@trusty-squire/mcp 0.1.0

package/dist/install/cli.js

@@ -0,0 +1,277 @@
+#!/usr/bin/env node
+// Install / pair / logout CLI.
+//
+// Tier 0 install (default) — friction-free:
+//   npx @trusty-squire/mcp install --target=claude-code
+//   → issues an anonymous machine token, writes MCP config, done.
+//
+// Tier 1+ pair (opt-in, on quota hit or user request):
+//   npx @trusty-squire/mcp pair
+//   → opens browser, pairs machine, upgrades session to a real account.
+//
+// Logout:
+//   npx @trusty-squire/mcp logout
+//
+// Flags:
+//   --target=<agent>     skip auto-detection
+//   --api-base=<url>     override the API base URL
+//   --pair               run pairing as part of install (Tier 1 from minute 1)
+import process from "node:process";
+import { pairInitiate, pairPoll, issueMachineToken } from "../api-client.js";
+import { openSessionStorage } from "../session.js";
+import { AGENTS, detectInstalledAgents } from "./agents.js";
+import { detectAsn } from "@trusty-squire/universal-bot";
+const DEFAULT_API_BASE = process.env.TRUSTY_SQUIRE_API_BASE ?? "https://trusty-squire-api.fly.dev";
+function parseArgs(argv) {
+    const positional = argv.filter((a) => !a.startsWith("--"));
+    const command = positional[0] ?? "install";
+    let target;
+    let apiBase = DEFAULT_API_BASE;
+    let withPair = false;
+    for (const arg of argv) {
+        if (arg.startsWith("--target=")) {
+            const t = arg.slice("--target=".length);
+            if (isAgentTarget(t))
+                target = t;
+        }
+        else if (arg.startsWith("--api-base=")) {
+            apiBase = arg.slice("--api-base=".length);
+        }
+        else if (arg === "--pair") {
+            withPair = true;
+        }
+    }
+    return target !== undefined
+        ? { command, target, apiBase, withPair }
+        : { command, apiBase, withPair };
+}
+function isAgentTarget(s) {
+    return s === "claude-code" || s === "cursor" || s === "goose" || s === "cline" || s === "continue";
+}
+async function main() {
+    const args = parseArgs(process.argv.slice(2));
+    switch (args.command) {
+        case "install":
+            await install(args);
+            return;
+        case "pair":
+            await pair(args);
+            return;
+        case "logout":
+            await logout();
+            return;
+        case "help":
+            printHelp();
+            return;
+        default:
+            console.error(`unknown command: ${args.command}`);
+            printHelp();
+            process.exit(64);
+    }
+}
+async function install(args) {
+    const target = await resolveTarget(args.target);
+    const agent = AGENTS[target];
+    // ── Detect egress class ───────────────────────────────────
+    // We do this before issuing the machine token so the asn class can
+    // be sent in the install payload (lets the API pre-correlate captcha
+    // failures with network class for analytics). Best-effort — a network
+    // failure here just means "unknown" gets sent.
+    const asn = await detectAsn();
+    // ── Tier 0: get a machine token (zero clicks) ─────────────
+    console.warn(`Setting up Trusty Squire on this machine…`);
+    const machine = await issueMachineToken(args.apiBase, fetch, asn ?? undefined);
+    console.warn(`✓ Got ${machine.quota_limit} free signups. No account needed yet.`);
+    // ── Warn datacenter users explicitly ──────────────────────
+    // The whole captcha-bypass story depends on a residential egress IP.
+    // Datacenter ASNs (Hetzner, AWS, Codespaces) get auto-rejected by
+    // reCAPTCHA v2 regardless of fingerprint quality. We don't try to
+    // hide this — better to set expectations now than have the user
+    // file a "Postmark signup doesn't work" bug later.
+    if (asn !== null) {
+        printAsnWarning(asn);
+    }
+    const storage = await openSessionStorage();
+    const baseSession = {
+        api_base_url: args.apiBase,
+        saved_at: new Date().toISOString(),
+        machine_token: machine.machine_token,
+    };
+    // ── Optional Tier 1: pair if --pair was passed ────────────
+    let finalSession = baseSession;
+    if (args.withPair) {
+        const upgraded = await runPair(args.apiBase, target, baseSession);
+        if (upgraded === null) {
+            console.warn("Pairing didn't complete — keeping Tier 0 session. Run `squire-mcp pair` later to upgrade.");
+        }
+        else {
+            finalSession = upgraded;
+        }
+    }
+    await storage.write(finalSession);
+    console.warn(`✓ Session saved (${storage.backendName()}).`);
+    // ── Write the MCP config into the host agent ──────────────
+    //
+    // Env vars passed to the MCP child:
+    //   - TRUSTY_SQUIRE_AGENT_IDENTITY: which host agent we're running under
+    //   - UNIVERSAL_BOT_PREFER_CHEAP=true: cheap-mode is the right default
+    //     for free Tier-0 signups; the proxy enforces this server-side
+    //     anyway, but setting it here means users who run the bot CLI
+    //     directly (outside MCP) also get the cheap path by default.
+    //
+    // The machine token itself is NOT in the env — the MCP server reads it
+    // from session storage (keychain / file), which keeps it out of any
+    // child-process listing or shell history.
+    await agent.writeConfig({
+        command: "npx",
+        args: ["-y", "@trusty-squire/mcp"],
+        env: {
+            TRUSTY_SQUIRE_AGENT_IDENTITY: target,
+            UNIVERSAL_BOT_PREFER_CHEAP: "true",
+        },
+    });
+    console.warn(`✓ Wrote ${agent.display_name} MCP config at ${agent.config_path()}.`);
+    console.warn(``);
+    console.warn(`You're done. Restart ${agent.display_name} to pick up the new tools.`);
+    console.warn(``);
+    console.warn(`Free signups available: ${machine.quota_limit - machine.quota_used}. ` +
+        `When you hit the limit, run \`npx @trusty-squire/mcp pair\` to upgrade.`);
+}
+async function pair(args) {
+    const storage = await openSessionStorage();
+    const existing = (await storage.read()) ?? {
+        api_base_url: args.apiBase,
+        saved_at: new Date().toISOString(),
+    };
+    const target = await resolveTarget(args.target);
+    const upgraded = await runPair(args.apiBase, target, existing);
+    if (upgraded === null) {
+        console.error("Pairing failed or expired. Try again with `npx @trusty-squire/mcp pair`.");
+        process.exit(1);
+    }
+    await storage.write(upgraded);
+    console.warn(`✓ Paired. You can now use vault + paid-service provisioning.`);
+}
+// Runs the browser-based pair flow. Returns an upgraded SessionData on
+// success, null on timeout/expiry. Preserves any existing machine_token
+// so quota tracking continues to work post-pair.
+async function runPair(apiBase, target, existing) {
+    console.warn(`Pairing this machine with Trusty Squire…`);
+    const initiate = await pairInitiate(apiBase, target, existing.machine_token ?? null);
+    console.warn(`Open this URL in your browser to confirm:`);
+    console.warn(`  ${initiate.pair_url}`);
+    try {
+        const openMod = await import("open");
+        await openMod.default(initiate.pair_url);
+    }
+    catch {
+        // ignore — user copies the URL
+    }
+    const claim = await pollForClaim(apiBase, initiate.pair_token);
+    if (claim === null)
+        return null;
+    return {
+        ...existing,
+        api_base_url: apiBase,
+        saved_at: new Date().toISOString(),
+        agent_session_token: claim.token,
+        account_id: claim.account_id,
+    };
+}
+async function resolveTarget(explicit) {
+    if (explicit !== undefined)
+        return explicit;
+    const detected = await detectInstalledAgents();
+    if (detected.length === 1) {
+        console.warn(`Detected ${detected[0].display_name}. Configuring squire for it.`);
+        return detected[0].target;
+    }
+    if (detected.length > 1) {
+        console.error("Multiple agents detected. Please pass --target=<agent>:");
+        for (const a of detected)
+            console.error(`  --target=${a.target}  (${a.display_name})`);
+        process.exit(2);
+    }
+    console.error("No coding agents auto-detected. Pass --target= explicitly:");
+    for (const a of Object.values(AGENTS)) {
+        console.error(`  --target=${a.target}  (${a.display_name})`);
+    }
+    process.exit(2);
+}
+async function logout() {
+    const storage = await openSessionStorage();
+    await storage.clear();
+    console.warn(`✓ Cleared local session (${storage.backendName()}).`);
+}
+function printHelp() {
+    console.warn(`squire-mcp — install Trusty Squire MCP into a coding agent`);
+    console.warn(``);
+    console.warn(`Commands:`);
+    console.warn(`  install [--target=<agent>] [--api-base=<url>] [--pair]`);
+    console.warn(`  pair [--target=<agent>] [--api-base=<url>]`);
+    console.warn(`  logout`);
+    console.warn(``);
+    console.warn(`Agents: ${Object.keys(AGENTS).join(", ")}`);
+    console.warn(``);
+    console.warn(`The default \`install\` runs Tier 0: zero clicks, issues a machine token`);
+    console.warn(`good for a handful of free signups. Run \`pair\` later to upgrade.`);
+    console.warn(`Use \`install --pair\` to do both at once.`);
+}
+async function pollForClaim(apiBase, pairToken, intervalMsOrOpts = {}, timeoutMsArg) {
+    const opts = typeof intervalMsOrOpts === "number"
+        ? { intervalMs: intervalMsOrOpts, timeoutMs: timeoutMsArg }
+        : intervalMsOrOpts;
+    const intervalMs = opts.intervalMs ?? 1500;
+    const timeoutMs = opts.timeoutMs ?? 5 * 60 * 1000;
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        const status = await pairPoll(apiBase, pairToken);
+        if (status.status === "claimed" && status.agent_session_token !== undefined) {
+            return {
+                token: status.agent_session_token,
+                account_id: status.account_id ?? "",
+            };
+        }
+        if (status.status === "expired")
+            return null;
+        await new Promise((r) => setTimeout(r, intervalMs));
+    }
+    return null;
+}
+// Print a class-appropriate message about the network we detected.
+// Datacenter gets a clear warning + link; residential gets a brief
+// confirmation; unknown gets a heads-up. All to stderr.
+function printAsnWarning(asn) {
+    const orgDisplay = asn.org ?? "(unknown ASN)";
+    switch (asn.class) {
+        case "datacenter":
+            console.warn(``);
+            console.warn(`⚠  Detected network: ${orgDisplay}`);
+            console.warn(`   This looks like a datacenter / cloud network (Codespaces, AWS,`);
+            console.warn(`   Hetzner, etc.). Some signups — especially those gated by`);
+            console.warn(`   reCAPTCHA v2 — are likely to be blocked because anti-bot`);
+            console.warn(`   scoring weighs network reputation heavily.`);
+            console.warn(``);
+            console.warn(`   For best results: run Trusty Squire from a laptop/desktop`);
+            console.warn(`   on a home or office network. Cloud dev environments can`);
+            console.warn(`   still provision services that don't gate signup with`);
+            console.warn(`   reCAPTCHA (Resend, IPInfo, etc.), but Postmark/MailerSend`);
+            console.warn(`   and similar will likely fail.`);
+            console.warn(``);
+            return;
+        case "residential":
+            console.warn(`✓ Detected network: ${orgDisplay} (residential — captchas should pass cleanly).`);
+            return;
+        case "unknown":
+            console.warn(`ℹ Detected network: ${orgDisplay} (couldn't classify — proceed and we'll see).`);
+            return;
+    }
+}
+if (import.meta.url === `file://${process.argv[1]}`) {
+    main().catch((err) => {
+        console.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    });
+}
+export { install, pair, logout, parseArgs, pollForClaim, printAsnWarning };
+//# sourceMappingURL=cli.js.map

package/dist/install/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/install/cli.ts"],"names":[],"mappings":";AACA,+BAA+B;AAC/B,EAAE;AACF,4CAA4C;AAC5C,wDAAwD;AACxD,kEAAkE;AAClE,EAAE;AACF,uDAAuD;AACvD,gCAAgC;AAChC,wEAAwE;AACxE,EAAE;AACF,UAAU;AACV,kCAAkC;AAClC,EAAE;AACF,SAAS;AACT,6CAA6C;AAC7C,mDAAmD;AACnD,+EAA+E;AAE/E,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAoB,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAoB,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAgB,MAAM,8BAA8B,CAAC;AAEvE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,mCAAmC,CAAC;AASnG,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IAC3C,IAAI,MAA+B,CAAC;IACpC,IAAI,OAAO,GAAG,gBAAgB,CAAC;IAC/B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,aAAa,CAAC,CAAC,CAAC;gBAAE,MAAM,GAAG,CAAC,CAAC;QACnC,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACzC,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,KAAK,SAAS;QACzB,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE;QACxC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,OAAO,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,UAAU,CAAC;AACrG,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;YACpB,OAAO;QACT,KAAK,MAAM;YACT,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO;QACT,KAAK,QAAQ;YACX,MAAM,MAAM,EAAE,CAAC;YACf,OAAO;QACT,KAAK,MAAM;YACT,SAAS,EAAE,CAAC;YACZ,OAAO;QACT;YACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YAClD,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAU;IAC/B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAE7B,6DAA6D;IAC7D,mEAAmE;IACnE,qEAAqE;IACrE,sEAAsE;IACtE,+CAA+C;IAC/C,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;IAE9B,6DAA6D;IAC7D,OAAO,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC;IAC/E,OAAO,CAAC,IAAI,CACV,SAAS,OAAO,CAAC,WAAW,uCAAuC,CACpE,CAAC;IAEF,6DAA6D;IAC7D,qEAAqE;IACrE,kEAAkE;IAClE,kEAAkE;IAClE,gEAAgE;IAChE,mDAAmD;IACnD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,eAAe,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC3C,MAAM,WAAW,GAAgB;QAC/B,YAAY,EAAE,IAAI,CAAC,OAAO;QAC1B,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,aAAa,EAAE,OAAO,CAAC,aAAa;KACrC,CAAC;IAEF,6DAA6D;IAC7D,IAAI,YAAY,GAAG,WAAW,CAAC;IAC/B,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAClE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CACV,2FAA2F,CAC5F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,YAAY,GAAG,QAAQ,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAE5D,6DAA6D;IAC7D,EAAE;IACF,oCAAoC;IACpC,yEAAyE;IACzE,uEAAuE;IACvE,mEAAmE;IACnE,kEAAkE;IAClE,iEAAiE;IACjE,EAAE;IACF,uEAAuE;IACvE,oEAAoE;IACpE,0CAA0C;IAC1C,MAAM,KAAK,CAAC,WAAW,CAAC;QACtB,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,CAAC,IAAI,EAAE,oBAAoB,CAAC;QAClC,GAAG,EAAE;YACH,4BAA4B,EAAE,MAAM;YACpC,0BAA0B,EAAE,MAAM;SACnC;KACF,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,YAAY,kBAAkB,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACpF,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,IAAI,CAAC,wBAAwB,KAAK,CAAC,YAAY,4BAA4B,CAAC,CAAC;IACrF,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,IAAI,CACV,2BAA2B,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,IAAI;QACrE,yEAAyE,CAC5E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAU;IAC5B,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI;QACzC,YAAY,EAAE,IAAI,CAAC,OAAO;QAC1B,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9B,OAAO,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;AAC/E,CAAC;AAED,uEAAuE;AACvE,wEAAwE;AACxE,iDAAiD;AACjD,KAAK,UAAU,OAAO,CACpB,OAAe,EACf,MAAmB,EACnB,QAAqB;IAErB,OAAO,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,YAAY,CACjC,OAAO,EACP,MAAM,EACN,QAAQ,CAAC,aAAa,IAAI,IAAI,CAC/B,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IAC1D,OAAO,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEhC,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE,OAAO;QACrB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,mBAAmB,EAAE,KAAK,CAAC,KAAK;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAiC;IAC5D,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,YAAY,QAAQ,CAAC,CAAC,CAAE,CAAC,YAAY,8BAA8B,CAAC,CAAC;QAClF,OAAO,QAAQ,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC;IAC7B,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACzE,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,MAAM;IACnB,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC3C,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACtB,OAAO,CAAC,IAAI,CAAC,4BAA4B,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC3E,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACzE,OAAO,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC7D,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1D,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACzF,OAAO,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;IACnF,OAAO,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;AAC7D,CAAC;AAOD,KAAK,UAAU,YAAY,CACzB,OAAe,EACf,SAAiB,EACjB,mBAAyE,EAAE,EAC3E,YAAqB;IAErB,MAAM,IAAI,GACR,OAAO,gBAAgB,KAAK,QAAQ;QAClC,CAAC,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,YAAY,EAAE;QAC3D,CAAC,CAAC,gBAAgB,CAAC;IACvB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;YAC5E,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,mBAAmB;gBACjC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;aACpC,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC7C,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mEAAmE;AACnE,mEAAmE;AACnE,wDAAwD;AACxD,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,IAAI,eAAe,CAAC;IAC9C,QAAQ,GAAG,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,YAAY;YACf,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,wBAAwB,UAAU,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;YAClF,OAAO,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YAC5E,OAAO,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YAC5E,OAAO,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;YAC7E,OAAO,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;YAC3E,OAAO,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YACxE,OAAO,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;YAC7E,OAAO,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjB,OAAO;QACT,KAAK,aAAa;YAChB,OAAO,CAAC,IAAI,CAAC,uBAAuB,UAAU,gDAAgD,CAAC,CAAC;YAChG,OAAO;QACT,KAAK,SAAS;YACZ,OAAO,CAAC,IAAI,CAAC,uBAAuB,UAAU,+CAA+C,CAAC,CAAC;YAC/F,OAAO;IACX,CAAC;AACH,CAAC;AAED,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpD,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC5B,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,4 @@
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { ApiClient } from "./api-client.js";
+export declare function buildServer(api: ApiClient | null): Promise<Server>;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAMnE,OAAO,EAAE,SAAS,EAAuB,MAAM,iBAAiB,CAAC;AASjE,wBAAsB,WAAW,CAAC,GAAG,EAAE,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAwDxE"}

package/dist/server.js

@@ -0,0 +1,100 @@
+// MCP server entry point. Reads the session from keytar/file, sets up
+// an ApiClient against the configured API base URL, and exposes the
+// registered tools over stdio.
+//
+// The server is what a coding agent (Claude Code, Cursor, etc.)
+// launches as a child process via the MCP config it found in
+// `~/.claude/mcp.json` or equivalent.
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { ApiClient, MissingSessionError } from "./api-client.js";
+import { TOOLS, findTool } from "./tools/index.js";
+import { openSessionStorage } from "./session.js";
+const SERVER_NAME = "trusty-squire";
+const SERVER_VERSION = "0.1.0";
+const DEFAULT_REGISTRY_BASE = process.env.ADAPTER_REGISTRY_URL ?? "https://registry.trustysquire.ai";
+export async function buildServer(api) {
+    const server = new Server({ name: SERVER_NAME, version: SERVER_VERSION }, { capabilities: { tools: {} } });
+    server.setRequestHandler(ListToolsRequestSchema, async () => ({
+        tools: TOOLS.map((t) => ({
+            name: t.name,
+            description: t.description,
+            inputSchema: t.jsonInputSchema,
+        })),
+    }));
+    server.setRequestHandler(CallToolRequestSchema, async (req) => {
+        const tool = findTool(req.params.name);
+        if (tool === null) {
+            return errorContent(`unknown tool '${req.params.name}'`);
+        }
+        const parsed = tool.inputSchema.safeParse(req.params.arguments ?? {});
+        if (!parsed.success) {
+            return errorContent(`invalid arguments: ${parsed.error.issues.map((i) => i.message).join("; ")}`);
+        }
+        try {
+            // provision_any_service doesn't need API client (anonymous mode)
+            if (tool.name === "provision_any_service") {
+                const result = await tool.handler(parsed.data, null);
+                return {
+                    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+                };
+            }
+            // Other tools require an authenticated (Tier 1+) agent_session_token.
+            // provision_any_service is the Tier 0 escape hatch and handles its own
+            // session check above, so users who only need universal signup don't
+            // need to pair at all.
+            if (api === null) {
+                return errorContent(`This tool requires pairing (Tier 1+). For local dev: ` +
+                    `\`node /home/chode/trusty-squire/apps/mcp/dist/install/cli.js install --target=goose --pair\`. ` +
+                    `In production: \`npx @trusty-squire/mcp install --target=<agent> --pair\`. ` +
+                    `If you just want to sign up for a free service, call \`provision_any_service\` instead — ` +
+                    `it works with a Tier 0 machine_token and doesn't need pairing.`);
+            }
+            const result = await tool.handler(parsed.data, api);
+            return {
+                content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+            };
+        }
+        catch (err) {
+            return errorContent(err instanceof Error ? err.message : String(err));
+        }
+    });
+    return server;
+}
+function errorContent(message) {
+    return {
+        isError: true,
+        content: [{ type: "text", text: message }],
+    };
+}
+async function main() {
+    const storage = await openSessionStorage();
+    const session = await storage.read();
+    // Tier-aware ApiClient: only paired (Tier 1+) sessions can call the
+    // authenticated API. Tier 0 machine-token-only sessions get a null
+    // ApiClient — provision_any_service uses session.machine_token via the
+    // InboxClient directly, no agent session required.
+    const api = session !== null && session.agent_session_token !== undefined
+        ? new ApiClient({
+            apiBaseUrl: session.api_base_url,
+            registryBaseUrl: DEFAULT_REGISTRY_BASE,
+            agentSessionToken: session.agent_session_token,
+            agentIdentity: process.env.TRUSTY_SQUIRE_AGENT_IDENTITY ?? "unknown",
+        })
+        : null;
+    const server = await buildServer(api);
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+if (import.meta.url === `file://${process.argv[1]}`) {
+    main().catch((err) => {
+        // stderr goes to the coding agent's MCP log — keep the message
+        // useful for debugging without leaking secrets.
+        console.error(err instanceof MissingSessionError
+            ? err.message
+            : `[trusty-squire] startup failed: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,oEAAoE;AACpE,+BAA+B;AAC/B,EAAE;AACF,gEAAgE;AAChE,6DAA6D;AAC7D,sCAAsC;AAEtC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,WAAW,GAAG,eAAe,CAAC;AACpC,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,kCAAkC,CAAC;AAErG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAqB;IACrD,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,EAC9C,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,eAAe;SAC/B,CAAC,CAAC;KACJ,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,YAAY,CAAC,iBAAiB,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,YAAY,CAAC,sBAAsB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC;YACH,iEAAiE;YACjE,IAAI,IAAI,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;gBAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACrD,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;iBACnE,CAAC;YACJ,CAAC;YAED,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,uBAAuB;YACvB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,OAAO,YAAY,CACjB,uDAAuD;oBACvD,iGAAiG;oBACjG,6EAA6E;oBAC7E,2FAA2F;oBAC3F,gEAAgE,CACjE,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACpD,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aACnE,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,YAAY,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAErC,oEAAoE;IACpE,mEAAmE;IACnE,uEAAuE;IACvE,mDAAmD;IACnD,MAAM,GAAG,GACP,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,mBAAmB,KAAK,SAAS;QAC3D,CAAC,CAAC,IAAI,SAAS,CAAC;YACZ,UAAU,EAAE,OAAO,CAAC,YAAY;YAChC,eAAe,EAAE,qBAAqB;YACtC,iBAAiB,EAAE,OAAO,CAAC,mBAAmB;YAC9C,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,SAAS;SACrE,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpD,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC5B,+DAA+D;QAC/D,gDAAgD;QAChD,OAAO,CAAC,KAAK,CACX,GAAG,YAAY,mBAAmB;YAChC,CAAC,CAAC,GAAG,CAAC,OAAO;YACb,CAAC,CAAC,mCAAmC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1F,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/session.d.ts

@@ -0,0 +1,25 @@
+export interface SessionData {
+    api_base_url: string;
+    saved_at: string;
+    machine_token?: string;
+    agent_session_token?: string;
+    account_id?: string;
+}
+export interface SessionStorage {
+    read(): Promise<SessionData | null>;
+    write(data: SessionData): Promise<void>;
+    clear(): Promise<void>;
+    backendName(): string;
+}
+export declare function openSessionStorage(options?: {
+    preferFile?: boolean;
+}): Promise<SessionStorage>;
+export declare class FileStorage implements SessionStorage {
+    private readonly filePath;
+    constructor(filePath?: string);
+    read(): Promise<SessionData | null>;
+    write(data: SessionData): Promise<void>;
+    clear(): Promise<void>;
+    backendName(): string;
+}
+//# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IAEjB,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACpC,KAAK,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,WAAW,IAAI,MAAM,CAAC;CACvB;AAKD,wBAAsB,kBAAkB,CACtC,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAO,GACrC,OAAO,CAAC,cAAc,CAAC,CAMzB;AAiED,qBAAa,WAAY,YAAW,cAAc;IAEpC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,GAAE,MAAsB;IAEvD,IAAI,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAUnC,KAAK,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B,WAAW,IAAI,MAAM;CAGtB"}

package/dist/session.js

@@ -0,0 +1,112 @@
+// MCP session storage.
+//
+// Prefer keytar (OS keychain) when available. Fall back to a 0600
+// file at $XDG_CONFIG_HOME/trusty-squire/session.json (or
+// ~/.config/trusty-squire/session.json) so the install works on
+// minimal Linux containers and CI machines without libsecret.
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+const KEYTAR_SERVICE = "trusty-squire";
+const KEYTAR_ACCOUNT = "session";
+const FALLBACK_DIR = path.join(process.env.XDG_CONFIG_HOME ?? path.join(os.homedir(), ".config"), "trusty-squire");
+const FALLBACK_FILE = path.join(FALLBACK_DIR, "session.json");
+// Tries keytar first. Falls back to the file backend if keytar isn't
+// installed or its native binding can't load. The fallback is also the
+// chosen backend for CI / tests.
+export async function openSessionStorage(options = {}) {
+    if (options.preferFile !== true) {
+        const keytar = await tryLoadKeytar();
+        if (keytar !== null)
+            return new KeytarStorage(keytar);
+    }
+    return new FileStorage();
+}
+async function tryLoadKeytar() {
+    // Two things can fail here:
+    //   1. The module itself can't load (no native binding for this Node
+    //      version, or the package isn't installed).
+    //   2. The module loads but the OS keychain isn't available (no
+    //      D-Bus secrets daemon on a headless Linux box, locked Keychain
+    //      on macOS, etc.) — load succeeds, the first call throws.
+    // Probe with a write to a throwaway entry: getPassword() can succeed
+    // (returning null) on a half-broken D-Bus where the secrets service
+    // is present but no collection is unlocked — only setPassword
+    // surfaces that. We delete the probe right after so we don't pollute
+    // the keychain.
+    try {
+        const mod = await import("keytar");
+        const probeAccount = `${KEYTAR_ACCOUNT}__probe`;
+        await mod.default.setPassword(KEYTAR_SERVICE, probeAccount, "1");
+        await mod.default.deletePassword(KEYTAR_SERVICE, probeAccount);
+        return {
+            getPassword: mod.default.getPassword,
+            setPassword: mod.default.setPassword,
+            deletePassword: mod.default.deletePassword,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+class KeytarStorage {
+    kt;
+    constructor(kt) {
+        this.kt = kt;
+    }
+    async read() {
+        const raw = await this.kt.getPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
+        if (raw === null)
+            return null;
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            return null;
+        }
+    }
+    async write(data) {
+        await this.kt.setPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT, JSON.stringify(data));
+    }
+    async clear() {
+        await this.kt.deletePassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
+    }
+    backendName() {
+        return "keytar";
+    }
+}
+export class FileStorage {
+    filePath;
+    // Allow tests to override the default file path.
+    constructor(filePath = FALLBACK_FILE) {
+        this.filePath = filePath;
+    }
+    async read() {
+        try {
+            const raw = await fs.readFile(this.filePath, "utf8");
+            return JSON.parse(raw);
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                return null;
+            throw err;
+        }
+    }
+    async write(data) {
+        await fs.mkdir(path.dirname(this.filePath), { recursive: true, mode: 0o700 });
+        await fs.writeFile(this.filePath, JSON.stringify(data, null, 2), { mode: 0o600 });
+    }
+    async clear() {
+        try {
+            await fs.unlink(this.filePath);
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                throw err;
+        }
+    }
+    backendName() {
+        return "file";
+    }
+}
+//# sourceMappingURL=session.js.map

package/dist/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,uBAAuB;AACvB,EAAE;AACF,kEAAkE;AAClE,0DAA0D;AAC1D,gEAAgE;AAChE,8DAA8D;AAE9D,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,cAAc,GAAG,eAAe,CAAC;AACvC,MAAM,cAAc,GAAG,SAAS,CAAC;AAEjC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAC5B,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,EACjE,eAAe,CAChB,CAAC;AACF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AAuB9D,qEAAqE;AACrE,uEAAuE;AACvE,iCAAiC;AACjC,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAoC,EAAE;IAEtC,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,4BAA4B;IAC5B,qEAAqE;IACrE,iDAAiD;IACjD,gEAAgE;IAChE,qEAAqE;IACrE,+DAA+D;IAC/D,qEAAqE;IACrE,oEAAoE;IACpE,8DAA8D;IAC9D,qEAAqE;IACrE,gBAAgB;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,GAAiB,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,YAAY,GAAG,GAAG,cAAc,SAAS,CAAC;QAChD,MAAM,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;QACjE,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;QAC/D,OAAO;YACL,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW;YACpC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW;YACpC,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc;SAC3C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAYD,MAAM,aAAa;IACY;IAA7B,YAA6B,EAAe;QAAf,OAAE,GAAF,EAAE,CAAa;IAAG,CAAC;IAEhD,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;QACtE,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAiB;QAC3B,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IAC/D,CAAC;IAED,WAAW;QACT,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED,MAAM,OAAO,WAAW;IAEO;IAD7B,iDAAiD;IACjD,YAA6B,WAAmB,aAAa;QAAhC,aAAQ,GAAR,QAAQ,CAAwB;IAAG,CAAC;IAEjE,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACrD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAAyB,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC9D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAiB;QAC3B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAAyB,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,WAAW;QACT,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/tools/cancel.d.ts

@@ -0,0 +1,12 @@
+import { z } from "zod";
+import { type Tool } from "./index.js";
+declare const inputSchema: z.ZodObject<{
+    subscription_id: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    subscription_id: string;
+}, {
+    subscription_id: string;
+}>;
+export declare const cancelTool: Tool<z.infer<typeof inputSchema>>;
+export {};
+//# sourceMappingURL=cancel.d.ts.map

package/dist/tools/cancel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cancel.d.ts","sourceRoot":"","sources":["../../src/tools/cancel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAgB,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC;AAErD,QAAA,MAAM,WAAW;;;;;;EAEf,CAAC;AAiBH,eAAO,MAAM,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAaxD,CAAC"}

package/dist/tools/cancel.js

@@ -0,0 +1,34 @@
+import { z } from "zod";
+import { assertPaired } from "./index.js";
+const inputSchema = z.object({
+    subscription_id: z.string().min(1),
+});
+const DESCRIPTION = `Cancel one of the user's subscriptions. The user has pre-authorized
+cancellation in their spending policy (default confidence: low) so
+this completes without an approval prompt.
+
+WHEN TO CALL THIS TOOL:
+- The user explicitly asks to cancel a service
+- A migration / consolidation makes a subscription redundant
+
+BEHAVIOR:
+- Initiates the adapter's cancel flow asynchronously
+- Returns 202 immediately; poll list_subscriptions to confirm
+- Idempotent on subscription_id
+- In v0 the cancel flow is wired but the runtime's flow selector
+  doesn't pick the cancel flow yet — see chunk 11+ roadmap`;
+export const cancelTool = {
+    name: "cancel",
+    description: DESCRIPTION,
+    inputSchema,
+    jsonInputSchema: {
+        type: "object",
+        required: ["subscription_id"],
+        properties: { subscription_id: { type: "string" } },
+    },
+    async handler(args, api) {
+        assertPaired(api);
+        return api.cancelSubscription(args.subscription_id);
+    },
+};
+//# sourceMappingURL=cancel.js.map

package/dist/tools/cancel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cancel.js","sourceRoot":"","sources":["../../src/tools/cancel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAa,MAAM,YAAY,CAAC;AAErD,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG;;;;;;;;;;;;;2DAauC,CAAC;AAE5D,MAAM,CAAC,MAAM,UAAU,GAAsC;IAC3D,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,WAAW;IACxB,WAAW;IACX,eAAe,EAAE;QACf,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,iBAAiB,CAAC;QAC7B,UAAU,EAAE,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;KACpD;IACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG;QACrB,YAAY,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACtD,CAAC;CACF,CAAC"}

package/dist/tools/get-credential.d.ts

@@ -0,0 +1,15 @@
+import { z } from "zod";
+import { type Tool } from "./index.js";
+declare const inputSchema: z.ZodObject<{
+    reference: z.ZodString;
+    purpose: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    reference: string;
+    purpose: string;
+}, {
+    reference: string;
+    purpose: string;
+}>;
+export declare const getCredentialTool: Tool<z.infer<typeof inputSchema>>;
+export {};
+//# sourceMappingURL=get-credential.d.ts.map

package/dist/tools/get-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-credential.d.ts","sourceRoot":"","sources":["../../src/tools/get-credential.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAgB,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC;AAErD,QAAA,MAAM,WAAW;;;;;;;;;EAGf,CAAC;AAkBH,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAqB/D,CAAC"}