => `  ${name.padEnd(26)} ${PROMPT_TITLES[name]}`).join("\n");
+export const HELP = `forestrie-mcp-register ${PACKAGE_VERSION}
+
+  MCP server that signs statements with a log key, registers them on a
+  Forestrie transparency log under a grant you hold, delegates sealing for
+  your data log, and verifies the receipt by composing @forestrie/mcp-resolve
+  and @forestrie/mcp-verify. Signature bytes never cross the MCP boundary.
+
+USAGE
+  forestrie-mcp-register                start the MCP server on stdio (the default)
+  forestrie-mcp-register --help
+  forestrie-mcp-register --version
+
+TOOLS
+${TOOLS_BLOCK}
+
+PROMPTS
+${PROMPTS_BLOCK}
+
+CONFIGURATION (each overridable per call)
+  FORESTRIE_BASE_URL          canopy SCRAPI base URL
+  FORESTRIE_ROOT_LOG_ID       the forest's root log id (R in /register/{R}/entries)
+  FORESTRIE_GRANT             your Forestrie-Grant: base64, or a file path
+  FORESTRIE_AUTHORITY_GRANT   your authority log's grant, for issue_grant and register_grant
+  FORESTRIE_COORDINATOR_URL   delegation coordinator, for delegate_sealing
+  FORESTRIE_KNOWN_SEALER_KEY  registrar voucher key, base64 x‖y, for delegate_sealing
+  MCP_REGISTER_HOME           key files, grants, registrations, spend ledger
+                              (default ~/.config/forestrie/mcp-register)
+  MCP_REGISTER_KEY_FILE       the log key file (default $MCP_REGISTER_HOME/log-key.jwk)
+  MCP_REGISTER_AUTHORITY_KEY_FILE
+                              the authority key file (default $MCP_REGISTER_HOME/authority-key.jwk)
+
+PAYMENT (configuration only; never a tool argument)
+  MCP_REGISTER_PAYER_KEY_FILE     EVM private key (0x + 64 hex, mode 600) that pays canopy's
+                                  x402 402; unset means relay mode
+  MCP_REGISTER_PAY_MAX_PER_CALL   cap per payment, atomic units (required with a payer)
+  MCP_REGISTER_PAY_MAX_PER_DAY    cap per UTC day, atomic units (required with a payer)
+  MCP_REGISTER_PAY_NETWORK        the one network (default eip155:84532, Base Sepolia)
+  MCP_REGISTER_PAY_ASSET          the one asset (default USDC on Base Sepolia)
+  MCP_REGISTER_PAY_TO             optional: the only payee
+  MCP_REGISTER_PAY_ALLOW_MAINNET  1 to pay on a network that is not a testnet (off)
+
+CLIENT CONFIG
+  {"mcpServers": {"forestrie-register":
+    {"command": "npx", "args": ["-y", "@forestrie/mcp-register"]}}}
+
+  Verifier: @forestrie/mcp-verify ${VERIFIER_VERSION}
+  Resolver: @forestrie/mcp-resolve ${RESOLVE_VERSION}
+  Docs:     https://github.com/forestrie/mcp-register#readme
+`;
+/** stdout is the transport in stdio mode; everything else is stderr. */
+const out = (line) => {
+    process.stdout.write(`${line}\n`);
+};
+export async function main(argv) {
+    const args = [...argv];
+    if (args.includes("--help") || args.includes("-h") || args[0] === "help") {
+        out(HELP);
+        return 0;
+    }
+    if (args.includes("--version") || args.includes("-v")) {
+        out(PACKAGE_VERSION);
+        return 0;
+    }
+    const verb = args[0];
+    if (verb !== undefined && !verb.startsWith("-")) {
+        process.stderr.write(`forestrie-mcp-register: unknown command '${verb}'. Try --help.\n`);
+        return 1;
+    }
+    // Default: speak MCP on stdio. From here on, stdout belongs to the
+    // transport and nothing else may touch it.
+    const server = createServer();
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    // Wait for the client to go away (stdin ends, the transport closes) or
+    // for a signal. `server.server.onclose`, not `transport.onclose`: connect()
+    // installed the latter and overwriting it would skip the SDK's own
+    // cleanup. Listeners are removed afterwards so nothing here keeps the
+    // event loop alive.
+    let finish = () => { };
+    const ended = new Promise((resolve) => {
+        finish = resolve;
+    });
+    const onSignal = () => finish();
+    server.server.onclose = finish;
+    process.stdin.once("end", finish);
+    process.on("SIGINT", onSignal);
+    process.on("SIGTERM", onSignal);
+    await ended;
+    process.off("SIGINT", onSignal);
+    process.off("SIGTERM", onSignal);
+    process.stdin.off("end", finish);
+    // A signal leaves the transport open, and its stdin listener keeps the
+    // process alive for as long as the client holds the pipe. Close it so the
+    // event loop drains; the wrapper sets the exit code, never process.exit.
+    await server.close();
+    return 0;
+}
+/**
+ * Entry point. `process.exitCode` rather than `process.exit()`: node then
+ * drains stdout before exiting, which a hard exit would not.
+ */
+export async function run() {
+    try {
+        process.exitCode = await main(process.argv.slice(2));
+    }
+    catch (err) {
+        process.stderr.write(`forestrie-mcp-register: ${err instanceof Error ? (err.stack ?? err.message) : String(err)}\n`);
+        process.exitCode = 1;
+    }
+}
+await run();
+//# sourceMappingURL=cli.js.map

package/dist/node/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/node/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,YAAY,EACZ,aAAa,EACb,UAAU,EACV,WAAW,GACZ,MAAM,WAAW,CAAC;AAEnB;uCACuC;AACvC,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,CAChC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CACtD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CACpC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CACxD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,CAAC,MAAM,IAAI,GAAG,0BAA0B,eAAe;;;;;;;;;;;;;EAa3D,WAAW;;;EAGX,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oCA6BqB,gBAAgB;qCACf,eAAe;;CAEnD,CAAC;AAEF,wEAAwE;AACxE,MAAM,GAAG,GAAG,CAAC,IAAY,EAAQ,EAAE;IACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACpC,CAAC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAuB;IAChD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IAEvB,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACzE,GAAG,CAAC,IAAI,CAAC,CAAC;QACV,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,eAAe,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4CAA4C,IAAI,kBAAkB,CACnE,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,mEAAmE;IACnE,2CAA2C;IAC3C,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,uEAAuE;IACvE,4EAA4E;IAC5E,mEAAmE;IACnE,sEAAsE;IACtE,oBAAoB;IACpB,IAAI,MAAM,GAAe,GAAG,EAAE,GAAE,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC1C,MAAM,GAAG,OAAO,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,GAAS,EAAE,CAAC,MAAM,EAAE,CAAC;IACtC,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;IAC/B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChC,MAAM,KAAK,CAAC;IACZ,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACjC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAEjC,uEAAuE;IACvE,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACrB,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG;IACvB,IAAI,CAAC;QACH,OAAO,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2BAA2B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC/F,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,GAAG,EAAE,CAAC"}

package/dist/node/grant-store.d.ts

@@ -0,0 +1,49 @@
+import type { PaymentRequired, PaymentSummary } from "../core/x402.js";
+export type GrantState = 
+/** Signed (or supplied), not yet accepted by canopy. */
+"issued"
+/** canopy answered 402; waiting for a payment (relay mode). */
+ | "payment_required"
+/** canopy answered 303: enqueued for sequencing under the owner log. */
+ | "accepted"
+/** Sealed, and completed with its receipt. */
+ | "complete";
+export interface GrantRecord {
+    logId: string;
+    ownerLogId: string;
+    state: GrantState;
+    /** True when issue_grant signed it here. */
+    issuedHere: boolean;
+    /** The key the grant names, hex x‖y. */
+    granteeHex: string;
+    maxHeight?: number;
+    flagsHex: string;
+    /** Whether the parent grant carries GF_CHILD_PAYMENT_REQUIRED. */
+    parentRequiresPayment?: boolean;
+    issuedAt: string;
+    baseUrl?: string;
+    rootLogId?: string;
+    paymentRequired?: PaymentRequired;
+    payment?: PaymentSummary & {
+        via: "payer" | "relay";
+        at: string;
+    };
+    statusUrl?: string;
+    acceptedAt?: string;
+    firstPendingAt?: string;
+    entryId?: string;
+    massifHeight?: number;
+    receiptUrl?: string;
+    completedAt?: string;
+}
+export declare class GrantStore {
+    readonly root: string;
+    constructor(root: string);
+    dir(logId: string): string;
+    path(logId: string, file: string): string;
+    has(logId: string): boolean;
+    save(record: GrantRecord, files?: Record<string, Uint8Array>): void;
+    load(logId: string): GrantRecord;
+    read(logId: string, file: string): Uint8Array | undefined;
+}
+//# sourceMappingURL=grant-store.d.ts.map

package/dist/node/grant-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-store.d.ts","sourceRoot":"","sources":["../../src/node/grant-store.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGvE,MAAM,MAAM,UAAU;AACpB,wDAAwD;AACtD,QAAQ;AACV,+DAA+D;GAC7D,kBAAkB;AACpB,wEAAwE;GACtE,UAAU;AACZ,8CAA8C;GAC5C,UAAU,CAAC;AAEf,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,UAAU,CAAC;IAClB,4CAA4C;IAC5C,UAAU,EAAE,OAAO,CAAC;IACpB,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,OAAO,CAAC,EAAE,cAAc,GAAG;QAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAqBD,qBAAa,UAAU;IACT,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM;IAEjC,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAS1B,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM;IAIzC,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAS3B,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAM,GAAG,IAAI;IAYvE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW;IAmChC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;CAW1D"}

package/dist/node/grant-store.js

@@ -0,0 +1,95 @@
+/**
+ * Where child grants are kept between issue_grant and register_grant:
+ * `<home>/grants/<logId>/` holding `record.json`, `grant.cose` (as signed),
+ * `parent.cose` (the requester's authority grant, when known),
+ * `receipt.cose` and `completed.cose` (the grant with its receipt: the
+ * credential).
+ *
+ * The record is keyed by the child log id, so register_grant resumes from
+ * whatever state the last call reached. Nothing here is secret.
+ */
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { StoreError } from "./store.js";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const STATES = [
+    "issued",
+    "payment_required",
+    "accepted",
+    "complete",
+];
+function io(what, run) {
+    try {
+        return run();
+    }
+    catch (err) {
+        throw new StoreError("store_failed", `${what}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+export class GrantStore {
+    root;
+    constructor(root) {
+        this.root = root;
+    }
+    dir(logId) {
+        if (!UUID.test(logId))
+            throw new StoreError("unknown_registration", `logId must be a lowercase UUID (the child log id issue_grant returned); got ${logId}`);
+        return join(this.root, "grants", logId);
+    }
+    path(logId, file) {
+        return join(this.dir(logId), file);
+    }
+    has(logId) {
+        try {
+            readFileSync(this.path(logId, "record.json"));
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    save(record, files = {}) {
+        io(`cannot save grant ${record.logId} under ${this.root}`, () => {
+            mkdirSync(this.dir(record.logId), { recursive: true, mode: 0o700 });
+            for (const [name, bytes] of Object.entries(files))
+                writeFileSync(this.path(record.logId, name), bytes);
+            writeFileSync(this.path(record.logId, "record.json"), JSON.stringify(record, null, 2) + "\n");
+        });
+    }
+    load(logId) {
+        const path = this.path(logId, "record.json");
+        let text;
+        try {
+            text = readFileSync(path, "utf8");
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                throw new StoreError("unknown_registration", `no grant for log ${logId} in ${this.root}: issue_grant records each grant it signs there, or pass the grant itself`);
+            throw new StoreError("store_failed", `cannot read ${path}: ${err.message}`);
+        }
+        let record;
+        try {
+            record = JSON.parse(text);
+        }
+        catch {
+            record = undefined;
+        }
+        if (record === undefined ||
+            record.logId !== logId ||
+            typeof record.ownerLogId !== "string" ||
+            !STATES.includes(record.state))
+            throw new StoreError("corrupt_record", `${path} is not a grant record for ${logId}`);
+        return record;
+    }
+    read(logId, file) {
+        try {
+            return new Uint8Array(readFileSync(this.path(logId, file)));
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                return undefined;
+            throw new StoreError("store_failed", `cannot read ${file} for grant ${logId}: ${err.message}`);
+        }
+    }
+}
+//# sourceMappingURL=grant-store.js.map

package/dist/node/grant-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-store.js","sourceRoot":"","sources":["../../src/node/grant-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAsCxC,MAAM,IAAI,GAAG,gEAAgE,CAAC;AAC9E,MAAM,MAAM,GAAiB;IAC3B,QAAQ;IACR,kBAAkB;IAClB,UAAU;IACV,UAAU;CACX,CAAC;AAEF,SAAS,EAAE,CAAI,IAAY,EAAE,GAAY;IACvC,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,GAAG,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,OAAO,UAAU;IACA;IAArB,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAErC,GAAG,CAAC,KAAa;QACf,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;YACnB,MAAM,IAAI,UAAU,CAClB,sBAAsB,EACtB,+EAA+E,KAAK,EAAE,CACvF,CAAC;QACJ,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,CAAC,KAAa,EAAE,IAAY;QAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,GAAG,CAAC,KAAa;QACf,IAAI,CAAC;YACH,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAmB,EAAE,QAAoC,EAAE;QAC9D,EAAE,CAAC,qBAAqB,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE;YAC9D,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACpE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;gBAC/C,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;YACtD,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,EACtC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CACvC,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,KAAa;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAC7C,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAClD,MAAM,IAAI,UAAU,CAClB,sBAAsB,EACtB,oBAAoB,KAAK,OAAO,IAAI,CAAC,IAAI,2EAA2E,CACrH,CAAC;YACJ,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,eAAe,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CACjD,CAAC;QACJ,CAAC;QACD,IAAI,MAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyB,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;QACD,IACE,MAAM,KAAK,SAAS;YACpB,MAAM,CAAC,KAAK,KAAK,KAAK;YACtB,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;YACrC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAmB,CAAC;YAE5C,MAAM,IAAI,UAAU,CAClB,gBAAgB,EAChB,GAAG,IAAI,8BAA8B,KAAK,EAAE,CAC7C,CAAC;QACJ,OAAO,MAAqB,CAAC;IAC/B,CAAC;IAED,IAAI,CAAC,KAAa,EAAE,IAAY;QAC9B,IAAI,CAAC;YACH,OAAO,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACvE,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,eAAe,IAAI,cAAc,KAAK,KAAM,GAAa,CAAC,OAAO,EAAE,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/node/grant-tools.d.ts

@@ -0,0 +1,29 @@
+import { z } from "zod";
+import { type Args, type ResolvedDeps, type ToolResult } from "./tools.js";
+export declare const issueGrantInputShape: {
+    maxHeight: z.ZodNumber;
+    parentGrant: z.ZodOptional<z.ZodString>;
+    grantee: z.ZodOptional<z.ZodString>;
+    logId: z.ZodOptional<z.ZodString>;
+};
+export declare const registerGrantInputShape: {
+    logId: z.ZodOptional<z.ZodString>;
+    grant: z.ZodOptional<z.ZodString>;
+    parentGrant: z.ZodOptional<z.ZodString>;
+    payment: z.ZodOptional<z.ZodString>;
+    baseUrl: z.ZodOptional<z.ZodString>;
+    rootLogId: z.ZodOptional<z.ZodString>;
+};
+export declare function makeIssueGrantTool(deps: ResolvedDeps): (args: Args<typeof issueGrantInputShape>) => Promise<ToolResult>;
+/**
+ * No lock: paying twice for one grant is prevented by the nonce, not by
+ * serialising calls. Every authorisation this server signs for a grant
+ * carries `grantPaymentNonce(grant content, payer)`, so overlapping calls,
+ * a retry after a lost answer and other processes sharing the payer all
+ * sign the same nonce, and EIP-3009 settles at most one authorisation per
+ * (payer, nonce). The daily cap is approximate under concurrency: calls that
+ * pass the check before either records its payment can overshoot it by at
+ * most one per-call cap each.
+ */
+export declare function makeRegisterGrantTool(deps: ResolvedDeps): (args: Args<typeof registerGrantInputShape>) => Promise<ToolResult>;
+//# sourceMappingURL=grant-tools.d.ts.map

package/dist/node/grant-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-tools.d.ts","sourceRoot":"","sources":["../../src/node/grant-tools.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA4CxB,OAAO,EAWL,KAAK,IAAI,EACT,KAAK,YAAY,EACjB,KAAK,UAAU,EAChB,MAAM,YAAY,CAAC;AAcpB,eAAO,MAAM,oBAAoB;;;;;CAmBhC,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;;;;CAuBnC,CAAC;AAIF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,YAAY,IAC3C,MAAM,IAAI,CAAC,OAAO,oBAAoB,CAAC,yBAgFhD;AAuGD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,YAAY,IAC9C,MAAM,IAAI,CAAC,OAAO,uBAAuB,CAAC,yBAEnD"}