@helm-protocol/ttt-mcp 0.3.2 → 0.3.4

package/README.md

@@ -55,12 +55,12 @@ Claude workflow → [context compressed] → agents call pot_query(eventId)
 ### Claude Code
 
 ```bash
-claude mcp add ttt -- npx -y @helm-protocol/ttt-mcp@0.3.0
+claude mcp add ttt -- npx -y @helm-protocol/ttt-mcp@0.3.3
 ```
 
 With an API key (raises the free limit to your plan's monthly quota):
 ```bash
-claude mcp add ttt -e TTT_API_KEY=your-key -- npx -y @helm-protocol/ttt-mcp@0.3.0
+claude mcp add ttt -e TTT_API_KEY=your-key -- npx -y @helm-protocol/ttt-mcp@0.3.3
 ```
 
 ### Claude Desktop
@@ -72,7 +72,7 @@ Add to `claude_desktop_config.json`:
   "mcpServers": {
     "ttt": {
       "command": "npx",
-      "args": ["-y", "@helm-protocol/ttt-mcp@0.3.0"],
+      "args": ["-y", "@helm-protocol/ttt-mcp@0.3.3"],
       "env": { "TTT_API_KEY": "your-key" }
     }
   }
@@ -81,7 +81,7 @@ Add to `claude_desktop_config.json`:
 
 ### Cursor
 
-[![Add to Cursor](https://img.shields.io/badge/Add%20to%20Cursor-1a1a1a?style=flat&logo=cursor&logoColor=white)](https://cursor.com/install-mcp?name=ttt&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBoZWxtLXByb3RvY29sL3R0dC1tY3BAMC4zLjAiXX0=)
+[![Add to Cursor](https://img.shields.io/badge/Add%20to%20Cursor-1a1a1a?style=flat&logo=cursor&logoColor=white)](https://cursor.com/install-mcp?name=ttt&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBoZWxtLXByb3RvY29sL3R0dC1tY3BAMC4zLjMiXX0=)
 
 One-click install, or add the same `mcpServers` block above to `.cursor/mcp.json`.
 

package/dist/pot_record_v08.js

@@ -0,0 +1,212 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var pot_record_v08_exports = {};
+__export(pot_record_v08_exports, {
+  MTI_INTEGRITY_ALG_SHA256: () => MTI_INTEGRITY_ALG_SHA256,
+  RECORD_SIZE_HOLDER: () => RECORD_SIZE_HOLDER,
+  RECORD_SIZE_NO_HOLDER: () => RECORD_SIZE_NO_HOLDER,
+  RESERVED_ERROR_BOUND: () => RESERVED_ERROR_BOUND,
+  assemblePotRecordV08: () => assemblePotRecordV08,
+  computeCommitmentSha256: () => computeCommitmentSha256,
+  decodePotRecordV08: () => decodePotRecordV08,
+  ed25519KeyFromSeed: () => ed25519KeyFromSeed,
+  ed25519PublicKeyFromRaw: () => ed25519PublicKeyFromRaw,
+  generatePotRecordV08: () => generatePotRecordV08,
+  rawPublicKeyOf: () => rawPublicKeyOf,
+  verifyPotRecordV08: () => verifyPotRecordV08
+});
+module.exports = __toCommonJS(pot_record_v08_exports);
+var import_crypto = require("crypto");
+const ED25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
+const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+function ed25519KeyFromSeed(seed) {
+  if (seed.length !== 32) throw new Error("Ed25519 seed must be 32 bytes");
+  const der = Buffer.concat([ED25519_PKCS8_PREFIX, seed]);
+  return (0, import_crypto.createPrivateKey)({ key: der, format: "der", type: "pkcs8" });
+}
+function ed25519PublicKeyFromRaw(pub) {
+  if (pub.length !== 32) throw new Error("Ed25519 public key must be 32 bytes");
+  const der = Buffer.concat([ED25519_SPKI_PREFIX, pub]);
+  return (0, import_crypto.createPublicKey)({ key: der, format: "der", type: "spki" });
+}
+function rawPublicKeyOf(key) {
+  return key.export({ type: "spki", format: "der" }).subarray(-32);
+}
+const PRE_OFFSET = {
+  HEADER: 0,
+  // Version(4)|Tier(4), Flags(8), Integrity Alg(16) — 4 bytes
+  SRC_ERR: 4,
+  // Src Cnt(8), Error Bound(24) — 4 bytes
+  TIMESTAMP: 8,
+  // 8 bytes
+  ISSUER_KEY_ID: 16,
+  // 8 bytes
+  NONCE: 24,
+  // 32 bytes
+  PAYLOAD_DIGEST: 56,
+  // 32 bytes
+  HOLDER_KEY: 88
+  // 32 bytes, iff Flags bit 0 = 1
+};
+const PRE_LEN_NO_HOLDER = 88;
+const PRE_LEN_HOLDER = 120;
+const COMMITMENT_LEN = 32;
+const SIGNATURE_LEN = 64;
+const RECORD_SIZE_NO_HOLDER = PRE_LEN_NO_HOLDER + COMMITMENT_LEN + SIGNATURE_LEN;
+const RECORD_SIZE_HOLDER = PRE_LEN_HOLDER + COMMITMENT_LEN + SIGNATURE_LEN;
+const MTI_INTEGRITY_ALG_SHA256 = 1;
+const RESERVED_ERROR_BOUND = 16777215;
+function encodeFieldsPre(f) {
+  if (f.version < 0 || f.version > 15) throw new Error("version must fit in 4 bits");
+  if (f.tier < 0 || f.tier > 15) throw new Error("tier must fit in 4 bits");
+  if (f.integrityAlg < 0 || f.integrityAlg > 65535) throw new Error("integrityAlg must fit in 16 bits");
+  if (f.srcCnt < 3) throw new Error("Src Cnt MUST be at least 3 (draft-08 Section 3.2)");
+  if (f.srcCnt > 255) throw new Error("srcCnt must fit in 8 bits");
+  if (f.errorBoundUs === RESERVED_ERROR_BOUND) {
+    throw new Error("Error Bound 0xFFFFFF is reserved and MUST NOT be emitted (draft-08 Section 3.2)");
+  }
+  if (f.errorBoundUs < 0 || f.errorBoundUs > 16777215) throw new Error("errorBoundUs must fit in 24 bits");
+  if (f.issuerKeyId.length !== 8) throw new Error("issuerKeyId must be 8 bytes");
+  if (f.nonce.length !== 32) throw new Error("nonce must be 32 bytes");
+  if (f.payloadDigest.length !== 32) throw new Error("payloadDigest must be 32 bytes (SHA-256)");
+  if (f.holderKey !== void 0 && f.holderKey.length !== 32) {
+    throw new Error("holderKey must be 32 bytes");
+  }
+  const hasHolder = f.holderKey !== void 0;
+  const buf = Buffer.alloc(hasHolder ? PRE_LEN_HOLDER : PRE_LEN_NO_HOLDER);
+  buf.writeUInt8(f.version << 4 | f.tier, PRE_OFFSET.HEADER);
+  buf.writeUInt8(hasHolder ? 128 : 0, PRE_OFFSET.HEADER + 1);
+  buf.writeUInt16BE(f.integrityAlg, PRE_OFFSET.HEADER + 2);
+  buf.writeUInt8(f.srcCnt, PRE_OFFSET.SRC_ERR);
+  buf.writeUIntBE(f.errorBoundUs, PRE_OFFSET.SRC_ERR + 1, 3);
+  buf.writeBigUInt64BE(f.timestampNs, PRE_OFFSET.TIMESTAMP);
+  f.issuerKeyId.copy(buf, PRE_OFFSET.ISSUER_KEY_ID);
+  f.nonce.copy(buf, PRE_OFFSET.NONCE);
+  f.payloadDigest.copy(buf, PRE_OFFSET.PAYLOAD_DIGEST);
+  if (hasHolder) f.holderKey.copy(buf, PRE_OFFSET.HOLDER_KEY);
+  return buf;
+}
+function computeCommitmentSha256(fieldsPre, ctxId) {
+  const ctxBytes = Buffer.from(ctxId, "utf8");
+  if (ctxBytes.length > 255) {
+    throw new Error("ctx_id exceeds 255 octets \u2014 not usable with integrity algorithm 0x0001");
+  }
+  return (0, import_crypto.createHash)("sha256").update(Buffer.concat([Buffer.from([ctxBytes.length]), ctxBytes, Buffer.from([0]), fieldsPre])).digest();
+}
+function assemblePotRecordV08(fields, ctxId, issuerPrivateKey) {
+  const fieldsPre = encodeFieldsPre(fields);
+  const commitment = computeCommitmentSha256(fieldsPre, ctxId);
+  const p = Buffer.concat([fieldsPre, commitment]);
+  const signature = (0, import_crypto.sign)(null, p, issuerPrivateKey);
+  return Buffer.concat([p, signature]);
+}
+function generatePotRecordV08(fields, ctxId, issuerPrivateKeySeed) {
+  return assemblePotRecordV08(fields, ctxId, ed25519KeyFromSeed(issuerPrivateKeySeed));
+}
+function decodePotRecordV08(record) {
+  if (record.length < 2) throw new Error("record too short to read Flags");
+  const flags = record.readUInt8(PRE_OFFSET.HEADER + 1);
+  const hasHolder = (flags & 128) !== 0;
+  const expectedLen = hasHolder ? RECORD_SIZE_HOLDER : RECORD_SIZE_NO_HOLDER;
+  if (record.length !== expectedLen) {
+    throw new Error(`expected ${expectedLen} octets for Flags bit0=${hasHolder ? 1 : 0}, got ${record.length}`);
+  }
+  const versionTier = record.readUInt8(PRE_OFFSET.HEADER);
+  const version = versionTier >> 4 & 15;
+  const tier = versionTier & 15;
+  const integrityAlg = record.readUInt16BE(PRE_OFFSET.HEADER + 2);
+  const srcCnt = record.readUInt8(PRE_OFFSET.SRC_ERR);
+  const errorBoundUs = record.readUIntBE(PRE_OFFSET.SRC_ERR + 1, 3);
+  const timestampNs = record.readBigUInt64BE(PRE_OFFSET.TIMESTAMP);
+  const issuerKeyId = Buffer.from(record.subarray(PRE_OFFSET.ISSUER_KEY_ID, PRE_OFFSET.ISSUER_KEY_ID + 8));
+  const nonce = Buffer.from(record.subarray(PRE_OFFSET.NONCE, PRE_OFFSET.NONCE + 32));
+  const payloadDigest = Buffer.from(record.subarray(PRE_OFFSET.PAYLOAD_DIGEST, PRE_OFFSET.PAYLOAD_DIGEST + 32));
+  const preLen = hasHolder ? PRE_LEN_HOLDER : PRE_LEN_NO_HOLDER;
+  const holderKey = hasHolder ? Buffer.from(record.subarray(PRE_OFFSET.HOLDER_KEY, PRE_OFFSET.HOLDER_KEY + 32)) : void 0;
+  const fieldsPre = Buffer.from(record.subarray(0, preLen));
+  const commitment = Buffer.from(record.subarray(preLen, preLen + COMMITMENT_LEN));
+  const signature = Buffer.from(record.subarray(preLen + COMMITMENT_LEN, preLen + COMMITMENT_LEN + SIGNATURE_LEN));
+  const p = Buffer.from(record.subarray(0, preLen + COMMITMENT_LEN));
+  return {
+    version,
+    tier,
+    flags,
+    integrityAlg,
+    srcCnt,
+    errorBoundUs,
+    timestampNs,
+    issuerKeyId,
+    nonce,
+    payloadDigest,
+    holderKey,
+    commitment,
+    signature,
+    fieldsPre,
+    p
+  };
+}
+function verifyPotRecordV08(record, ctxId, issuerPublicKeyRaw, content) {
+  let decoded;
+  try {
+    decoded = decodePotRecordV08(record);
+  } catch (e) {
+    return { verdict: "rejected", reason: e instanceof Error ? e.message : String(e) };
+  }
+  if (decoded.version !== 1) {
+    return { verdict: "rejected", reason: `unknown version ${decoded.version}, expected 1` };
+  }
+  if (decoded.integrityAlg !== MTI_INTEGRITY_ALG_SHA256) {
+    return { verdict: "rejected", reason: `unimplemented integrity algorithm 0x${decoded.integrityAlg.toString(16)}` };
+  }
+  if (decoded.errorBoundUs === RESERVED_ERROR_BOUND) {
+    return { verdict: "rejected", reason: "Error Bound carries the reserved value 0xFFFFFF" };
+  }
+  const expectedCommitment = computeCommitmentSha256(decoded.fieldsPre, ctxId);
+  if (!expectedCommitment.equals(decoded.commitment)) {
+    return { verdict: "rejected", reason: "commitment mismatch" };
+  }
+  const publicKey = ed25519PublicKeyFromRaw(issuerPublicKeyRaw);
+  if (!(0, import_crypto.verify)(null, decoded.p, publicKey, decoded.signature)) {
+    return { verdict: "rejected", reason: "Ed25519 signature invalid" };
+  }
+  let payloadDigestMatchesContent;
+  if (content !== void 0) {
+    const recomputed = (0, import_crypto.createHash)("sha256").update(content).digest();
+    payloadDigestMatchesContent = recomputed.equals(decoded.payloadDigest);
+    if (!payloadDigestMatchesContent) {
+      return { verdict: "rejected", reason: "Payload Digest does not match supplied content", payloadDigestMatchesContent };
+    }
+  }
+  return { verdict: "intact", payloadDigestMatchesContent };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  MTI_INTEGRITY_ALG_SHA256,
+  RECORD_SIZE_HOLDER,
+  RECORD_SIZE_NO_HOLDER,
+  RESERVED_ERROR_BOUND,
+  assemblePotRecordV08,
+  computeCommitmentSha256,
+  decodePotRecordV08,
+  ed25519KeyFromSeed,
+  ed25519PublicKeyFromRaw,
+  generatePotRecordV08,
+  rawPublicKeyOf,
+  verifyPotRecordV08
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helm-protocol/ttt-mcp",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "Proof-of-Time attestation — Ed25519-signed timestamps with multi-source corroboration and explicit error bounds. IETF draft-helmprotocol-tttps",
   "main": "dist/index.js",
   "bin": {
@@ -11,7 +11,7 @@
     "README.md"
   ],
   "scripts": {
-    "build": "esbuild index.ts tools.ts telemetry.ts auth.ts server.ts --platform=node --target=node18 --format=cjs --outdir=dist",
+    "build": "esbuild index.ts tools.ts telemetry.ts auth.ts server.ts pot_record_v08.ts --platform=node --target=node18 --format=cjs --outdir=dist",
     "start": "node dist/index.js",
     "dev": "npx ts-node index.ts",
     "test": "jest --forceExit",
@@ -20,16 +20,21 @@
   "jest": {
     "preset": "ts-jest",
     "testEnvironment": "node",
-    "testMatch": ["**/__tests__/**/*.test.ts"],
+    "testMatch": [
+      "**/__tests__/**/*.test.ts"
+    ],
     "moduleNameMapper": {
       "^openttt$": "<rootDir>/node_modules/openttt/dist/index.js"
     },
     "transform": {
-      "^.+\\.tsx?$": ["ts-jest", {
-        "tsconfig": {
-          "module": "CommonJS"
+      "^.+\\.tsx?$": [
+        "ts-jest",
+        {
+          "tsconfig": {
+            "module": "CommonJS"
+          }
         }
-      }]
+      ]
     }
   },
   "keywords": [
@@ -54,7 +59,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",
     "ioredis": "^5.11.0",
-    "openttt": "^0.2.13",
+    "openttt": "^0.3.1",
     "zod": "^3.25.0"
   },
   "devDependencies": {