@provian/mcp 0.0.0-stage → 1.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +15 -0
- package/LICENSE +21 -0
- package/README.md +266 -2
- package/bin/provian-mcp.mjs +18 -0
- package/dist/agent-wallet-registration.d.ts +34 -0
- package/dist/agent-wallet-registration.d.ts.map +1 -0
- package/dist/agent-wallet-registration.js +440 -0
- package/dist/agent-wallet-registration.js.map +1 -0
- package/dist/core/challenge.d.ts +187 -0
- package/dist/core/challenge.d.ts.map +1 -0
- package/dist/core/challenge.js +536 -0
- package/dist/core/challenge.js.map +1 -0
- package/dist/core/crypto.d.ts +44 -0
- package/dist/core/crypto.d.ts.map +1 -0
- package/dist/core/crypto.js +124 -0
- package/dist/core/crypto.js.map +1 -0
- package/dist/core/disclosure-request.d.ts +169 -0
- package/dist/core/disclosure-request.d.ts.map +1 -0
- package/dist/core/disclosure-request.js +400 -0
- package/dist/core/disclosure-request.js.map +1 -0
- package/dist/core/genesis-offer.d.ts +25 -0
- package/dist/core/genesis-offer.d.ts.map +1 -0
- package/dist/core/genesis-offer.js +34 -0
- package/dist/core/genesis-offer.js.map +1 -0
- package/dist/core/harness-tool-vocabulary.d.ts +55 -0
- package/dist/core/harness-tool-vocabulary.d.ts.map +1 -0
- package/dist/core/harness-tool-vocabulary.js +116 -0
- package/dist/core/harness-tool-vocabulary.js.map +1 -0
- package/dist/core/keccak256.d.ts +15 -0
- package/dist/core/keccak256.d.ts.map +1 -0
- package/dist/core/keccak256.js +111 -0
- package/dist/core/keccak256.js.map +1 -0
- package/dist/core/key-custody.d.ts +33 -0
- package/dist/core/key-custody.d.ts.map +1 -0
- package/dist/core/key-custody.js +59 -0
- package/dist/core/key-custody.js.map +1 -0
- package/dist/core/meter-hash.d.ts +2 -0
- package/dist/core/meter-hash.d.ts.map +1 -0
- package/dist/core/meter-hash.js +8 -0
- package/dist/core/meter-hash.js.map +1 -0
- package/dist/core/meter-wire.d.ts +193 -0
- package/dist/core/meter-wire.d.ts.map +1 -0
- package/dist/core/meter-wire.js +418 -0
- package/dist/core/meter-wire.js.map +1 -0
- package/dist/core/output-signature.d.ts +162 -0
- package/dist/core/output-signature.d.ts.map +1 -0
- package/dist/core/output-signature.js +367 -0
- package/dist/core/output-signature.js.map +1 -0
- package/dist/core/presentation.d.ts +141 -0
- package/dist/core/presentation.d.ts.map +1 -0
- package/dist/core/presentation.js +160 -0
- package/dist/core/presentation.js.map +1 -0
- package/dist/core/recovery-seal.d.ts +36 -0
- package/dist/core/recovery-seal.d.ts.map +1 -0
- package/dist/core/recovery-seal.js +122 -0
- package/dist/core/recovery-seal.js.map +1 -0
- package/dist/core/server.d.ts +38 -0
- package/dist/core/server.d.ts.map +1 -0
- package/dist/core/server.js +106 -0
- package/dist/core/server.js.map +1 -0
- package/dist/core/thread-reader.d.ts +8 -0
- package/dist/core/thread-reader.d.ts.map +1 -0
- package/dist/core/thread-reader.js +47 -0
- package/dist/core/thread-reader.js.map +1 -0
- package/dist/core/tool-set.d.ts +28 -0
- package/dist/core/tool-set.d.ts.map +1 -0
- package/dist/core/tool-set.js +71 -0
- package/dist/core/tool-set.js.map +1 -0
- package/dist/core/tools.d.ts +151 -0
- package/dist/core/tools.d.ts.map +1 -0
- package/dist/core/tools.js +3623 -0
- package/dist/core/tools.js.map +1 -0
- package/dist/core/types.d.ts +189 -0
- package/dist/core/types.d.ts.map +1 -0
- package/dist/core/types.js +17 -0
- package/dist/core/types.js.map +1 -0
- package/dist/credentials.d.ts +46 -0
- package/dist/credentials.d.ts.map +1 -0
- package/dist/credentials.js +213 -0
- package/dist/credentials.js.map +1 -0
- package/dist/device-credentials.d.ts +57 -0
- package/dist/device-credentials.d.ts.map +1 -0
- package/dist/device-credentials.js +403 -0
- package/dist/device-credentials.js.map +1 -0
- package/dist/eip191.d.ts +18 -0
- package/dist/eip191.d.ts.map +1 -0
- package/dist/eip191.js +41 -0
- package/dist/eip191.js.map +1 -0
- package/dist/index.d.ts +21 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +48 -0
- package/dist/index.js.map +1 -0
- package/dist/runtime-env.d.ts +131 -0
- package/dist/runtime-env.d.ts.map +1 -0
- package/dist/runtime-env.js +328 -0
- package/dist/runtime-env.js.map +1 -0
- package/dist/stdio.d.ts +6 -0
- package/dist/stdio.d.ts.map +1 -0
- package/dist/stdio.js +136 -0
- package/dist/stdio.js.map +1 -0
- package/package.json +60 -4
|
@@ -0,0 +1,213 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
/**
|
|
3
|
+
* Local credential resolution for the stdio MCP server.
|
|
4
|
+
*
|
|
5
|
+
* Precedence:
|
|
6
|
+
* 1. PROVIAN_API_KEY + PROVIAN_API_SECRET environment variables
|
|
7
|
+
* 2. ~/.provian/agent-credentials.json — the same hand-droppable file the
|
|
8
|
+
* SDK's register-device / invite-device scripts read
|
|
9
|
+
*
|
|
10
|
+
* The file loader mirrors the SDK's `agent-credentials-file.ts` exactly,
|
|
11
|
+
* including the security posture: on POSIX the file is REFUSED when more
|
|
12
|
+
* permissive than 0600 (it carries a long-lived agent secret; a wrong chmod
|
|
13
|
+
* fails loudly rather than treating the secret as world-readable). Do not
|
|
14
|
+
* weaken the 0600 check.
|
|
15
|
+
*/
|
|
16
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
17
|
+
if (k2 === undefined) k2 = k;
|
|
18
|
+
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
19
|
+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
20
|
+
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
21
|
+
}
|
|
22
|
+
Object.defineProperty(o, k2, desc);
|
|
23
|
+
}) : (function(o, m, k, k2) {
|
|
24
|
+
if (k2 === undefined) k2 = k;
|
|
25
|
+
o[k2] = m[k];
|
|
26
|
+
}));
|
|
27
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
28
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
29
|
+
}) : function(o, v) {
|
|
30
|
+
o["default"] = v;
|
|
31
|
+
});
|
|
32
|
+
var __importStar = (this && this.__importStar) || (function () {
|
|
33
|
+
var ownKeys = function(o) {
|
|
34
|
+
ownKeys = Object.getOwnPropertyNames || function (o) {
|
|
35
|
+
var ar = [];
|
|
36
|
+
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
|
|
37
|
+
return ar;
|
|
38
|
+
};
|
|
39
|
+
return ownKeys(o);
|
|
40
|
+
};
|
|
41
|
+
return function (mod) {
|
|
42
|
+
if (mod && mod.__esModule) return mod;
|
|
43
|
+
var result = {};
|
|
44
|
+
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
|
45
|
+
__setModuleDefault(result, mod);
|
|
46
|
+
return result;
|
|
47
|
+
};
|
|
48
|
+
})();
|
|
49
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
50
|
+
exports.AGENT_CREDS_PATH = void 0;
|
|
51
|
+
exports.loadAgentCredentialsFile = loadAgentCredentialsFile;
|
|
52
|
+
exports.loadBoundAgentCredentialsFile = loadBoundAgentCredentialsFile;
|
|
53
|
+
exports.resolveLocalAuth = resolveLocalAuth;
|
|
54
|
+
exports.persistAgentCredentials = persistAgentCredentials;
|
|
55
|
+
const fs = __importStar(require("fs"));
|
|
56
|
+
const path = __importStar(require("path"));
|
|
57
|
+
const os_1 = require("os");
|
|
58
|
+
const crypto_1 = require("crypto");
|
|
59
|
+
exports.AGENT_CREDS_PATH = path.join((0, os_1.homedir)(), '.provian', 'agent-credentials.json');
|
|
60
|
+
const API_KEY_PATTERN = /^pvn_live_[0-9a-f]{32}$/;
|
|
61
|
+
const API_SECRET_PATTERN = /^pvns_[0-9a-f]{64}$/;
|
|
62
|
+
const CURRENT_CREDENTIAL_KEYS = ['address', 'api_key', 'api_secret', 'wallet_id'];
|
|
63
|
+
function hasPathEntry(filePath) {
|
|
64
|
+
try {
|
|
65
|
+
fs.lstatSync(filePath);
|
|
66
|
+
return true;
|
|
67
|
+
}
|
|
68
|
+
catch (error) {
|
|
69
|
+
if (error.code === 'ENOENT')
|
|
70
|
+
return false;
|
|
71
|
+
return true;
|
|
72
|
+
}
|
|
73
|
+
}
|
|
74
|
+
function hasBoundWalletIdentity(value) {
|
|
75
|
+
return typeof value.wallet_id === 'string'
|
|
76
|
+
&& /^wallet_aw_[A-Za-z0-9_-]+$/.test(value.wallet_id)
|
|
77
|
+
&& typeof value.address === 'string'
|
|
78
|
+
&& /^0x[0-9a-fA-F]{40}$/.test(value.address);
|
|
79
|
+
}
|
|
80
|
+
function isExactBoundCredentialsFile(value) {
|
|
81
|
+
if (!value || typeof value !== 'object' || Array.isArray(value))
|
|
82
|
+
return false;
|
|
83
|
+
const record = value;
|
|
84
|
+
const keys = Object.keys(record).sort();
|
|
85
|
+
if (keys.length !== CURRENT_CREDENTIAL_KEYS.length
|
|
86
|
+
|| keys.some((key, index) => key !== CURRENT_CREDENTIAL_KEYS[index]))
|
|
87
|
+
return false;
|
|
88
|
+
return typeof record.api_key === 'string'
|
|
89
|
+
&& API_KEY_PATTERN.test(record.api_key)
|
|
90
|
+
&& typeof record.api_secret === 'string'
|
|
91
|
+
&& API_SECRET_PATTERN.test(record.api_secret)
|
|
92
|
+
&& hasBoundWalletIdentity(record);
|
|
93
|
+
}
|
|
94
|
+
/**
|
|
95
|
+
* Load + validate ~/.provian/agent-credentials.json. Returns null when the
|
|
96
|
+
* file is missing, too permissive (POSIX), unparseable, or malformed.
|
|
97
|
+
*/
|
|
98
|
+
function loadAgentCredentialsFile(credsPath = exports.AGENT_CREDS_PATH) {
|
|
99
|
+
const noFollow = (0, os_1.platform)() === 'win32' ? 0 : fs.constants.O_NOFOLLOW;
|
|
100
|
+
let fd;
|
|
101
|
+
try {
|
|
102
|
+
fd = fs.openSync(credsPath, fs.constants.O_RDONLY | noFollow);
|
|
103
|
+
}
|
|
104
|
+
catch {
|
|
105
|
+
return null;
|
|
106
|
+
}
|
|
107
|
+
try {
|
|
108
|
+
const stat = fs.fstatSync(fd);
|
|
109
|
+
const mode = stat.mode & 0o777;
|
|
110
|
+
if (!stat.isFile() || ((0, os_1.platform)() !== 'win32' && (mode & 0o077) !== 0)) {
|
|
111
|
+
console.error(`provian-mcp: ${credsPath} must be a private 0600 regular file; refusing to read.`);
|
|
112
|
+
return null;
|
|
113
|
+
}
|
|
114
|
+
const raw = fs.readFileSync(fd, 'utf-8');
|
|
115
|
+
const parsed = JSON.parse(raw);
|
|
116
|
+
if (!parsed.api_key || !parsed.api_secret)
|
|
117
|
+
return null;
|
|
118
|
+
if (!parsed.api_key.startsWith('pvn_live_'))
|
|
119
|
+
return null;
|
|
120
|
+
if (!parsed.api_secret.startsWith('pvns_'))
|
|
121
|
+
return null;
|
|
122
|
+
return parsed;
|
|
123
|
+
}
|
|
124
|
+
catch {
|
|
125
|
+
return null;
|
|
126
|
+
}
|
|
127
|
+
finally {
|
|
128
|
+
fs.closeSync(fd);
|
|
129
|
+
}
|
|
130
|
+
}
|
|
131
|
+
/** Load only the exact current wallet-bound shape. Legacy API-only files may
|
|
132
|
+
* authenticate existing calls but cannot prove completed-wallet recovery. */
|
|
133
|
+
function loadBoundAgentCredentialsFile(credsPath = exports.AGENT_CREDS_PATH) {
|
|
134
|
+
const credentials = loadAgentCredentialsFile(credsPath);
|
|
135
|
+
return isExactBoundCredentialsFile(credentials) ? credentials : null;
|
|
136
|
+
}
|
|
137
|
+
/** Resolve credentials: env first, then the credentials file. */
|
|
138
|
+
function resolveLocalAuth(env = process.env, credsPath = exports.AGENT_CREDS_PATH) {
|
|
139
|
+
const envKey = env.PROVIAN_API_KEY?.trim();
|
|
140
|
+
const envSecret = env.PROVIAN_API_SECRET?.trim();
|
|
141
|
+
if (envKey && envSecret) {
|
|
142
|
+
return { apiKey: envKey, apiSecret: envSecret };
|
|
143
|
+
}
|
|
144
|
+
const file = loadAgentCredentialsFile(credsPath);
|
|
145
|
+
if (file?.api_key && file.api_secret) {
|
|
146
|
+
return { apiKey: file.api_key, apiSecret: file.api_secret };
|
|
147
|
+
}
|
|
148
|
+
return null;
|
|
149
|
+
}
|
|
150
|
+
/**
|
|
151
|
+
* Persist freshly minted credentials to ~/.provian/agent-credentials.json
|
|
152
|
+
* (0600, directory 0700) so subsequent authenticated tool calls work.
|
|
153
|
+
* Replaces only credentials for the same wallet so a response-loss recovery
|
|
154
|
+
* can durably install the newly rotated pair. A different wallet fails closed.
|
|
155
|
+
*/
|
|
156
|
+
function persistAgentCredentials(creds, credsPath = exports.AGENT_CREDS_PATH) {
|
|
157
|
+
try {
|
|
158
|
+
if (!isExactBoundCredentialsFile(creds))
|
|
159
|
+
return null;
|
|
160
|
+
const existing = loadAgentCredentialsFile(credsPath);
|
|
161
|
+
if (hasPathEntry(credsPath) && !existing)
|
|
162
|
+
return null;
|
|
163
|
+
if (existing && !isExactBoundCredentialsFile(existing))
|
|
164
|
+
return null;
|
|
165
|
+
if (existing && (existing.wallet_id !== creds.wallet_id
|
|
166
|
+
|| existing.address.toLowerCase() !== creds.address.toLowerCase()))
|
|
167
|
+
return null;
|
|
168
|
+
fs.mkdirSync(path.dirname(credsPath), { recursive: true, mode: 0o700 });
|
|
169
|
+
const temp = `${credsPath}.${process.pid}.${(0, crypto_1.randomBytes)(8).toString('hex')}.tmp`;
|
|
170
|
+
const fd = fs.openSync(temp, 'wx', 0o600);
|
|
171
|
+
try {
|
|
172
|
+
fs.writeFileSync(fd, `${JSON.stringify(creds, null, 2)}\n`, 'utf8');
|
|
173
|
+
fs.fsyncSync(fd);
|
|
174
|
+
}
|
|
175
|
+
finally {
|
|
176
|
+
fs.closeSync(fd);
|
|
177
|
+
}
|
|
178
|
+
try {
|
|
179
|
+
fs.renameSync(temp, credsPath);
|
|
180
|
+
fs.chmodSync(credsPath, 0o600);
|
|
181
|
+
const installedFd = fs.openSync(credsPath, 'r');
|
|
182
|
+
try {
|
|
183
|
+
const installed = fs.fstatSync(installedFd);
|
|
184
|
+
if (!installed.isFile()
|
|
185
|
+
|| ((0, os_1.platform)() !== 'win32' && (installed.mode & 0o777) !== 0o600)) {
|
|
186
|
+
throw new Error('installed credentials are not a 0600 regular file');
|
|
187
|
+
}
|
|
188
|
+
fs.fsyncSync(installedFd);
|
|
189
|
+
}
|
|
190
|
+
finally {
|
|
191
|
+
fs.closeSync(installedFd);
|
|
192
|
+
}
|
|
193
|
+
const directoryFd = fs.openSync(path.dirname(credsPath), 'r');
|
|
194
|
+
try {
|
|
195
|
+
fs.fsyncSync(directoryFd);
|
|
196
|
+
}
|
|
197
|
+
finally {
|
|
198
|
+
fs.closeSync(directoryFd);
|
|
199
|
+
}
|
|
200
|
+
}
|
|
201
|
+
finally {
|
|
202
|
+
try {
|
|
203
|
+
fs.unlinkSync(temp);
|
|
204
|
+
}
|
|
205
|
+
catch { /* renamed */ }
|
|
206
|
+
}
|
|
207
|
+
return credsPath;
|
|
208
|
+
}
|
|
209
|
+
catch {
|
|
210
|
+
return null;
|
|
211
|
+
}
|
|
212
|
+
}
|
|
213
|
+
//# sourceMappingURL=credentials.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DH,4DA0BC;AAID,sEAKC;AAGD,4CAcC;AAQD,0DAyCC;AA9JD,uCAAyB;AACzB,2CAA6B;AAC7B,2BAAqD;AACrD,mCAAqC;AAGxB,QAAA,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,IAAA,YAAO,GAAE,EAAE,UAAU,EAAE,wBAAwB,CAAC,CAAC;AAS3F,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAClD,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AACjD,MAAM,uBAAuB,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAE3F,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAA2B;IAE3B,OAAO,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;WACrC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;WAClD,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;WACjC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,2BAA2B,CAClC,KAAc;IAEd,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,IAAI,CAAC,MAAM,KAAK,uBAAuB,CAAC,MAAM;WAC7C,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,OAAO,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;WACpC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;WACpC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;WACrC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;WAC1C,sBAAsB,CAAC,MAA8B,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,SAAgB,wBAAwB,CAAC,YAAoB,wBAAgB;IAC3E,MAAM,QAAQ,GAAG,IAAA,aAAU,GAAE,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC;IACxE,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAA,aAAU,GAAE,KAAK,OAAO,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACzE,OAAO,CAAC,KAAK,CAAC,gBAAgB,SAAS,yDAAyD,CAAC,CAAC;YAClG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED;6EAC6E;AAC7E,SAAgB,6BAA6B,CAC3C,YAAoB,wBAAgB;IAEpC,MAAM,WAAW,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO,2BAA2B,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED,iEAAiE;AACjE,SAAgB,gBAAgB,CAC9B,MAAyB,OAAO,CAAC,GAAG,EACpC,YAAoB,wBAAgB;IAEpC,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC;IACD,MAAM,IAAI,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACrC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB,CACrC,KAAkF,EAClF,YAAoB,wBAAgB;IAEpC,IAAI,CAAC;QACH,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,QAAQ,IAAI,CAAC,2BAA2B,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACpE,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;eAClD,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAClF,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,IAAI,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QACjF,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACpE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC/B,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC/B,MAAM,WAAW,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;gBAC5C,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE;uBAClB,CAAC,IAAA,aAAU,GAAE,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;oBACtE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBACvE,CAAC;gBACD,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAC5B,CAAC;oBAAS,CAAC;gBAAC,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAAC,CAAC;YACxC,MAAM,WAAW,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;YAC9D,IAAI,CAAC;gBAAC,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAAC,CAAC;oBAAS,CAAC;gBAAC,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAAC,CAAC;QAC3E,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1,57 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Device-credential resolution for the stdio MCP server.
|
|
3
|
+
*
|
|
4
|
+
* Reads/writes ~/.provian/credentials — the SDK's env-format device file
|
|
5
|
+
* (KEY=VALUE lines, 0600) — so the MCP server, the CLI, and the observer all
|
|
6
|
+
* share ONE registered device per machine instead of minting one each.
|
|
7
|
+
*
|
|
8
|
+
* Safety rule: file credentials are reused only when PROVIAN_OWNER_TYPE=agent.
|
|
9
|
+
* A human-owned device file (from `register-device` without --agent) is left
|
|
10
|
+
* alone — submitting agent PEs through a human device would silently attribute
|
|
11
|
+
* them to the human's wallet. Env vars (PROVIAN_DEVICE_KEY/SECRET) are treated
|
|
12
|
+
* as explicit operator intent and used as-is.
|
|
13
|
+
*/
|
|
14
|
+
import type { DeviceAuth, PendingDeviceRegistration } from './core/types';
|
|
15
|
+
export declare const DEVICE_CREDS_PATH: string;
|
|
16
|
+
export declare const MCP_PENDING_DEVICE_REGISTRATION_PATH: string;
|
|
17
|
+
interface BoundDeviceCredentialsFile {
|
|
18
|
+
deviceKey: string;
|
|
19
|
+
deviceSecret: string;
|
|
20
|
+
deviceId: string;
|
|
21
|
+
walletId: string;
|
|
22
|
+
registrationId: string;
|
|
23
|
+
}
|
|
24
|
+
/**
|
|
25
|
+
* Persist a stable pending registration before the caller is allowed to send
|
|
26
|
+
* the first network request. Atomic rename means a crash yields either no
|
|
27
|
+
* request identity (and therefore no request) or the complete reusable one.
|
|
28
|
+
*/
|
|
29
|
+
export declare function loadOrCreatePendingDeviceRegistration(context: {
|
|
30
|
+
owner_key: string;
|
|
31
|
+
device_name: string;
|
|
32
|
+
platform: string;
|
|
33
|
+
}, pendingPath?: string): PendingDeviceRegistration;
|
|
34
|
+
/** Delete only the exact pending identity that just became durable. */
|
|
35
|
+
export declare function clearPendingDeviceRegistration(registrationId: string, pendingPath?: string, credsPath?: string): void;
|
|
36
|
+
/** Finish the legal crash state where bound credentials crossed their fsync
|
|
37
|
+
* barrier but pending deletion did not. A legacy/unbound device file is left
|
|
38
|
+
* untouched because it cannot authenticate the pending identity. */
|
|
39
|
+
export declare function reconcileInstalledDeviceRegistration(pendingPath?: string, credsPath?: string): void;
|
|
40
|
+
export declare function loadBoundDeviceCredentialsFile(credsPath?: string): BoundDeviceCredentialsFile | null;
|
|
41
|
+
/** Resolve device credentials: env first, then an agent-owned device file. */
|
|
42
|
+
export declare function resolveLocalDeviceAuth(env?: NodeJS.ProcessEnv, credsPath?: string): DeviceAuth | null;
|
|
43
|
+
/**
|
|
44
|
+
* Persist device credentials in the SDK's exact file format. Never overwrites
|
|
45
|
+
* an existing file (an already-registered device identity wins). Returns the
|
|
46
|
+
* path written, or null when skipped/failed.
|
|
47
|
+
*/
|
|
48
|
+
export declare function persistDeviceCredentialsFile(creds: {
|
|
49
|
+
device_key: string;
|
|
50
|
+
device_secret: string;
|
|
51
|
+
device_id?: string;
|
|
52
|
+
device_name?: string;
|
|
53
|
+
wallet_id?: string;
|
|
54
|
+
registration_id?: string;
|
|
55
|
+
}, credsPath?: string): string | null;
|
|
56
|
+
export {};
|
|
57
|
+
//# sourceMappingURL=device-credentials.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"device-credentials.d.ts","sourceRoot":"","sources":["../src/device-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,UAAU,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAE1E,eAAO,MAAM,iBAAiB,QAAkD,CAAC;AACjF,eAAO,MAAM,oCAAoC,QAIhD,CAAC;AAYF,UAAU,0BAA0B;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;CACxB;AAqGD;;;;GAIG;AACH,wBAAgB,qCAAqC,CACnD,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EACrE,WAAW,GAAE,MAA6C,GACzD,yBAAyB,CA6D3B;AAED,uEAAuE;AACvE,wBAAgB,8BAA8B,CAC5C,cAAc,EAAE,MAAM,EACtB,WAAW,GAAE,MAA6C,EAC1D,SAAS,GAAE,MAA0B,GACpC,IAAI,CAiBN;AAED;;oEAEoE;AACpE,wBAAgB,oCAAoC,CAClD,WAAW,GAAE,MAA6C,EAC1D,SAAS,GAAE,MAA0B,GACpC,IAAI,CAKN;AAuCD,wBAAgB,8BAA8B,CAC5C,SAAS,GAAE,MAA0B,GACpC,0BAA0B,GAAG,IAAI,CAgBnC;AAED,8EAA8E;AAC9E,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,SAAS,GAAE,MAA0B,GACpC,UAAU,GAAG,IAAI,CAenB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,EACD,SAAS,GAAE,MAA0B,GACpC,MAAM,GAAG,IAAI,CAkDf"}
|