@provian/mcp 0.0.0-stage → 1.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (101) hide show
  1. package/CHANGELOG.md +15 -0
  2. package/LICENSE +21 -0
  3. package/README.md +266 -2
  4. package/bin/provian-mcp.mjs +18 -0
  5. package/dist/agent-wallet-registration.d.ts +34 -0
  6. package/dist/agent-wallet-registration.d.ts.map +1 -0
  7. package/dist/agent-wallet-registration.js +440 -0
  8. package/dist/agent-wallet-registration.js.map +1 -0
  9. package/dist/core/challenge.d.ts +187 -0
  10. package/dist/core/challenge.d.ts.map +1 -0
  11. package/dist/core/challenge.js +536 -0
  12. package/dist/core/challenge.js.map +1 -0
  13. package/dist/core/crypto.d.ts +44 -0
  14. package/dist/core/crypto.d.ts.map +1 -0
  15. package/dist/core/crypto.js +124 -0
  16. package/dist/core/crypto.js.map +1 -0
  17. package/dist/core/disclosure-request.d.ts +169 -0
  18. package/dist/core/disclosure-request.d.ts.map +1 -0
  19. package/dist/core/disclosure-request.js +400 -0
  20. package/dist/core/disclosure-request.js.map +1 -0
  21. package/dist/core/genesis-offer.d.ts +25 -0
  22. package/dist/core/genesis-offer.d.ts.map +1 -0
  23. package/dist/core/genesis-offer.js +34 -0
  24. package/dist/core/genesis-offer.js.map +1 -0
  25. package/dist/core/harness-tool-vocabulary.d.ts +55 -0
  26. package/dist/core/harness-tool-vocabulary.d.ts.map +1 -0
  27. package/dist/core/harness-tool-vocabulary.js +116 -0
  28. package/dist/core/harness-tool-vocabulary.js.map +1 -0
  29. package/dist/core/keccak256.d.ts +15 -0
  30. package/dist/core/keccak256.d.ts.map +1 -0
  31. package/dist/core/keccak256.js +111 -0
  32. package/dist/core/keccak256.js.map +1 -0
  33. package/dist/core/key-custody.d.ts +33 -0
  34. package/dist/core/key-custody.d.ts.map +1 -0
  35. package/dist/core/key-custody.js +59 -0
  36. package/dist/core/key-custody.js.map +1 -0
  37. package/dist/core/meter-hash.d.ts +2 -0
  38. package/dist/core/meter-hash.d.ts.map +1 -0
  39. package/dist/core/meter-hash.js +8 -0
  40. package/dist/core/meter-hash.js.map +1 -0
  41. package/dist/core/meter-wire.d.ts +193 -0
  42. package/dist/core/meter-wire.d.ts.map +1 -0
  43. package/dist/core/meter-wire.js +418 -0
  44. package/dist/core/meter-wire.js.map +1 -0
  45. package/dist/core/output-signature.d.ts +162 -0
  46. package/dist/core/output-signature.d.ts.map +1 -0
  47. package/dist/core/output-signature.js +367 -0
  48. package/dist/core/output-signature.js.map +1 -0
  49. package/dist/core/presentation.d.ts +141 -0
  50. package/dist/core/presentation.d.ts.map +1 -0
  51. package/dist/core/presentation.js +160 -0
  52. package/dist/core/presentation.js.map +1 -0
  53. package/dist/core/recovery-seal.d.ts +36 -0
  54. package/dist/core/recovery-seal.d.ts.map +1 -0
  55. package/dist/core/recovery-seal.js +122 -0
  56. package/dist/core/recovery-seal.js.map +1 -0
  57. package/dist/core/server.d.ts +38 -0
  58. package/dist/core/server.d.ts.map +1 -0
  59. package/dist/core/server.js +106 -0
  60. package/dist/core/server.js.map +1 -0
  61. package/dist/core/thread-reader.d.ts +8 -0
  62. package/dist/core/thread-reader.d.ts.map +1 -0
  63. package/dist/core/thread-reader.js +47 -0
  64. package/dist/core/thread-reader.js.map +1 -0
  65. package/dist/core/tool-set.d.ts +28 -0
  66. package/dist/core/tool-set.d.ts.map +1 -0
  67. package/dist/core/tool-set.js +71 -0
  68. package/dist/core/tool-set.js.map +1 -0
  69. package/dist/core/tools.d.ts +151 -0
  70. package/dist/core/tools.d.ts.map +1 -0
  71. package/dist/core/tools.js +3623 -0
  72. package/dist/core/tools.js.map +1 -0
  73. package/dist/core/types.d.ts +189 -0
  74. package/dist/core/types.d.ts.map +1 -0
  75. package/dist/core/types.js +17 -0
  76. package/dist/core/types.js.map +1 -0
  77. package/dist/credentials.d.ts +46 -0
  78. package/dist/credentials.d.ts.map +1 -0
  79. package/dist/credentials.js +213 -0
  80. package/dist/credentials.js.map +1 -0
  81. package/dist/device-credentials.d.ts +57 -0
  82. package/dist/device-credentials.d.ts.map +1 -0
  83. package/dist/device-credentials.js +403 -0
  84. package/dist/device-credentials.js.map +1 -0
  85. package/dist/eip191.d.ts +18 -0
  86. package/dist/eip191.d.ts.map +1 -0
  87. package/dist/eip191.js +41 -0
  88. package/dist/eip191.js.map +1 -0
  89. package/dist/index.d.ts +21 -0
  90. package/dist/index.d.ts.map +1 -0
  91. package/dist/index.js +48 -0
  92. package/dist/index.js.map +1 -0
  93. package/dist/runtime-env.d.ts +131 -0
  94. package/dist/runtime-env.d.ts.map +1 -0
  95. package/dist/runtime-env.js +328 -0
  96. package/dist/runtime-env.js.map +1 -0
  97. package/dist/stdio.d.ts +6 -0
  98. package/dist/stdio.d.ts.map +1 -0
  99. package/dist/stdio.js +136 -0
  100. package/dist/stdio.js.map +1 -0
  101. package/package.json +60 -4
@@ -0,0 +1,213 @@
1
+ "use strict";
2
+ /**
3
+ * Local credential resolution for the stdio MCP server.
4
+ *
5
+ * Precedence:
6
+ * 1. PROVIAN_API_KEY + PROVIAN_API_SECRET environment variables
7
+ * 2. ~/.provian/agent-credentials.json — the same hand-droppable file the
8
+ * SDK's register-device / invite-device scripts read
9
+ *
10
+ * The file loader mirrors the SDK's `agent-credentials-file.ts` exactly,
11
+ * including the security posture: on POSIX the file is REFUSED when more
12
+ * permissive than 0600 (it carries a long-lived agent secret; a wrong chmod
13
+ * fails loudly rather than treating the secret as world-readable). Do not
14
+ * weaken the 0600 check.
15
+ */
16
+ var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
17
+ if (k2 === undefined) k2 = k;
18
+ var desc = Object.getOwnPropertyDescriptor(m, k);
19
+ if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
20
+ desc = { enumerable: true, get: function() { return m[k]; } };
21
+ }
22
+ Object.defineProperty(o, k2, desc);
23
+ }) : (function(o, m, k, k2) {
24
+ if (k2 === undefined) k2 = k;
25
+ o[k2] = m[k];
26
+ }));
27
+ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
28
+ Object.defineProperty(o, "default", { enumerable: true, value: v });
29
+ }) : function(o, v) {
30
+ o["default"] = v;
31
+ });
32
+ var __importStar = (this && this.__importStar) || (function () {
33
+ var ownKeys = function(o) {
34
+ ownKeys = Object.getOwnPropertyNames || function (o) {
35
+ var ar = [];
36
+ for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
37
+ return ar;
38
+ };
39
+ return ownKeys(o);
40
+ };
41
+ return function (mod) {
42
+ if (mod && mod.__esModule) return mod;
43
+ var result = {};
44
+ if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
45
+ __setModuleDefault(result, mod);
46
+ return result;
47
+ };
48
+ })();
49
+ Object.defineProperty(exports, "__esModule", { value: true });
50
+ exports.AGENT_CREDS_PATH = void 0;
51
+ exports.loadAgentCredentialsFile = loadAgentCredentialsFile;
52
+ exports.loadBoundAgentCredentialsFile = loadBoundAgentCredentialsFile;
53
+ exports.resolveLocalAuth = resolveLocalAuth;
54
+ exports.persistAgentCredentials = persistAgentCredentials;
55
+ const fs = __importStar(require("fs"));
56
+ const path = __importStar(require("path"));
57
+ const os_1 = require("os");
58
+ const crypto_1 = require("crypto");
59
+ exports.AGENT_CREDS_PATH = path.join((0, os_1.homedir)(), '.provian', 'agent-credentials.json');
60
+ const API_KEY_PATTERN = /^pvn_live_[0-9a-f]{32}$/;
61
+ const API_SECRET_PATTERN = /^pvns_[0-9a-f]{64}$/;
62
+ const CURRENT_CREDENTIAL_KEYS = ['address', 'api_key', 'api_secret', 'wallet_id'];
63
+ function hasPathEntry(filePath) {
64
+ try {
65
+ fs.lstatSync(filePath);
66
+ return true;
67
+ }
68
+ catch (error) {
69
+ if (error.code === 'ENOENT')
70
+ return false;
71
+ return true;
72
+ }
73
+ }
74
+ function hasBoundWalletIdentity(value) {
75
+ return typeof value.wallet_id === 'string'
76
+ && /^wallet_aw_[A-Za-z0-9_-]+$/.test(value.wallet_id)
77
+ && typeof value.address === 'string'
78
+ && /^0x[0-9a-fA-F]{40}$/.test(value.address);
79
+ }
80
+ function isExactBoundCredentialsFile(value) {
81
+ if (!value || typeof value !== 'object' || Array.isArray(value))
82
+ return false;
83
+ const record = value;
84
+ const keys = Object.keys(record).sort();
85
+ if (keys.length !== CURRENT_CREDENTIAL_KEYS.length
86
+ || keys.some((key, index) => key !== CURRENT_CREDENTIAL_KEYS[index]))
87
+ return false;
88
+ return typeof record.api_key === 'string'
89
+ && API_KEY_PATTERN.test(record.api_key)
90
+ && typeof record.api_secret === 'string'
91
+ && API_SECRET_PATTERN.test(record.api_secret)
92
+ && hasBoundWalletIdentity(record);
93
+ }
94
+ /**
95
+ * Load + validate ~/.provian/agent-credentials.json. Returns null when the
96
+ * file is missing, too permissive (POSIX), unparseable, or malformed.
97
+ */
98
+ function loadAgentCredentialsFile(credsPath = exports.AGENT_CREDS_PATH) {
99
+ const noFollow = (0, os_1.platform)() === 'win32' ? 0 : fs.constants.O_NOFOLLOW;
100
+ let fd;
101
+ try {
102
+ fd = fs.openSync(credsPath, fs.constants.O_RDONLY | noFollow);
103
+ }
104
+ catch {
105
+ return null;
106
+ }
107
+ try {
108
+ const stat = fs.fstatSync(fd);
109
+ const mode = stat.mode & 0o777;
110
+ if (!stat.isFile() || ((0, os_1.platform)() !== 'win32' && (mode & 0o077) !== 0)) {
111
+ console.error(`provian-mcp: ${credsPath} must be a private 0600 regular file; refusing to read.`);
112
+ return null;
113
+ }
114
+ const raw = fs.readFileSync(fd, 'utf-8');
115
+ const parsed = JSON.parse(raw);
116
+ if (!parsed.api_key || !parsed.api_secret)
117
+ return null;
118
+ if (!parsed.api_key.startsWith('pvn_live_'))
119
+ return null;
120
+ if (!parsed.api_secret.startsWith('pvns_'))
121
+ return null;
122
+ return parsed;
123
+ }
124
+ catch {
125
+ return null;
126
+ }
127
+ finally {
128
+ fs.closeSync(fd);
129
+ }
130
+ }
131
+ /** Load only the exact current wallet-bound shape. Legacy API-only files may
132
+ * authenticate existing calls but cannot prove completed-wallet recovery. */
133
+ function loadBoundAgentCredentialsFile(credsPath = exports.AGENT_CREDS_PATH) {
134
+ const credentials = loadAgentCredentialsFile(credsPath);
135
+ return isExactBoundCredentialsFile(credentials) ? credentials : null;
136
+ }
137
+ /** Resolve credentials: env first, then the credentials file. */
138
+ function resolveLocalAuth(env = process.env, credsPath = exports.AGENT_CREDS_PATH) {
139
+ const envKey = env.PROVIAN_API_KEY?.trim();
140
+ const envSecret = env.PROVIAN_API_SECRET?.trim();
141
+ if (envKey && envSecret) {
142
+ return { apiKey: envKey, apiSecret: envSecret };
143
+ }
144
+ const file = loadAgentCredentialsFile(credsPath);
145
+ if (file?.api_key && file.api_secret) {
146
+ return { apiKey: file.api_key, apiSecret: file.api_secret };
147
+ }
148
+ return null;
149
+ }
150
+ /**
151
+ * Persist freshly minted credentials to ~/.provian/agent-credentials.json
152
+ * (0600, directory 0700) so subsequent authenticated tool calls work.
153
+ * Replaces only credentials for the same wallet so a response-loss recovery
154
+ * can durably install the newly rotated pair. A different wallet fails closed.
155
+ */
156
+ function persistAgentCredentials(creds, credsPath = exports.AGENT_CREDS_PATH) {
157
+ try {
158
+ if (!isExactBoundCredentialsFile(creds))
159
+ return null;
160
+ const existing = loadAgentCredentialsFile(credsPath);
161
+ if (hasPathEntry(credsPath) && !existing)
162
+ return null;
163
+ if (existing && !isExactBoundCredentialsFile(existing))
164
+ return null;
165
+ if (existing && (existing.wallet_id !== creds.wallet_id
166
+ || existing.address.toLowerCase() !== creds.address.toLowerCase()))
167
+ return null;
168
+ fs.mkdirSync(path.dirname(credsPath), { recursive: true, mode: 0o700 });
169
+ const temp = `${credsPath}.${process.pid}.${(0, crypto_1.randomBytes)(8).toString('hex')}.tmp`;
170
+ const fd = fs.openSync(temp, 'wx', 0o600);
171
+ try {
172
+ fs.writeFileSync(fd, `${JSON.stringify(creds, null, 2)}\n`, 'utf8');
173
+ fs.fsyncSync(fd);
174
+ }
175
+ finally {
176
+ fs.closeSync(fd);
177
+ }
178
+ try {
179
+ fs.renameSync(temp, credsPath);
180
+ fs.chmodSync(credsPath, 0o600);
181
+ const installedFd = fs.openSync(credsPath, 'r');
182
+ try {
183
+ const installed = fs.fstatSync(installedFd);
184
+ if (!installed.isFile()
185
+ || ((0, os_1.platform)() !== 'win32' && (installed.mode & 0o777) !== 0o600)) {
186
+ throw new Error('installed credentials are not a 0600 regular file');
187
+ }
188
+ fs.fsyncSync(installedFd);
189
+ }
190
+ finally {
191
+ fs.closeSync(installedFd);
192
+ }
193
+ const directoryFd = fs.openSync(path.dirname(credsPath), 'r');
194
+ try {
195
+ fs.fsyncSync(directoryFd);
196
+ }
197
+ finally {
198
+ fs.closeSync(directoryFd);
199
+ }
200
+ }
201
+ finally {
202
+ try {
203
+ fs.unlinkSync(temp);
204
+ }
205
+ catch { /* renamed */ }
206
+ }
207
+ return credsPath;
208
+ }
209
+ catch {
210
+ return null;
211
+ }
212
+ }
213
+ //# sourceMappingURL=credentials.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DH,4DA0BC;AAID,sEAKC;AAGD,4CAcC;AAQD,0DAyCC;AA9JD,uCAAyB;AACzB,2CAA6B;AAC7B,2BAAqD;AACrD,mCAAqC;AAGxB,QAAA,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,IAAA,YAAO,GAAE,EAAE,UAAU,EAAE,wBAAwB,CAAC,CAAC;AAS3F,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAClD,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AACjD,MAAM,uBAAuB,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAE3F,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAA2B;IAE3B,OAAO,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;WACrC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;WAClD,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;WACjC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,2BAA2B,CAClC,KAAc;IAEd,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,IAAI,CAAC,MAAM,KAAK,uBAAuB,CAAC,MAAM;WAC7C,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,OAAO,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;WACpC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;WACpC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;WACrC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;WAC1C,sBAAsB,CAAC,MAA8B,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,SAAgB,wBAAwB,CAAC,YAAoB,wBAAgB;IAC3E,MAAM,QAAQ,GAAG,IAAA,aAAU,GAAE,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC;IACxE,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAA,aAAU,GAAE,KAAK,OAAO,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACzE,OAAO,CAAC,KAAK,CAAC,gBAAgB,SAAS,yDAAyD,CAAC,CAAC;YAClG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED;6EAC6E;AAC7E,SAAgB,6BAA6B,CAC3C,YAAoB,wBAAgB;IAEpC,MAAM,WAAW,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO,2BAA2B,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED,iEAAiE;AACjE,SAAgB,gBAAgB,CAC9B,MAAyB,OAAO,CAAC,GAAG,EACpC,YAAoB,wBAAgB;IAEpC,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC;IACD,MAAM,IAAI,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACrC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB,CACrC,KAAkF,EAClF,YAAoB,wBAAgB;IAEpC,IAAI,CAAC;QACH,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,QAAQ,IAAI,CAAC,2BAA2B,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACpE,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;eAClD,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAClF,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,IAAI,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QACjF,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACpE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC/B,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC/B,MAAM,WAAW,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;gBAC5C,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE;uBAClB,CAAC,IAAA,aAAU,GAAE,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;oBACtE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBACvE,CAAC;gBACD,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAC5B,CAAC;oBAAS,CAAC;gBAAC,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAAC,CAAC;YACxC,MAAM,WAAW,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;YAC9D,IAAI,CAAC;gBAAC,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAAC,CAAC;oBAAS,CAAC;gBAAC,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAAC,CAAC;QAC3E,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
@@ -0,0 +1,57 @@
1
+ /**
2
+ * Device-credential resolution for the stdio MCP server.
3
+ *
4
+ * Reads/writes ~/.provian/credentials — the SDK's env-format device file
5
+ * (KEY=VALUE lines, 0600) — so the MCP server, the CLI, and the observer all
6
+ * share ONE registered device per machine instead of minting one each.
7
+ *
8
+ * Safety rule: file credentials are reused only when PROVIAN_OWNER_TYPE=agent.
9
+ * A human-owned device file (from `register-device` without --agent) is left
10
+ * alone — submitting agent PEs through a human device would silently attribute
11
+ * them to the human's wallet. Env vars (PROVIAN_DEVICE_KEY/SECRET) are treated
12
+ * as explicit operator intent and used as-is.
13
+ */
14
+ import type { DeviceAuth, PendingDeviceRegistration } from './core/types';
15
+ export declare const DEVICE_CREDS_PATH: string;
16
+ export declare const MCP_PENDING_DEVICE_REGISTRATION_PATH: string;
17
+ interface BoundDeviceCredentialsFile {
18
+ deviceKey: string;
19
+ deviceSecret: string;
20
+ deviceId: string;
21
+ walletId: string;
22
+ registrationId: string;
23
+ }
24
+ /**
25
+ * Persist a stable pending registration before the caller is allowed to send
26
+ * the first network request. Atomic rename means a crash yields either no
27
+ * request identity (and therefore no request) or the complete reusable one.
28
+ */
29
+ export declare function loadOrCreatePendingDeviceRegistration(context: {
30
+ owner_key: string;
31
+ device_name: string;
32
+ platform: string;
33
+ }, pendingPath?: string): PendingDeviceRegistration;
34
+ /** Delete only the exact pending identity that just became durable. */
35
+ export declare function clearPendingDeviceRegistration(registrationId: string, pendingPath?: string, credsPath?: string): void;
36
+ /** Finish the legal crash state where bound credentials crossed their fsync
37
+ * barrier but pending deletion did not. A legacy/unbound device file is left
38
+ * untouched because it cannot authenticate the pending identity. */
39
+ export declare function reconcileInstalledDeviceRegistration(pendingPath?: string, credsPath?: string): void;
40
+ export declare function loadBoundDeviceCredentialsFile(credsPath?: string): BoundDeviceCredentialsFile | null;
41
+ /** Resolve device credentials: env first, then an agent-owned device file. */
42
+ export declare function resolveLocalDeviceAuth(env?: NodeJS.ProcessEnv, credsPath?: string): DeviceAuth | null;
43
+ /**
44
+ * Persist device credentials in the SDK's exact file format. Never overwrites
45
+ * an existing file (an already-registered device identity wins). Returns the
46
+ * path written, or null when skipped/failed.
47
+ */
48
+ export declare function persistDeviceCredentialsFile(creds: {
49
+ device_key: string;
50
+ device_secret: string;
51
+ device_id?: string;
52
+ device_name?: string;
53
+ wallet_id?: string;
54
+ registration_id?: string;
55
+ }, credsPath?: string): string | null;
56
+ export {};
57
+ //# sourceMappingURL=device-credentials.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"device-credentials.d.ts","sourceRoot":"","sources":["../src/device-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,UAAU,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAE1E,eAAO,MAAM,iBAAiB,QAAkD,CAAC;AACjF,eAAO,MAAM,oCAAoC,QAIhD,CAAC;AAYF,UAAU,0BAA0B;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;CACxB;AAqGD;;;;GAIG;AACH,wBAAgB,qCAAqC,CACnD,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EACrE,WAAW,GAAE,MAA6C,GACzD,yBAAyB,CA6D3B;AAED,uEAAuE;AACvE,wBAAgB,8BAA8B,CAC5C,cAAc,EAAE,MAAM,EACtB,WAAW,GAAE,MAA6C,EAC1D,SAAS,GAAE,MAA0B,GACpC,IAAI,CAiBN;AAED;;oEAEoE;AACpE,wBAAgB,oCAAoC,CAClD,WAAW,GAAE,MAA6C,EAC1D,SAAS,GAAE,MAA0B,GACpC,IAAI,CAKN;AAuCD,wBAAgB,8BAA8B,CAC5C,SAAS,GAAE,MAA0B,GACpC,0BAA0B,GAAG,IAAI,CAgBnC;AAED,8EAA8E;AAC9E,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,SAAS,GAAE,MAA0B,GACpC,UAAU,GAAG,IAAI,CAenB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,EACD,SAAS,GAAE,MAA0B,GACpC,MAAM,GAAG,IAAI,CAkDf"}