@provian/mcp 0.0.0-stage → 1.2.0

package/dist/device-credentials.js

@@ -0,0 +1,403 @@
+"use strict";
+/**
+ * Device-credential resolution for the stdio MCP server.
+ *
+ * Reads/writes ~/.provian/credentials — the SDK's env-format device file
+ * (KEY=VALUE lines, 0600) — so the MCP server, the CLI, and the observer all
+ * share ONE registered device per machine instead of minting one each.
+ *
+ * Safety rule: file credentials are reused only when PROVIAN_OWNER_TYPE=agent.
+ * A human-owned device file (from `register-device` without --agent) is left
+ * alone — submitting agent PEs through a human device would silently attribute
+ * them to the human's wallet. Env vars (PROVIAN_DEVICE_KEY/SECRET) are treated
+ * as explicit operator intent and used as-is.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MCP_PENDING_DEVICE_REGISTRATION_PATH = exports.DEVICE_CREDS_PATH = void 0;
+exports.loadOrCreatePendingDeviceRegistration = loadOrCreatePendingDeviceRegistration;
+exports.clearPendingDeviceRegistration = clearPendingDeviceRegistration;
+exports.reconcileInstalledDeviceRegistration = reconcileInstalledDeviceRegistration;
+exports.loadBoundDeviceCredentialsFile = loadBoundDeviceCredentialsFile;
+exports.resolveLocalDeviceAuth = resolveLocalDeviceAuth;
+exports.persistDeviceCredentialsFile = persistDeviceCredentialsFile;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os_1 = require("os");
+const crypto_1 = require("crypto");
+exports.DEVICE_CREDS_PATH = path.join((0, os_1.homedir)(), '.provian', 'credentials');
+exports.MCP_PENDING_DEVICE_REGISTRATION_PATH = path.join((0, os_1.homedir)(), '.provian', 'pending-mcp-device-registration.json');
+const DEFAULT_RELAY_URL = 'https://api.provian.ai';
+const PENDING_KEYS = [
+    'context_sha256',
+    'created_at_ms',
+    'device_key',
+    'device_secret',
+    'registration_id',
+    'schema_version',
+];
+const DEVICE_KEY = /^pdk_[a-f0-9]{32}$/;
+const DEVICE_SECRET = /^pds_[a-f0-9]{64}$/;
+const REGISTRATION_ID = /^[A-Za-z0-9][A-Za-z0-9_.:@-]{15,127}$/;
+function hasPathEntry(filePath) {
+    try {
+        fs.lstatSync(filePath);
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        return true;
+    }
+}
+function readPrivateText(filePath, label) {
+    const noFollow = process.platform === 'win32' ? 0 : fs.constants.O_NOFOLLOW;
+    let fd;
+    try {
+        const pathStat = fs.lstatSync(filePath);
+        if (!pathStat.isFile() || pathStat.isSymbolicLink()) {
+            throw new Error(`${label} must be a private regular file`);
+        }
+        fd = fs.openSync(filePath, fs.constants.O_RDONLY | noFollow);
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith(label))
+            throw error;
+        throw new Error(`${label} is missing, unreadable, or unsafe`);
+    }
+    try {
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile()
+            || (process.platform !== 'win32' && (stat.mode & 0o077) !== 0)) {
+            throw new Error(`${label} must be a private 0600 regular file`);
+        }
+        return fs.readFileSync(fd, 'utf8');
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+function fsyncParentDirectory(filePath) {
+    const directoryFd = fs.openSync(path.dirname(filePath), 'r');
+    try {
+        fs.fsyncSync(directoryFd);
+    }
+    finally {
+        fs.closeSync(directoryFd);
+    }
+}
+function pendingContextHash(context) {
+    return (0, crypto_1.createHash)('sha256').update(JSON.stringify({
+        owner_key: context.owner_key,
+        device_name: context.device_name,
+        platform: context.platform,
+    })).digest('hex');
+}
+function parsePendingRegistration(raw, expectedContextHash) {
+    let parsed;
+    try {
+        const value = JSON.parse(raw);
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw new Error('not an object');
+        parsed = value;
+    }
+    catch {
+        throw new Error('Pending MCP device registration is malformed; refusing to replace an ambiguous identity');
+    }
+    const keys = Object.keys(parsed).sort();
+    if (keys.length !== PENDING_KEYS.length
+        || keys.some((key, index) => key !== PENDING_KEYS[index])
+        || parsed.schema_version !== 'provian-mcp-device-registration/v1'
+        || typeof parsed.context_sha256 !== 'string'
+        || !/^[a-f0-9]{64}$/.test(parsed.context_sha256)
+        || (expectedContextHash !== undefined && parsed.context_sha256 !== expectedContextHash)
+        || typeof parsed.registration_id !== 'string'
+        || !REGISTRATION_ID.test(parsed.registration_id)
+        || typeof parsed.device_key !== 'string'
+        || !DEVICE_KEY.test(parsed.device_key)
+        || typeof parsed.device_secret !== 'string'
+        || !DEVICE_SECRET.test(parsed.device_secret)
+        || typeof parsed.created_at_ms !== 'number'
+        || !Number.isSafeInteger(parsed.created_at_ms)
+        || parsed.created_at_ms < 0) {
+        throw new Error('Pending MCP device registration does not match this agent/context; refusing to create a second ambiguous identity');
+    }
+    return parsed;
+}
+/**
+ * Persist a stable pending registration before the caller is allowed to send
+ * the first network request. Atomic rename means a crash yields either no
+ * request identity (and therefore no request) or the complete reusable one.
+ */
+function loadOrCreatePendingDeviceRegistration(context, pendingPath = exports.MCP_PENDING_DEVICE_REGISTRATION_PATH) {
+    const contextSha256 = pendingContextHash(context);
+    if (hasPathEntry(pendingPath)) {
+        const existing = parsePendingRegistration(readPrivateText(pendingPath, 'Pending MCP device registration'), contextSha256);
+        return {
+            registrationId: existing.registration_id,
+            deviceKey: existing.device_key,
+            deviceSecret: existing.device_secret,
+        };
+    }
+    const pending = {
+        schema_version: 'provian-mcp-device-registration/v1',
+        context_sha256: contextSha256,
+        registration_id: `mcp-device-registration-${(0, crypto_1.randomUUID)()}`,
+        device_key: `pdk_${(0, crypto_1.randomBytes)(16).toString('hex')}`,
+        device_secret: `pds_${(0, crypto_1.randomBytes)(32).toString('hex')}`,
+        created_at_ms: Date.now(),
+    };
+    fs.mkdirSync(path.dirname(pendingPath), { recursive: true, mode: 0o700 });
+    const temporaryPath = `${pendingPath}.${process.pid}.${(0, crypto_1.randomBytes)(8).toString('hex')}.tmp`;
+    try {
+        const fd = fs.openSync(temporaryPath, 'wx', 0o600);
+        try {
+            fs.writeFileSync(fd, `${JSON.stringify(pending, null, 2)}\n`, 'utf8');
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        // link is create-if-absent (unlike rename, which would replace a winner).
+        // Concurrent first-use calls therefore converge on one complete identity.
+        try {
+            fs.linkSync(temporaryPath, pendingPath);
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            const winner = parsePendingRegistration(readPrivateText(pendingPath, 'Pending MCP device registration'), contextSha256);
+            return {
+                registrationId: winner.registration_id,
+                deviceKey: winner.device_key,
+                deviceSecret: winner.device_secret,
+            };
+        }
+        const directoryFd = fs.openSync(path.dirname(pendingPath), 'r');
+        try {
+            fs.fsyncSync(directoryFd);
+        }
+        finally {
+            fs.closeSync(directoryFd);
+        }
+    }
+    catch (error) {
+        try {
+            fs.unlinkSync(temporaryPath);
+        }
+        catch { /* no partial temp file */ }
+        throw error;
+    }
+    finally {
+        try {
+            fs.unlinkSync(temporaryPath);
+        }
+        catch { /* linked file already durable */ }
+    }
+    return {
+        registrationId: pending.registration_id,
+        deviceKey: pending.device_key,
+        deviceSecret: pending.device_secret,
+    };
+}
+/** Delete only the exact pending identity that just became durable. */
+function clearPendingDeviceRegistration(registrationId, pendingPath = exports.MCP_PENDING_DEVICE_REGISTRATION_PATH, credsPath = exports.DEVICE_CREDS_PATH) {
+    if (!hasPathEntry(pendingPath))
+        return;
+    const parsed = parsePendingRegistration(readPrivateText(pendingPath, 'Pending MCP device registration'));
+    if (parsed.registration_id !== registrationId) {
+        throw new Error('Pending MCP device registration changed before acknowledgement');
+    }
+    const installed = loadBoundDeviceCredentialsFile(credsPath);
+    if (!installed
+        || installed.registrationId !== parsed.registration_id
+        || installed.deviceKey !== parsed.device_key
+        || installed.deviceSecret !== parsed.device_secret) {
+        throw new Error('Installed device credentials do not match the pending registration');
+    }
+    fs.unlinkSync(pendingPath);
+    fsyncParentDirectory(pendingPath);
+}
+/** Finish the legal crash state where bound credentials crossed their fsync
+ * barrier but pending deletion did not. A legacy/unbound device file is left
+ * untouched because it cannot authenticate the pending identity. */
+function reconcileInstalledDeviceRegistration(pendingPath = exports.MCP_PENDING_DEVICE_REGISTRATION_PATH, credsPath = exports.DEVICE_CREDS_PATH) {
+    if (!hasPathEntry(pendingPath))
+        return;
+    const installed = loadBoundDeviceCredentialsFile(credsPath);
+    if (!installed)
+        return;
+    clearPendingDeviceRegistration(installed.registrationId, pendingPath, credsPath);
+}
+function unquote(value) {
+    const trimmed = value.trim();
+    if ((trimmed.startsWith('"') && trimmed.endsWith('"')) ||
+        (trimmed.startsWith("'") && trimmed.endsWith("'"))) {
+        return trimmed.slice(1, -1);
+    }
+    return trimmed;
+}
+function parseEnvFormat(content) {
+    const values = {};
+    for (const rawLine of content.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const body = line.startsWith('export ') ? line.slice('export '.length).trim() : line;
+        const eq = body.indexOf('=');
+        if (eq === -1)
+            continue;
+        const key = body.slice(0, eq).trim();
+        if (Object.prototype.hasOwnProperty.call(values, key)) {
+            throw new Error(`Duplicate device credential field ${key}`);
+        }
+        values[key] = unquote(body.slice(eq + 1));
+    }
+    return values;
+}
+function loadDeviceCredentialValues(credsPath) {
+    if (!hasPathEntry(credsPath))
+        return null;
+    try {
+        return parseEnvFormat(readPrivateText(credsPath, 'Device credentials'));
+    }
+    catch {
+        return null;
+    }
+}
+function loadBoundDeviceCredentialsFile(credsPath = exports.DEVICE_CREDS_PATH) {
+    const values = loadDeviceCredentialValues(credsPath);
+    if (!values
+        || values.PROVIAN_OWNER_TYPE !== 'agent'
+        || !DEVICE_KEY.test(values.PROVIAN_DEVICE_KEY || '')
+        || !DEVICE_SECRET.test(values.PROVIAN_DEVICE_SECRET || '')
+        || !/^dev_[a-f0-9]{64}$/.test(values.PROVIAN_DEVICE_ID || '')
+        || !/^wallet_aw_[A-Za-z0-9_-]+$/.test(values.PROVIAN_AGENT_WALLET_ID || '')
+        || !REGISTRATION_ID.test(values.PROVIAN_DEVICE_REGISTRATION_ID || ''))
+        return null;
+    return {
+        deviceKey: values.PROVIAN_DEVICE_KEY,
+        deviceSecret: values.PROVIAN_DEVICE_SECRET,
+        deviceId: values.PROVIAN_DEVICE_ID,
+        walletId: values.PROVIAN_AGENT_WALLET_ID,
+        registrationId: values.PROVIAN_DEVICE_REGISTRATION_ID,
+    };
+}
+/** Resolve device credentials: env first, then an agent-owned device file. */
+function resolveLocalDeviceAuth(env = process.env, credsPath = exports.DEVICE_CREDS_PATH) {
+    const envKey = env.PROVIAN_DEVICE_KEY?.trim();
+    const envSecret = env.PROVIAN_DEVICE_SECRET?.trim();
+    if (envKey && envSecret)
+        return { deviceKey: envKey, deviceSecret: envSecret };
+    try {
+        const values = loadDeviceCredentialValues(credsPath);
+        if (!values || values.PROVIAN_OWNER_TYPE !== 'agent')
+            return null;
+        const key = values.PROVIAN_DEVICE_KEY;
+        const secret = values.PROVIAN_DEVICE_SECRET;
+        if (!DEVICE_KEY.test(key || '') || !DEVICE_SECRET.test(secret || ''))
+            return null;
+        return { deviceKey: key, deviceSecret: secret };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Persist device credentials in the SDK's exact file format. Never overwrites
+ * an existing file (an already-registered device identity wins). Returns the
+ * path written, or null when skipped/failed.
+ */
+function persistDeviceCredentialsFile(creds, credsPath = exports.DEVICE_CREDS_PATH) {
+    try {
+        if (!DEVICE_KEY.test(creds.device_key)
+            || !DEVICE_SECRET.test(creds.device_secret)
+            || typeof creds.device_id !== 'string'
+            || !/^dev_[a-f0-9]{64}$/.test(creds.device_id)
+            || typeof creds.wallet_id !== 'string'
+            || !/^wallet_aw_[A-Za-z0-9_-]+$/.test(creds.wallet_id)
+            || typeof creds.registration_id !== 'string'
+            || !REGISTRATION_ID.test(creds.registration_id))
+            return null;
+        if (hasPathEntry(credsPath))
+            return null;
+        fs.mkdirSync(path.dirname(credsPath), { recursive: true, mode: 0o700 });
+        const lines = [
+            '# Provian device credentials',
+            `PROVIAN_DEVICE_KEY=${creds.device_key}`,
+            `PROVIAN_DEVICE_SECRET=${creds.device_secret}`,
+            `PROVIAN_RELAY_URL=${DEFAULT_RELAY_URL}`,
+        ];
+        lines.push(`PROVIAN_DEVICE_ID=${creds.device_id}`);
+        if (creds.device_name)
+            lines.push(`PROVIAN_DEVICE_NAME=${JSON.stringify(creds.device_name)}`);
+        lines.push(`PROVIAN_DEVICE_REGISTRATION_ID=${creds.registration_id}`);
+        lines.push('PROVIAN_OWNER_TYPE=agent');
+        lines.push(`PROVIAN_AGENT_WALLET_ID=${creds.wallet_id}`);
+        const temporaryPath = `${credsPath}.${process.pid}.${(0, crypto_1.randomBytes)(8).toString('hex')}.tmp`;
+        try {
+            const fd = fs.openSync(temporaryPath, 'wx', 0o600);
+            try {
+                fs.writeFileSync(fd, `${lines.join('\n')}\n`, 'utf8');
+                fs.fsyncSync(fd);
+            }
+            finally {
+                fs.closeSync(fd);
+            }
+            fs.linkSync(temporaryPath, credsPath);
+            fsyncParentDirectory(credsPath);
+        }
+        finally {
+            try {
+                fs.unlinkSync(temporaryPath);
+            }
+            catch { /* linked */ }
+        }
+        const installed = loadBoundDeviceCredentialsFile(credsPath);
+        if (!installed
+            || installed.deviceKey !== creds.device_key
+            || installed.deviceSecret !== creds.device_secret
+            || installed.deviceId !== creds.device_id
+            || installed.walletId !== creds.wallet_id
+            || installed.registrationId !== creds.registration_id) {
+            throw new Error('Installed device credentials failed exact verification');
+        }
+        return credsPath;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=device-credentials.js.map

package/dist/device-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-credentials.js","sourceRoot":"","sources":["../src/device-credentials.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyIH,sFAgEC;AAGD,wEAqBC;AAKD,oFAQC;AAuCD,wEAkBC;AAGD,wDAkBC;AAOD,oEA4DC;AA7XD,uCAAyB;AACzB,2CAA6B;AAC7B,2BAA6B;AAC7B,mCAA6D;AAGhD,QAAA,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,IAAA,YAAO,GAAE,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AACpE,QAAA,oCAAoC,GAAG,IAAI,CAAC,IAAI,CAC3D,IAAA,YAAO,GAAE,EACT,UAAU,EACV,sCAAsC,CACvC,CAAC;AACF,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAmBnD,MAAM,YAAY,GAAG;IACnB,gBAAgB;IAChB,eAAe;IACf,YAAY;IACZ,eAAe;IACf,iBAAiB;IACjB,gBAAgB;CACR,CAAC;AACX,MAAM,UAAU,GAAG,oBAAoB,CAAC;AACxC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAC3C,MAAM,eAAe,GAAG,uCAAuC,CAAC;AAEhE,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,KAAa;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC;IAC5E,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;QAC7D,CAAC;QACD,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;eACb,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,MAAM,WAAW,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7D,IAAI,CAAC;QAAC,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAAC,CAAC;AAC3E,CAAC;AAED,SAAS,kBAAkB,CAAC,OAI3B;IACC,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QAChD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,wBAAwB,CAC/B,GAAW,EACX,mBAA4B;IAE5B,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QACzC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QAClG,MAAM,GAAG,KAAgC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;WAClC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC;WACtD,MAAM,CAAC,cAAc,KAAK,oCAAoC;WAC9D,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ;WACzC,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;WAC7C,CAAC,mBAAmB,KAAK,SAAS,IAAI,MAAM,CAAC,cAAc,KAAK,mBAAmB,CAAC;WACpF,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ;WAC1C,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;WAC7C,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;WACrC,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;WACnC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;WACxC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;WACzC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;WACxC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC;WAC3C,MAAM,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;IACJ,CAAC;IACD,OAAO,MAAuD,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAgB,qCAAqC,CACnD,OAAqE,EACrE,cAAsB,4CAAoC;IAE1D,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,wBAAwB,CACvC,eAAe,CAAC,WAAW,EAAE,iCAAiC,CAAC,EAC/D,aAAa,CACd,CAAC;QACF,OAAO;YACL,cAAc,EAAE,QAAQ,CAAC,eAAe;YACxC,SAAS,EAAE,QAAQ,CAAC,UAAU;YAC9B,YAAY,EAAE,QAAQ,CAAC,aAAa;SACrC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAuC;QAClD,cAAc,EAAE,oCAAoC;QACpD,cAAc,EAAE,aAAa;QAC7B,eAAe,EAAE,2BAA2B,IAAA,mBAAU,GAAE,EAAE;QAC1D,UAAU,EAAE,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACpD,aAAa,EAAE,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACvD,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE;KAC1B,CAAC;IACF,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,MAAM,aAAa,GAAG,GAAG,WAAW,IAAI,OAAO,CAAC,GAAG,IAAI,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAC5F,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACtE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QACD,0EAA0E;QAC1E,0EAA0E;QAC1E,IAAI,CAAC;YACH,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,MAAM,MAAM,GAAG,wBAAwB,CACrC,eAAe,CAAC,WAAW,EAAE,iCAAiC,CAAC,EAC/D,aAAa,CACd,CAAC;YACF,OAAO;gBACL,cAAc,EAAE,MAAM,CAAC,eAAe;gBACtC,SAAS,EAAE,MAAM,CAAC,UAAU;gBAC5B,YAAY,EAAE,MAAM,CAAC,aAAa;aACnC,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;QAC1E,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iCAAiC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,eAAe;QACvC,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,YAAY,EAAE,OAAO,CAAC,aAAa;KACpC,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,SAAgB,8BAA8B,CAC5C,cAAsB,EACtB,cAAsB,4CAAoC,EAC1D,YAAoB,yBAAiB;IAErC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC;QAAE,OAAO;IACvC,MAAM,MAAM,GAAG,wBAAwB,CACrC,eAAe,CAAC,WAAW,EAAE,iCAAiC,CAAC,CAChE,CAAC;IACF,IAAI,MAAM,CAAC,eAAe,KAAK,cAAc,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,SAAS,GAAG,8BAA8B,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,SAAS;WACT,SAAS,CAAC,cAAc,KAAK,MAAM,CAAC,eAAe;WACnD,SAAS,CAAC,SAAS,KAAK,MAAM,CAAC,UAAU;WACzC,SAAS,CAAC,YAAY,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC3B,oBAAoB,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC;AAED;;oEAEoE;AACpE,SAAgB,oCAAoC,CAClD,cAAsB,4CAAoC,EAC1D,YAAoB,yBAAiB;IAErC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC;QAAE,OAAO;IACvC,MAAM,SAAS,GAAG,8BAA8B,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,8BAA8B,CAAC,SAAS,CAAC,cAAc,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IACE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAClD,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACrF,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,0BAA0B,CAAC,SAAiB;IACnD,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,eAAe,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,8BAA8B,CAC5C,YAAoB,yBAAiB;IAErC,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM;WACN,MAAM,CAAC,kBAAkB,KAAK,OAAO;WACrC,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;WACjD,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC;WACvD,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;WAC1D,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,uBAAuB,IAAI,EAAE,CAAC;WACxE,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,8BAA8B,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,kBAAkB;QACpC,YAAY,EAAE,MAAM,CAAC,qBAAqB;QAC1C,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,QAAQ,EAAE,MAAM,CAAC,uBAAuB;QACxC,cAAc,EAAE,MAAM,CAAC,8BAA8B;KACtD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAgB,sBAAsB,CACpC,MAAyB,OAAO,CAAC,GAAG,EACpC,YAAoB,yBAAiB;IAErC,MAAM,MAAM,GAAG,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAG,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC;IACpD,IAAI,MAAM,IAAI,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;IAE/E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,kBAAkB,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,CAAC,kBAAkB,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,CAAC,qBAAqB,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAClF,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,4BAA4B,CAC1C,KAOC,EACD,YAAoB,yBAAiB;IAErC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;eACjC,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;eACxC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;eACnC,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;eAC3C,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;eACnC,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;eACnD,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;eACzC,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/D,IAAI,YAAY,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG;YACZ,8BAA8B;YAC9B,sBAAsB,KAAK,CAAC,UAAU,EAAE;YACxC,yBAAyB,KAAK,CAAC,aAAa,EAAE;YAC9C,qBAAqB,iBAAiB,EAAE;SACzC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACnD,IAAI,KAAK,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9F,KAAK,CAAC,IAAI,CAAC,kCAAkC,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QACtE,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,2BAA2B,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,IAAI,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACnD,IAAI,CAAC;gBACH,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACtD,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACnB,CAAC;oBAAS,CAAC;gBACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACnB,CAAC;YACD,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;YACtC,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,SAAS,GAAG,8BAA8B,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,SAAS;eACT,SAAS,CAAC,SAAS,KAAK,KAAK,CAAC,UAAU;eACxC,SAAS,CAAC,YAAY,KAAK,KAAK,CAAC,aAAa;eAC9C,SAAS,CAAC,QAAQ,KAAK,KAAK,CAAC,SAAS;eACtC,SAAS,CAAC,QAAQ,KAAK,KAAK,CAAC,SAAS;eACtC,SAAS,CAAC,cAAc,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/eip191.d.ts

@@ -0,0 +1,18 @@
+/**
+ * EIP-191 `personal_sign` for the LOCAL stdio server only.
+ *
+ * Byte-identical port of `provian-agent-sdk/src/link-signing.ts`
+ * (`signEip191Message`) over the same pinned @noble/curves 1.9.7 — the relay
+ * recovers the signer with `ethers.verifyMessage(message, signature)`.
+ *
+ * Deliberately OUTSIDE src/core/: the shared core (mirrored into the relay)
+ * must stay free of signing dependencies because the remote endpoint refuses
+ * private-key material by design. The stdio entrypoint injects this via
+ * ToolContext.signEip191.
+ */
+/**
+ * Produce a 0x-prefixed 65-byte hex EIP-191 (`personal_sign`) signature
+ * (r || s || v, v = 27/28) over an arbitrary UTF-8 message.
+ */
+export declare function signEip191Message(privateKeyHex: string, message: string): string;
+//# sourceMappingURL=eip191.d.ts.map

package/dist/eip191.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eip191.d.ts","sourceRoot":"","sources":["../src/eip191.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAaH;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAYhF"}

package/dist/eip191.js

@@ -0,0 +1,41 @@
+"use strict";
+/**
+ * EIP-191 `personal_sign` for the LOCAL stdio server only.
+ *
+ * Byte-identical port of `provian-agent-sdk/src/link-signing.ts`
+ * (`signEip191Message`) over the same pinned @noble/curves 1.9.7 — the relay
+ * recovers the signer with `ethers.verifyMessage(message, signature)`.
+ *
+ * Deliberately OUTSIDE src/core/: the shared core (mirrored into the relay)
+ * must stay free of signing dependencies because the remote endpoint refuses
+ * private-key material by design. The stdio entrypoint injects this via
+ * ToolContext.signEip191.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signEip191Message = signEip191Message;
+const secp256k1_1 = require("@noble/curves/secp256k1");
+const keccak256_1 = require("./core/keccak256");
+/** EIP-191 personal_sign digest (equivalent to ethers.hashMessage). */
+function eip191Digest(message) {
+    const bodyBytes = Buffer.from(message, 'utf-8');
+    const prefix = `\x19Ethereum Signed Message:\n${bodyBytes.length}`;
+    const prefixed = Buffer.concat([Buffer.from(prefix, 'utf-8'), bodyBytes]);
+    return (0, keccak256_1.keccak256)(prefixed);
+}
+/**
+ * Produce a 0x-prefixed 65-byte hex EIP-191 (`personal_sign`) signature
+ * (r || s || v, v = 27/28) over an arbitrary UTF-8 message.
+ */
+function signEip191Message(privateKeyHex, message) {
+    const cleanKey = privateKeyHex.startsWith('0x') ? privateKeyHex.slice(2) : privateKeyHex;
+    if (cleanKey.length !== 64) {
+        throw new Error('signEip191Message: privateKeyHex must be 32 bytes (64 hex chars)');
+    }
+    const digest = eip191Digest(message);
+    const sig = secp256k1_1.secp256k1.sign(digest, cleanKey);
+    const r = sig.r.toString(16).padStart(64, '0');
+    const s = sig.s.toString(16).padStart(64, '0');
+    const v = (27 + (sig.recovery ?? 0)).toString(16).padStart(2, '0');
+    return `0x${r}${s}${v}`;
+}
+//# sourceMappingURL=eip191.js.map

package/dist/eip191.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eip191.js","sourceRoot":"","sources":["../src/eip191.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAiBH,8CAYC;AA3BD,uDAAoD;AACpD,gDAA6C;AAE7C,uEAAuE;AACvE,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,iCAAiC,SAAS,CAAC,MAAM,EAAE,CAAC;IACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1E,OAAO,IAAA,qBAAS,EAAC,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,aAAqB,EAAE,OAAe;IACtE,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IACzF,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,qBAAS,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @provian/mcp - MCP server for the Provian trust layer.
+ *
+ * Two ways to connect, one tool set:
+ *   - Local stdio:  `npx @provian/mcp` (this package)
+ *   - Remote HTTP:  https://api.provian.ai/mcp (zero install — the relay
+ *     mounts the same shared tool core as a streamable-HTTP MCP endpoint)
+ *
+ * The shared core lives in src/core/ and is mirrored into the relay
+ * (provian-backend/src/mcp/core/) so both transports stay byte-identical.
+ */
+export { PROVIAN_TOOLS, PROVIAN_MCP_VERSION, PROVIAN_MCP_SERVER_NAME, callProvianTool, findTool } from './core/tools';
+export { buildProvianMcpServer } from './core/server';
+export type { ProvianToolDef, ToolContext, ToolAuth, DeviceAuth, PendingDeviceRegistration, ToolResult, } from './core/types';
+export { generateAgentKeyPair, signPoPChallenge, deriveAddressFromPrivateKey } from './core/crypto';
+export { loadOrCreatePendingAgentWalletRegistration, reloadPendingAgentWalletRegistration, completePendingAgentWalletRegistration, loadCompletedAgentWalletIdentity, } from './agent-wallet-registration';
+export { signEip191Message } from './eip191';
+export { resolveLocalAuth, persistAgentCredentials, AGENT_CREDS_PATH } from './credentials';
+export { clearPendingDeviceRegistration, loadOrCreatePendingDeviceRegistration, resolveLocalDeviceAuth, persistDeviceCredentialsFile, DEVICE_CREDS_PATH, MCP_PENDING_DEVICE_REGISTRATION_PATH, } from './device-credentials';
+export { startStdioServer, buildLocalContext } from './stdio';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,YAAY,EACV,cAAc,EACd,WAAW,EACX,QAAQ,EACR,UAAU,EACV,yBAAyB,EACzB,UAAU,GACX,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AACpG,OAAO,EACL,0CAA0C,EAC1C,oCAAoC,EACpC,sCAAsC,EACtC,gCAAgC,GACjC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC5F,OAAO,EACL,8BAA8B,EAC9B,qCAAqC,EACrC,sBAAsB,EACtB,4BAA4B,EAC5B,iBAAiB,EACjB,oCAAoC,GACrC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -0,0 +1,48 @@
+"use strict";
+/**
+ * @provian/mcp - MCP server for the Provian trust layer.
+ *
+ * Two ways to connect, one tool set:
+ *   - Local stdio:  `npx @provian/mcp` (this package)
+ *   - Remote HTTP:  https://api.provian.ai/mcp (zero install — the relay
+ *     mounts the same shared tool core as a streamable-HTTP MCP endpoint)
+ *
+ * The shared core lives in src/core/ and is mirrored into the relay
+ * (provian-backend/src/mcp/core/) so both transports stay byte-identical.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildLocalContext = exports.startStdioServer = exports.MCP_PENDING_DEVICE_REGISTRATION_PATH = exports.DEVICE_CREDS_PATH = exports.persistDeviceCredentialsFile = exports.resolveLocalDeviceAuth = exports.loadOrCreatePendingDeviceRegistration = exports.clearPendingDeviceRegistration = exports.AGENT_CREDS_PATH = exports.persistAgentCredentials = exports.resolveLocalAuth = exports.signEip191Message = exports.loadCompletedAgentWalletIdentity = exports.completePendingAgentWalletRegistration = exports.reloadPendingAgentWalletRegistration = exports.loadOrCreatePendingAgentWalletRegistration = exports.deriveAddressFromPrivateKey = exports.signPoPChallenge = exports.generateAgentKeyPair = exports.buildProvianMcpServer = exports.findTool = exports.callProvianTool = exports.PROVIAN_MCP_SERVER_NAME = exports.PROVIAN_MCP_VERSION = exports.PROVIAN_TOOLS = void 0;
+var tools_1 = require("./core/tools");
+Object.defineProperty(exports, "PROVIAN_TOOLS", { enumerable: true, get: function () { return tools_1.PROVIAN_TOOLS; } });
+Object.defineProperty(exports, "PROVIAN_MCP_VERSION", { enumerable: true, get: function () { return tools_1.PROVIAN_MCP_VERSION; } });
+Object.defineProperty(exports, "PROVIAN_MCP_SERVER_NAME", { enumerable: true, get: function () { return tools_1.PROVIAN_MCP_SERVER_NAME; } });
+Object.defineProperty(exports, "callProvianTool", { enumerable: true, get: function () { return tools_1.callProvianTool; } });
+Object.defineProperty(exports, "findTool", { enumerable: true, get: function () { return tools_1.findTool; } });
+var server_1 = require("./core/server");
+Object.defineProperty(exports, "buildProvianMcpServer", { enumerable: true, get: function () { return server_1.buildProvianMcpServer; } });
+var crypto_1 = require("./core/crypto");
+Object.defineProperty(exports, "generateAgentKeyPair", { enumerable: true, get: function () { return crypto_1.generateAgentKeyPair; } });
+Object.defineProperty(exports, "signPoPChallenge", { enumerable: true, get: function () { return crypto_1.signPoPChallenge; } });
+Object.defineProperty(exports, "deriveAddressFromPrivateKey", { enumerable: true, get: function () { return crypto_1.deriveAddressFromPrivateKey; } });
+var agent_wallet_registration_1 = require("./agent-wallet-registration");
+Object.defineProperty(exports, "loadOrCreatePendingAgentWalletRegistration", { enumerable: true, get: function () { return agent_wallet_registration_1.loadOrCreatePendingAgentWalletRegistration; } });
+Object.defineProperty(exports, "reloadPendingAgentWalletRegistration", { enumerable: true, get: function () { return agent_wallet_registration_1.reloadPendingAgentWalletRegistration; } });
+Object.defineProperty(exports, "completePendingAgentWalletRegistration", { enumerable: true, get: function () { return agent_wallet_registration_1.completePendingAgentWalletRegistration; } });
+Object.defineProperty(exports, "loadCompletedAgentWalletIdentity", { enumerable: true, get: function () { return agent_wallet_registration_1.loadCompletedAgentWalletIdentity; } });
+var eip191_1 = require("./eip191");
+Object.defineProperty(exports, "signEip191Message", { enumerable: true, get: function () { return eip191_1.signEip191Message; } });
+var credentials_1 = require("./credentials");
+Object.defineProperty(exports, "resolveLocalAuth", { enumerable: true, get: function () { return credentials_1.resolveLocalAuth; } });
+Object.defineProperty(exports, "persistAgentCredentials", { enumerable: true, get: function () { return credentials_1.persistAgentCredentials; } });
+Object.defineProperty(exports, "AGENT_CREDS_PATH", { enumerable: true, get: function () { return credentials_1.AGENT_CREDS_PATH; } });
+var device_credentials_1 = require("./device-credentials");
+Object.defineProperty(exports, "clearPendingDeviceRegistration", { enumerable: true, get: function () { return device_credentials_1.clearPendingDeviceRegistration; } });
+Object.defineProperty(exports, "loadOrCreatePendingDeviceRegistration", { enumerable: true, get: function () { return device_credentials_1.loadOrCreatePendingDeviceRegistration; } });
+Object.defineProperty(exports, "resolveLocalDeviceAuth", { enumerable: true, get: function () { return device_credentials_1.resolveLocalDeviceAuth; } });
+Object.defineProperty(exports, "persistDeviceCredentialsFile", { enumerable: true, get: function () { return device_credentials_1.persistDeviceCredentialsFile; } });
+Object.defineProperty(exports, "DEVICE_CREDS_PATH", { enumerable: true, get: function () { return device_credentials_1.DEVICE_CREDS_PATH; } });
+Object.defineProperty(exports, "MCP_PENDING_DEVICE_REGISTRATION_PATH", { enumerable: true, get: function () { return device_credentials_1.MCP_PENDING_DEVICE_REGISTRATION_PATH; } });
+var stdio_1 = require("./stdio");
+Object.defineProperty(exports, "startStdioServer", { enumerable: true, get: function () { return stdio_1.startStdioServer; } });
+Object.defineProperty(exports, "buildLocalContext", { enumerable: true, get: function () { return stdio_1.buildLocalContext; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAEH,sCAAsH;AAA7G,sGAAA,aAAa,OAAA;AAAE,4GAAA,mBAAmB,OAAA;AAAE,gHAAA,uBAAuB,OAAA;AAAE,wGAAA,eAAe,OAAA;AAAE,iGAAA,QAAQ,OAAA;AAC/F,wCAAsD;AAA7C,+GAAA,qBAAqB,OAAA;AAS9B,wCAAoG;AAA3F,8GAAA,oBAAoB,OAAA;AAAE,0GAAA,gBAAgB,OAAA;AAAE,qHAAA,2BAA2B,OAAA;AAC5E,yEAKqC;AAJnC,uJAAA,0CAA0C,OAAA;AAC1C,iJAAA,oCAAoC,OAAA;AACpC,mJAAA,sCAAsC,OAAA;AACtC,6IAAA,gCAAgC,OAAA;AAElC,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAC1B,6CAA4F;AAAnF,+GAAA,gBAAgB,OAAA;AAAE,sHAAA,uBAAuB,OAAA;AAAE,+GAAA,gBAAgB,OAAA;AACpE,2DAO8B;AAN5B,oIAAA,8BAA8B,OAAA;AAC9B,2IAAA,qCAAqC,OAAA;AACrC,4HAAA,sBAAsB,OAAA;AACtB,kIAAA,4BAA4B,OAAA;AAC5B,uHAAA,iBAAiB,OAAA;AACjB,0IAAA,oCAAoC,OAAA;AAEtC,iCAA8D;AAArD,yGAAA,gBAAgB,OAAA;AAAE,0GAAA,iBAAiB,OAAA"}