@rel-time/mcp-server 1.2.3 → 1.2.5

package/index.js

@@ -17,7 +17,8 @@ const os = require("os");
 const path = require("path");
 const readline = require("readline");
 const { exec } = require("child_process");
-const { PDFDocument } = require("pdf-lib");
+const { PDFDocument, PDFName, PDFString } = require("pdf-lib");
+const QRCode = require("qrcode");
 const sharp = require("sharp");
 
 function normalizeApiBase(rawUrl) {
@@ -55,9 +56,38 @@ let LAST_INVOICE_PACK = null;
 
 const SERVER_INFO = {
   name: "rel-time-mcp-server",
-  version: "1.2.3",
+  version: "1.2.4",
 };
 
+/**
+ * Resolves a local file path, automatically matching macOS screenshot filenames
+ * that contain Narrow No-Break Spaces (U+202F) or Non-Breaking Spaces (U+00A0)
+ * when the caller passes normal ASCII spaces.
+ */
+function resolveLocalFilePath(rawPath) {
+  const resolved = path.resolve(rawPath);
+  if (fs.existsSync(resolved)) {
+    return resolved;
+  }
+  const dir = path.dirname(resolved);
+  const targetBase = path.basename(resolved);
+  const normalizeSpaces = (s) => s.normalize("NFC").replace(/[\u00A0\u202F\u2007\u2009\s]+/g, " ");
+  const normalizedTarget = normalizeSpaces(targetBase);
+  try {
+    if (fs.existsSync(dir)) {
+      const entries = fs.readdirSync(dir);
+      for (const entry of entries) {
+        if (normalizeSpaces(entry) === normalizedTarget) {
+          return path.join(dir, entry);
+        }
+      }
+    }
+  } catch (e) {
+    // Ignore directory read error
+  }
+  return resolved;
+}
+
 /**
  * Loads saved API key from ~/.reltime/api_key.json if not provided via env/args.
  */
@@ -203,7 +233,7 @@ function openSystemBrowser(url) {
  * Rel-Time WebAuthn Passkey Bridge in the user's browser so they can touch
  * TouchID / FaceID / YubiKey.
  */
-function launchBrowserPasskeyBridge(timeoutMs = 120000) {
+function launchBrowserPasskeyBridge(timeoutMs = 300000) {
   return new Promise((resolve, reject) => {
     const server = http.createServer((req, res) => {
       res.setHeader("Access-Control-Allow-Origin", "*");
@@ -252,10 +282,48 @@ function launchBrowserPasskeyBridge(timeoutMs = 120000) {
 }
 
 /**
- * Stamps the Option A (pure crisp 64-ray Sun-Stamp, 0% glare, no pill) onto a local Image or PDF.
+ * Injects a standard PNG tEXt chunk ("RelTimeVerify\0<verifyUrl>") right before IEND
+ * so Stamped PNG copies can be instantaneously verified when dropped into /verify.
+ */
+function injectPngVerifyBuffer(pngBuffer, verifyUrl) {
+  if (!verifyUrl || !Buffer.isBuffer(pngBuffer) || pngBuffer.length < 24) {
+    return pngBuffer;
+  }
+  const iendOffset = pngBuffer.length - 12;
+  if (pngBuffer.slice(iendOffset + 4, iendOffset + 8).toString("ascii") !== "IEND") {
+    return pngBuffer;
+  }
+  const payload = Buffer.from(`RelTimeVerify\0${verifyUrl}`, "utf8");
+  const typeBuf = Buffer.from("tEXt", "ascii");
+  const crcInput = Buffer.concat([typeBuf, payload]);
+
+  let crc = 0xffffffff;
+  for (let i = 0; i < crcInput.length; i++) {
+    crc ^= crcInput[i];
+    for (let b = 0; b < 8; b++) {
+      crc = (crc >>> 1) ^ (crc & 1 ? 0xedb88320 : 0);
+    }
+  }
+  crc = (crc ^ 0xffffffff) >>> 0;
+
+  const lenBuf = Buffer.alloc(4);
+  lenBuf.writeUInt32BE(payload.length, 0);
+  const crcBuf = Buffer.alloc(4);
+  crcBuf.writeUInt32BE(crc, 0);
+
+  const chunk = Buffer.concat([lenBuf, crcInput, crcBuf]);
+  return Buffer.concat([
+    pngBuffer.slice(0, iendOffset),
+    chunk,
+    pngBuffer.slice(iendOffset),
+  ]);
+}
+
+/**
+ * Stamps the Option 1A (+14° Bitcoin Tilt, pure crisp 64-ray Sun-Stamp, 0% glare, no pill) onto a local Image or PDF.
  * Returns { stamped: true, output_path, format } or { stamped: false, reason }.
  */
-async function stampLocalFileOptionA(filePath, svgContent, customOutputPath = null) {
+async function stampLocalFileOptionA(filePath, svgContent, customOutputPath = null, verifyHash = null) {
   const ext = path.extname(filePath).toLowerCase().replace(/^\./, "");
   const dir = path.dirname(filePath);
   const baseName = path.basename(filePath, path.extname(filePath));
@@ -270,18 +338,32 @@ async function stampLocalFileOptionA(filePath, svgContent, customOutputPath = nu
     };
   }
 
+  // Resolve verification URL from verifyHash or from <a href="..."> inside svgContent
+  let verifyUrl = verifyHash ? `https://rel-time.com/verify?t=${verifyHash.toLowerCase()}` : null;
+  if (!verifyUrl && typeof svgContent === "string") {
+    const match = svgContent.match(/https?:\/\/rel-time\.com\/verify\?[tThH]=([0-9a-fA-F]{64})/);
+    if (match) {
+      verifyUrl = `https://rel-time.com/verify?t=${match[1].toLowerCase()}`;
+    }
+  }
+
+  // Strip outer <a> wrapper before rasterizing with sharp/librsvg
+  const cleanSvg = String(svgContent || "")
+    .replace(/<a\b[^>]*>/gi, "")
+    .replace(/<\/a>/gi, "");
+
   if (isImage) {
     const outPath = customOutputPath ? path.resolve(customOutputPath) : path.join(dir, `reltime-stamped-${baseName}.png`);
     const img = sharp(filePath);
     const meta = await img.metadata();
-    const w = meta.width || 1200;
-    const h = meta.height || 800;
+    const w = (meta.autoOrient && meta.autoOrient.width) || meta.width || 1200;
+    const h = (meta.autoOrient && meta.autoOrient.height) || meta.height || 800;
 
     const minDim = Math.min(w, h);
-    const badgeSize = Math.max(130, Math.min(420, Math.round(minDim * 0.22)));
-    const margin = Math.max(12, Math.round(minDim * 0.025));
+    const badgeSize = Math.max(180, Math.round(minDim * 0.22));
+    const margin = Math.max(14, Math.round(minDim * 0.025));
 
-    const stampPngBuffer = await sharp(Buffer.from(svgContent, "utf8"))
+    const stampPngBuffer = await sharp(Buffer.from(cleanSvg, "utf8"))
       .resize(badgeSize, badgeSize)
       .png()
       .toBuffer();
@@ -289,10 +371,14 @@ async function stampLocalFileOptionA(filePath, svgContent, customOutputPath = nu
     const left = Math.max(0, w - badgeSize - margin);
     const top = Math.max(0, h - badgeSize - margin);
 
-    await img
+    const rawOutBuf = await sharp(filePath)
+      .rotate()
       .composite([{ input: stampPngBuffer, left, top }])
       .png()
-      .toFile(outPath);
+      .toBuffer();
+
+    const finalPngBuf = verifyUrl ? injectPngVerifyBuffer(rawOutBuf, verifyUrl) : rawOutBuf;
+    fs.writeFileSync(outPath, finalPngBuf);
 
     return {
       stamped: true,
@@ -313,24 +399,52 @@ async function stampLocalFileOptionA(filePath, svgContent, customOutputPath = nu
     const firstPage = pages[0];
     const { width, height } = firstPage.getSize();
 
-    // Render high-DPI 480x480 Option A Sun-Stamp PNG (pure crisp SVG, 0% glare, no pill)
-    const stampPngBuffer = await sharp(Buffer.from(svgContent, "utf8"))
-      .resize(480, 480)
+    // Render high-DPI 1024x1024 (300+ DPI) Option 1A Sun-Stamp PNG
+    const stampPngBuffer = await sharp(Buffer.from(cleanSvg, "utf8"))
+      .resize(1024, 1024)
       .png()
       .toBuffer();
 
     const pngImage = await pdfDoc.embedPng(stampPngBuffer);
-    const targetSize = Math.min(135, Math.max(85, Math.min(width, height) * 0.2));
+    const targetSize = Math.min(148, Math.max(105, Math.min(width, height) * 0.22));
     const margin = 18;
+    const drawX = Math.max(margin, width - targetSize - margin);
+    const drawY = margin;
 
     firstPage.drawImage(pngImage, {
-      x: Math.max(margin, width - targetSize - margin),
-      y: margin,
+      x: drawX,
+      y: drawY,
       width: targetSize,
       height: targetSize,
     });
 
-    const modifiedPdfBytes = await pdfDoc.save();
+    // Attach clickable PDF Link Annotation over the Sun-Stamp rectangle
+    if (verifyUrl) {
+      try {
+        const linkAnnotation = pdfDoc.context.obj({
+          Type: "Annot",
+          Subtype: "Link",
+          Rect: [drawX, drawY, drawX + targetSize, drawY + targetSize],
+          Border: [0, 0, 0],
+          F: 4,
+          A: {
+            Type: "Action",
+            S: "URI",
+            URI: PDFString.of(verifyUrl),
+          },
+        });
+        const linkRef = pdfDoc.context.register(linkAnnotation);
+        if (typeof firstPage.node.addAnnot === "function") {
+          firstPage.node.addAnnot(linkRef);
+        } else {
+          firstPage.node.set(PDFName.of("Annots"), pdfDoc.context.obj([linkRef]));
+        }
+      } catch (e) {
+        // Ignore annotation error on restricted PDFs
+      }
+    }
+
+    const modifiedPdfBytes = await pdfDoc.save({ useObjectStreams: false });
     fs.writeFileSync(outPath, Buffer.from(modifiedPdfBytes));
 
     return {
@@ -503,7 +617,7 @@ const TOOLS = [
   {
     name: "reltime_provision_agent_key",
     description:
-      "Self-onboarding & Top-Up for Autonomous AI Agents via Bitcoin Lightning (`POST /v1/agent/invoice` & `POST /v1/agent/claim`). IMPORTANT: Before calling `create_invoice` for a new key, ALWAYS ask the user which pack they want first:\n1. **Agent Launch Pack (`pack: 'launch'`, $5 / 50 Hashes):** Priority 10-Minute Bitcoin Queue · Standard Mode only (Data Integrity + Biometric or Anonymous) · Includes Sun-Stamp, 1-Click Stamped Copy (.PDF/.PNG), and .JSON Doomsday Proof.\n2. **Autonomous Agents (`pack: 'standard'`, $50 / 500 Hashes):** Dynamic 6-Hour Batch Queue · Supports both Temporal Mode (`T_index` sub-second sequencing) and Standard Mode · Reloadable anytime (+500 credits / $50) with zero key rotation.",
+      "Self-onboarding & Top-Up for Autonomous AI Agents via Bitcoin Lightning (`POST /v1/agent/invoice` & `POST /v1/agent/claim`). IMPORTANT:\n1. Before calling `create_invoice` for a new key, ALWAYS ask the user which pack they want first:\n   - **Agent Launch Pack (`pack: 'launch'`, $5 / 50 Hashes):** Priority 10-Minute Bitcoin Queue · Standard Mode only (Data Integrity + Biometric or Anonymous) · Includes Sun-Stamp, 1-Click Stamped Copy (.PDF/.PNG), and .JSON Doomsday Proof.\n   - **Autonomous Agents (`pack: 'standard'`, $50 / 500 Hashes):** Dynamic 6-Hour Batch Queue · Supports both Temporal Mode (`T_index` sub-second sequencing) and Standard Mode · Reloadable anytime (+500 credits / $50) with zero key rotation.\n2. When `create_invoice` returns, ALWAYS present BOTH the scannable QR code image (by calling Read on `qr_code_png_path` so the image renders inline in chat!) AND the full, un-truncated `ln_invoice` (`bolt11`) string in a copyable code block on the VERY FIRST try!",
     inputSchema: {
       type: "object",
       properties: {
@@ -576,7 +690,7 @@ async function executeTool(name, args = {}) {
         "Before anchoring files, a Rel-Time API key is required. Ask the user which pack they want to provision first:"
       );
     }
-    const filePath = path.resolve(args.file_path);
+    const filePath = resolveLocalFilePath(args.file_path);
     if (!fs.existsSync(filePath)) {
       throw new Error(`File not found at path: ${filePath}`);
     }
@@ -671,7 +785,7 @@ async function executeTool(name, args = {}) {
     // 3. Automatically generate Stamped Copy (.PDF or .PNG) for PDFs and Images
     let stampedCopyResult = null;
     if (args.save_stamped_copy !== false) {
-      stampedCopyResult = await stampLocalFileOptionA(filePath, svgContent);
+      stampedCopyResult = await stampLocalFileOptionA(filePath, svgContent, null, clientHash);
     }
 
     return {
@@ -696,7 +810,7 @@ async function executeTool(name, args = {}) {
   }
 
   if (name === "reltime_stamp_file") {
-    const filePath = path.resolve(args.file_path);
+    const filePath = resolveLocalFilePath(args.file_path);
     if (!fs.existsSync(filePath)) {
       throw new Error(`File not found at path: ${filePath}`);
     }
@@ -713,7 +827,7 @@ async function executeTool(name, args = {}) {
       throw new Error(`Failed to fetch Sun-Stamp (${stampRes.status}): ${await stampRes.text()}`);
     }
     const svgContent = await stampRes.text();
-    const result = await stampLocalFileOptionA(filePath, svgContent, args.output_path || null);
+    const result = await stampLocalFileOptionA(filePath, svgContent, args.output_path || null, targetHash);
     return {
       file_path: filePath,
       hash: targetHash,
@@ -853,7 +967,40 @@ async function executeTool(name, args = {}) {
           pack: args.pack,
         }),
       });
-      return await res.json();
+      const data = await res.json();
+      const bolt11 = data.ln_invoice || data.bolt11 || "";
+      if (bolt11) {
+        try {
+          if (!fs.existsSync(PASSKEY_CONFIG_DIR)) {
+            fs.mkdirSync(PASSKEY_CONFIG_DIR, { recursive: true, mode: 0o700 });
+          }
+          const qrPngBuffer = await QRCode.toBuffer(bolt11.toUpperCase(), {
+            type: "png",
+            width: 560,
+            margin: 2,
+            errorCorrectionLevel: "M",
+          });
+          const homeQrPath = path.join(PASSKEY_CONFIG_DIR, "lightning-invoice-qr.png");
+          const tmpQrPath = "/tmp/reltime-lightning-qr.png";
+          fs.writeFileSync(homeQrPath, qrPngBuffer);
+          try {
+            fs.writeFileSync(tmpQrPath, qrPngBuffer);
+          } catch (e) {
+            // Ignore /tmp write error
+          }
+          data.bolt11 = bolt11;
+          data.ln_invoice = bolt11;
+          data.qr_code_png_path = homeQrPath;
+          data.qr_code_tmp_png_path = tmpQrPath;
+          data.invoice_expiration = "60 minutes (3,600 seconds)";
+          data.mandatory_first_reply_instructions =
+            "CRITICAL INSTRUCTION FOR AI AGENT: On this very first reply, you MUST show the user BOTH: (1) the scannable QR code image (immediately call your Read tool on `qr_code_png_path` BEFORE sending your message so the QR code PNG renders inline in the chat window right now!) AND (2) the full, un-truncated `bolt11` (`lnbc...`) Lightning invoice string inside a copyable code block so the user can either scan with their phone or copy-paste on the first try without asking!";
+          data._mcp_image_base64 = qrPngBuffer.toString("base64");
+        } catch (qrErr) {
+          data.qr_error = qrErr.message;
+        }
+      }
+      return data;
     } else if (args.action === "claim_invoice") {
       if (!args.invoice_id) throw new Error("invoice_id is required when action is 'claim_invoice'.");
       const resolvedPack = args.pack || LAST_INVOICE_PACK || undefined;
@@ -933,16 +1080,25 @@ rl.on("line", async (line) => {
       const toolArgs = params?.arguments || {};
       try {
         const resultObj = await executeTool(toolName, toolArgs);
+        const contentItems = [];
+        if (resultObj && resultObj._mcp_image_base64) {
+          const b64 = resultObj._mcp_image_base64;
+          delete resultObj._mcp_image_base64;
+          contentItems.push({
+            type: "image",
+            data: b64,
+            mimeType: "image/png",
+          });
+        }
+        contentItems.push({
+          type: "text",
+          text: JSON.stringify(resultObj, null, 2),
+        });
         sendJsonRpc({
           jsonrpc: "2.0",
           id,
           result: {
-            content: [
-              {
-                type: "text",
-                text: JSON.stringify(resultObj, null, 2),
-              },
-            ],
+            content: contentItems,
           },
         });
       } catch (toolErr) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rel-time/mcp-server",
-  "version": "1.2.3",
+  "version": "1.2.5",
   "description": "Official Model Context Protocol (MCP) server for Rel-Time (rel-time.com) — Zero-Knowledge Bitcoin & VDF Provenance, Local File Hashing, and Sun-Stamp Generation for Claude, Cursor, Windsurf, and Antigravity.",
   "main": "index.js",
   "bin": {
@@ -32,6 +32,7 @@
   },
   "dependencies": {
     "pdf-lib": "^1.17.1",
+    "qrcode": "^1.5.4",
     "sharp": "^0.35.5"
   }
 }