@zktx.io/sui-mcp 0.5.0

package/dist/core/session/settingsSessions.js

@@ -0,0 +1,45 @@
+import { cloneLocalSession, createLocalSessionBase, isLocalSessionExpired, tokenMatchesHash } from "./localSession.js";
+import { InMemoryKeyedRecordStore } from "./keyedRecordStore.js";
+export class SettingsSessionManager {
+    options;
+    sessions;
+    constructor(options) {
+        this.options = options;
+        this.sessions = options.recordStore ?? new InMemoryKeyedRecordStore();
+    }
+    async create(now) {
+        const { base, token } = createLocalSessionBase(now, this.options.ttlMs);
+        const session = {
+            ...base,
+            type: "local_settings"
+        };
+        this.sessions.set(session.id, session);
+        await this.options.appendEventLog({
+            type: "settings_session.created",
+            sessionId: session.id,
+            at: now.toISOString()
+        });
+        return { session: cloneLocalSession(session), token };
+    }
+    async get(id, now) {
+        const session = this.sessions.get(id);
+        if (!session) {
+            return undefined;
+        }
+        if (isLocalSessionExpired(session, now)) {
+            this.sessions.delete(id);
+            return undefined;
+        }
+        return cloneLocalSession(session);
+    }
+    async validateToken(id, token, now) {
+        const session = await this.get(id, now);
+        if (!session) {
+            return false;
+        }
+        return tokenMatchesHash(session.tokenHash, token);
+    }
+    clear() {
+        this.sessions.clear();
+    }
+}

package/dist/core/session/sqliteCardStore.js

@@ -0,0 +1,88 @@
+import { cardStateSchema, receiptDisplaySchema } from "./cardSession.js";
+export class SqliteCardRecordStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    hasReviewInput(reviewSessionId, ownerId, now) {
+        return !!this.db.prepare(`SELECT 1 FROM live_read_cards WHERE owner_id=? AND scope='review'
+      AND state='ready' AND accepted_input_json IS NULL AND expires_at>?
+      AND json_extract(input_json,'$.reviewSessionId')=? LIMIT 1`).get(ownerId, now.toISOString(), reviewSessionId);
+    }
+    get(id) {
+        const row = this.db.prepare("SELECT * FROM live_read_cards WHERE id = ?").get(id);
+        if (!row)
+            return undefined;
+        return {
+            state: cardStateSchema.parse({ cardId: row.id, kind: row.kind, state: row.state, revision: row.revision,
+                createdAt: row.created_at, expiresAt: row.expires_at, input: JSON.parse(row.input_json),
+                ...(row.reason === null ? {} : { reason: row.reason }), ...(row.error === null ? {} : { error: row.error }),
+                ...(row.result_json === null ? {} : { data: JSON.parse(row.result_json) }) }),
+            tokenHash: row.token_hash, ownerId: row.owner_id,
+            scope: row.scope, ...(row.operation_id === null ? {} : { operationId: row.operation_id }),
+            ...(row.accepted_input_json === null ? {} : { acceptedInput: JSON.parse(row.accepted_input_json) }),
+            ...(row.receipt_display_json === null ? {} : { receiptDisplay: receiptDisplaySchema.parse(JSON.parse(row.receipt_display_json)) })
+        };
+    }
+    evaluate(expected, clock) {
+        return this.db.transaction(() => {
+            const now = clock();
+            let record = this.get(expected.state.cardId);
+            if (!record || record.tokenHash !== expected.tokenHash || record.ownerId !== expected.ownerId)
+                throw new Error("Saved card access is unavailable.");
+            if (record.state.state === "ready" && Date.parse(record.state.expiresAt) <= now.getTime()) {
+                const next = { ...record, state: { ...record.state, state: "closed", reason: "expired", revision: record.state.revision + 1 } };
+                if (!this.replace(record, next))
+                    throw new Error("Card expiry could not be committed.");
+                record = next;
+            }
+            return { record, evaluatedAt: now.toISOString() };
+        }).immediate();
+    }
+    admit(expected, input, ownerId, clock) {
+        return this.db.transaction(() => {
+            const { record } = this.evaluate(expected, clock);
+            if (record.ownerId !== ownerId || record.state.state !== "ready" || record.acceptedInput !== undefined ||
+                record.state.revision !== expected.state.revision)
+                return undefined;
+            const next = { ...record, acceptedInput: input, state: { ...record.state, input,
+                    state: "running", revision: record.state.revision + 1 } };
+            if (!this.replace(record, next))
+                throw new Error("Card admission could not be committed.");
+            return next;
+        }).immediate();
+    }
+    create(record) {
+        this.db.prepare(`INSERT INTO live_read_cards
+      (id, owner_id, token_hash, kind, state, reason, error, revision, created_at, expires_at,
+       input_json, accepted_input_json, result_json, receipt_display_json, scope, operation_id)
+      VALUES (@id, @owner, @token, @kind, @state, @reason, @error, @revision, @created, @expires,
+       @input, @accepted, @result, @display, @scope, @operation)`).run(values(record));
+    }
+    replace(expected, next) {
+        // This single statement commits admission or a result atomically. A removed
+        // card is never recreated by a delayed network response.
+        return this.db.prepare(`UPDATE live_read_cards SET state=@state, reason=@reason, error=@error,
+      revision=@revision, input_json=@input, accepted_input_json=@accepted, result_json=@result,
+      receipt_display_json=@display, scope=@scope, operation_id=@operation
+      WHERE id=@id AND owner_id=@owner AND token_hash=@token AND revision=@expectedRevision
+        AND state=@expectedState`).run({ ...values(next), expectedRevision: expected.state.revision,
+            expectedState: expected.state.state }).changes === 1;
+    }
+    recover(ownerId, now) {
+        this.db.prepare(`UPDATE live_read_cards SET
+      reason=CASE WHEN state='ready' AND expires_at<=@now THEN 'expired' ELSE 'server_restarted' END,
+      state='closed', revision=revision+1, owner_id=@owner
+      WHERE state!='closed' AND owner_id!=@owner`).run({ owner: ownerId, now: now.toISOString() });
+    }
+}
+function values(record) {
+    const state = cardStateSchema.parse(record.state);
+    return { id: state.cardId, owner: record.ownerId, token: record.tokenHash, kind: state.kind,
+        scope: record.scope ?? "read", operation: record.operationId ?? null,
+        state: state.state, reason: state.reason ?? null, error: state.error ?? null, revision: state.revision,
+        created: state.createdAt, expires: state.expiresAt, input: JSON.stringify(state.input),
+        accepted: record.acceptedInput === undefined ? null : JSON.stringify(record.acceptedInput),
+        result: state.data === undefined ? null : JSON.stringify(state.data),
+        display: record.receiptDisplay === undefined ? null : JSON.stringify(receiptDisplaySchema.parse(record.receiptDisplay)) };
+}

package/dist/core/session/sqliteSessionStore.js

@@ -0,0 +1,213 @@
+import { isDeepStrictEqual } from "node:util";
+import { clonePrivateReviewArtifacts } from "./privateReviewArtifacts.js";
+import { LIVE_REVIEW_SESSION_WRITE_CONTRACT_VERSION } from "./liveReviewSessionContract.js";
+import { INITIAL_CHAIN_OBSERVATION_STATUSES } from "./transactionRequest.js";
+export function insertLiveReviewSessionRow(db, session) {
+    const serialized = serializeSessionForLiveReviewSessionRow(session);
+    db.prepare(`INSERT INTO live_review_sessions
+       (id, token_hash, status, account, owner_id, review_revision, preparation_id, preparation_error, wallet_connection_id, wallet_connection_revision, current_attempt_id,
+        plans_json, review_state_json,
+        created_at, expires_at, last_activity_at, revision, write_contract_version)
+     VALUES
+       (@id, @tokenHash, @status, @account, @ownerId, @reviewRevision, @preparationId, @preparationError, @walletConnectionId, @walletConnectionRevision, @currentAttemptId,
+        @plansJson, @reviewStateJson,
+        @createdAt, @expiresAt, @lastActivityAt, 0, @writeContractVersion)`).run(serialized);
+}
+export function updateLiveReviewSessionRow(db, expectedRevision, session) {
+    const serialized = serializeSessionForLiveReviewSessionRow(session);
+    const result = db
+        .prepare(`UPDATE live_review_sessions
+       SET token_hash = @tokenHash,
+           status = @status,
+           account = @account,
+           owner_id = @ownerId,
+           review_revision = @reviewRevision,
+           preparation_id = @preparationId,
+           preparation_error = @preparationError,
+           wallet_connection_id = @walletConnectionId,
+           wallet_connection_revision = @walletConnectionRevision,
+           current_attempt_id = @currentAttemptId,
+           plans_json = @plansJson,
+           review_state_json = @reviewStateJson,
+           created_at = @createdAt,
+           expires_at = @expiresAt,
+           last_activity_at = @lastActivityAt,
+           revision = revision + 1,
+           write_contract_version = @writeContractVersion
+       WHERE id = @id AND revision = @expectedRevision`)
+        .run({ ...serialized, expectedRevision });
+    return result.changes > 0;
+}
+/**
+ * SQLite-backed live review-session records. Runtime product transitions are
+ * committed by SqliteActivityStore when the store is created through that owner,
+ * so live session state and review activity stay in one SQLite transaction.
+ * Direct instances keep a low-level transition commit path for tests and mixed
+ * harnesses that do not couple live state with activity rows.
+ */
+export class SqliteSessionRecordStore {
+    db;
+    usesActivityStoreLiveSessionMutations;
+    constructor(db, options = {}) {
+        this.db = db;
+        this.usesActivityStoreLiveSessionMutations = options.usesActivityStoreLiveSessionMutations === true;
+    }
+    get(id) {
+        const row = this.db
+            .prepare(`SELECT * FROM live_review_sessions WHERE id = ?`)
+            .get(id);
+        return row ? sessionFromLiveReviewSessionRow(row) : undefined;
+    }
+    revision(id) { return this.getRow(id)?.revision; }
+    hasAdmittedRevision(id, reviewRevision) {
+        return !!this.db.prepare("SELECT 1 FROM review_requests WHERE review_session_id=? AND review_revision=?").get(id, reviewRevision);
+    }
+    create(id, session) {
+        if (this.getRow(id)) {
+            throw new Error(`Review session already exists: ${id}`);
+        }
+        insertLiveReviewSessionRow(this.db, session);
+    }
+    commitReviewSessionTransition(id, expected, next) {
+        const commit = this.db.transaction(() => {
+            const row = this.getRow(id);
+            if (!row || !isDeepStrictEqual(sessionFromLiveReviewSessionRow(row), expected)) {
+                return false;
+            }
+            return updateLiveReviewSessionRow(this.db, row.revision, next);
+        });
+        return commit.immediate();
+    }
+    ids() {
+        const rows = this.db.prepare(`SELECT id FROM live_review_sessions`).all();
+        return rows.map((row) => row.id);
+    }
+    clear() {
+        this.db.prepare(`DELETE FROM live_review_sessions`).run();
+    }
+    hasUnsettledRequest(id, now) {
+        return !!this.db.prepare(`SELECT 1 FROM live_request_authority l JOIN review_requests r ON r.attempt_id=l.attempt_id
+      WHERE r.review_session_id=? AND (l.sdk_pending=1 OR l.submit_pending=1 OR l.lookup_pending=1
+        OR (r.request_status IN (SELECT value FROM json_each(?)) AND (l.lookup_deadline IS NULL OR l.lookup_deadline>?))) LIMIT 1`)
+            .get(id, JSON.stringify(INITIAL_CHAIN_OBSERVATION_STATUSES), now.toISOString());
+    }
+    getRow(id) {
+        return this.db.prepare("SELECT * FROM live_review_sessions WHERE id=?").get(id);
+    }
+}
+export class SqlitePrivateReviewArtifactStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    get(reviewSessionId) {
+        const row = this.db
+            .prepare(`SELECT artifacts_json FROM live_private_review_artifacts WHERE review_session_id = ?`)
+            .get(reviewSessionId);
+        if (!row) {
+            return undefined;
+        }
+        // clonePrivateReviewArtifacts re-parses/validates the evidence on read, matching
+        // the in-memory store's clone-on-read behaviour.
+        return clonePrivateReviewArtifacts(JSON.parse(row.artifacts_json));
+    }
+    set(reviewSessionId, artifacts) {
+        const json = JSON.stringify(clonePrivateReviewArtifacts(artifacts));
+        this.db
+            .prepare(`INSERT INTO live_private_review_artifacts (review_session_id, artifacts_json)
+         VALUES (?, ?)
+         ON CONFLICT(review_session_id) DO UPDATE SET artifacts_json = excluded.artifacts_json`)
+            .run(reviewSessionId, json);
+    }
+    delete(reviewSessionId) {
+        this.db.prepare(`DELETE FROM live_private_review_artifacts WHERE review_session_id = ?`).run(reviewSessionId);
+    }
+    clear() {
+        this.db.prepare(`DELETE FROM live_private_review_artifacts`).run();
+    }
+}
+/**
+ * SQLite-backed id-keyed store for the short-lived settings
+ * session manager. Each record is a JSON blob keyed by id; the table name is a
+ * trusted constant supplied by the factories below (never user input).
+ */
+export class SqliteKeyedRecordStore {
+    db;
+    table;
+    revive;
+    constructor(db, table, revive) {
+        this.db = db;
+        this.table = table;
+        this.revive = revive;
+    }
+    get(id) {
+        const row = this.db
+            .prepare(`SELECT session_json FROM ${this.table} WHERE id = ?`)
+            .get(id);
+        return row ? this.revive(JSON.parse(row.session_json)) : undefined;
+    }
+    set(id, value) {
+        this.db
+            .prepare(`INSERT INTO ${this.table} (id, session_json) VALUES (?, ?)
+         ON CONFLICT(id) DO UPDATE SET session_json = excluded.session_json`)
+            .run(id, JSON.stringify(value));
+    }
+    delete(id) {
+        this.db.prepare(`DELETE FROM ${this.table} WHERE id = ?`).run(id);
+    }
+    ids() {
+        const rows = this.db.prepare(`SELECT id FROM ${this.table}`).all();
+        return rows.map((row) => row.id);
+    }
+    clear() {
+        this.db.prepare(`DELETE FROM ${this.table}`).run();
+    }
+}
+export function createSqliteSettingsRecordStore(db) {
+    return new SqliteKeyedRecordStore(db, "live_settings_sessions", (raw) => raw);
+}
+// Reconstruct the ReviewSession from columns + JSON blobs. Optional fields are
+// omitted (not set to undefined) so the shape matches the in-memory store exactly.
+export function sessionFromLiveReviewSessionRow(row) {
+    return {
+        id: row.id,
+        tokenHash: row.token_hash,
+        status: row.status,
+        createdAt: row.created_at,
+        expiresAt: row.expires_at,
+        lastActivityAt: row.last_activity_at,
+        plans: JSON.parse(row.plans_json),
+        ...(row.account === null ? {} : { account: row.account }),
+        ...(row.review_state_json === null
+            ? {}
+            : { reviewState: JSON.parse(row.review_state_json) }),
+        ownerId: row.owner_id,
+        reviewRevision: row.review_revision,
+        ...(row.wallet_connection_id === null ? {} : { walletConnectionId: row.wallet_connection_id }),
+        ...(row.wallet_connection_revision === null ? {} : { walletConnectionRevision: row.wallet_connection_revision }),
+        ...(row.preparation_error === null ? {} : { preparationError: row.preparation_error }),
+        ...(row.preparation_id === null ? {} : { preparationId: row.preparation_id }),
+        ...(row.current_attempt_id === null ? {} : { currentAttemptId: row.current_attempt_id })
+    };
+}
+export function serializeSessionForLiveReviewSessionRow(session) {
+    return {
+        id: session.id,
+        tokenHash: session.tokenHash,
+        status: session.status,
+        account: session.account ?? null,
+        ownerId: session.ownerId,
+        reviewRevision: session.reviewRevision,
+        preparationId: session.preparationId ?? null,
+        preparationError: session.preparationError ?? null,
+        walletConnectionId: session.walletConnectionId ?? null,
+        walletConnectionRevision: session.walletConnectionRevision ?? null,
+        currentAttemptId: session.currentAttemptId ?? null,
+        plansJson: JSON.stringify(session.plans),
+        reviewStateJson: session.reviewState ? JSON.stringify(session.reviewState) : null,
+        createdAt: session.createdAt,
+        expiresAt: session.expiresAt,
+        lastActivityAt: session.lastActivityAt,
+        writeContractVersion: LIVE_REVIEW_SESSION_WRITE_CONTRACT_VERSION
+    };
+}

package/dist/core/session/sqliteTransactionMaterialStore.js

@@ -0,0 +1,64 @@
+import { buildTransactionMaterialRecord, sameHandle, toMaterialHandle } from "./transactionMaterialStore.js";
+/**
+ * SQLite-backed transaction material store. Holds the same synchronous contract as
+ * InMemoryLocalTransactionMaterialStore so producers and the wallet handoff path are
+ * unchanged, but persists records (including the unsigned transaction BLOB) to the
+ * shared local database so any review-server process can read them. Validation,
+ * handle identity, and expiry semantics are shared via transactionMaterialStore.ts,
+ * so the two backends never drift. The unsigned bytes are protected at rest by the
+ * data directory (0700) and database file (0600) permissions set in SqliteActivityStore.
+ */
+export class SqliteTransactionMaterialStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    recordTransactionMaterial(input, now = new Date()) {
+        const record = buildTransactionMaterialRecord(input, now);
+        this.db
+            .prepare(`INSERT INTO live_transaction_materials
+           (material_id, review_session_id, plan_id, account, kind, source,
+            transaction_bytes, redacted_diagnostics_json, created_at, expires_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(record.materialId, record.reviewSessionId, record.planId, record.account, record.kind, record.source, Buffer.from(record.transactionBytes), record.redactedDiagnostics === undefined ? null : JSON.stringify(record.redactedDiagnostics), record.createdAt, record.expiresAt);
+        return toMaterialHandle(record);
+    }
+    getTransactionMaterial(handle, now = new Date()) {
+        const row = this.db
+            .prepare(`SELECT * FROM live_transaction_materials WHERE material_id = ?`)
+            .get(handle.materialId);
+        if (!row) {
+            return undefined;
+        }
+        if (Date.parse(row.expires_at) <= now.getTime()) {
+            this.db.prepare(`DELETE FROM live_transaction_materials WHERE material_id = ?`).run(handle.materialId);
+            return undefined;
+        }
+        const record = recordFromRow(row);
+        if (!sameHandle(record, handle)) {
+            return undefined;
+        }
+        return record;
+    }
+    deleteReviewSessionTransactionMaterials(reviewSessionId) {
+        this.db.prepare(`DELETE FROM live_transaction_materials WHERE review_session_id = ?`).run(reviewSessionId);
+    }
+}
+// Each read rebuilds a fresh record (new Uint8Array from the BLOB, parsed
+// diagnostics) so a caller mutating the result never touches the stored row.
+function recordFromRow(row) {
+    return {
+        materialId: row.material_id,
+        reviewSessionId: row.review_session_id,
+        planId: row.plan_id,
+        account: row.account,
+        kind: row.kind,
+        source: row.source,
+        createdAt: row.created_at,
+        expiresAt: row.expires_at,
+        transactionBytes: new Uint8Array(row.transaction_bytes),
+        ...(row.redacted_diagnostics_json == null
+            ? {}
+            : { redactedDiagnostics: JSON.parse(row.redacted_diagnostics_json) })
+    };
+}