botanary-mcp 0.1.0

package/dist/src/identity/backends/select.js

@@ -0,0 +1,34 @@
+import { createFileFallbackBackend } from './file-fallback.js';
+import { createLibsecretBackend } from './libsecret.js';
+import { createMacosKeychainBackend } from './macos-keychain.js';
+import { createWindowsDpapiBackend } from './windows-dpapi.js';
+/**
+ * Fixed, platform-derived priority order. The SAME list is used for reads and writes (store.ts): a new
+ * key is written to the first available candidate, and every candidate is swept in this order when
+ * looking for an existing one. `file-fallback` is always last and always available, so this list can
+ * never be empty and a caller can never end up with nowhere to store a key.
+ */
+export function defaultCandidates(platform = process.platform) {
+    switch (platform) {
+        case 'darwin':
+            return [createMacosKeychainBackend(), createFileFallbackBackend()];
+        case 'linux':
+            return [createLibsecretBackend(), createFileFallbackBackend()];
+        case 'win32':
+            return [createWindowsDpapiBackend(), createFileFallbackBackend()];
+        default:
+            return [createFileFallbackBackend()];
+    }
+}
+/** Pick the first available backend from `candidates`, in order. Used only to decide where a NEW key
+ *  gets written - see the KeyBackend interface doc for why reads don't use this. */
+export async function selectAvailable(candidates) {
+    for (const backend of candidates) {
+        if (await backend.isAvailable())
+            return backend;
+    }
+    // Unreachable in practice: every platform list above ends with file-fallback, which is always
+    // available. Guarded anyway so a future edit that removes that guarantee fails loudly, not silently.
+    throw new Error('no key storage backend available (file-fallback should always be present)');
+}
+//# sourceMappingURL=select.js.map

package/dist/src/identity/backends/select.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"select.js","sourceRoot":"","sources":["../../../../src/identity/backends/select.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAA4B,OAAO,CAAC,QAAQ;IAC5E,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,CAAC,0BAA0B,EAAE,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,KAAK,OAAO;YACV,OAAO,CAAC,sBAAsB,EAAE,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACjE,KAAK,OAAO;YACV,OAAO,CAAC,yBAAyB,EAAE,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACpE;YACE,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED;oFACoF;AACpF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAAwB;IAC5D,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,IAAI,MAAM,OAAO,CAAC,WAAW,EAAE;YAAE,OAAO,OAAO,CAAC;IAClD,CAAC;IACD,8FAA8F;IAC9F,qGAAqG;IACrG,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;AAC/F,CAAC"}

package/dist/src/identity/backends/types.js

@@ -0,0 +1,16 @@
+export class KeyBackendError extends Error {
+    backend;
+    operation;
+    constructor(backend, operation, message) {
+        super(`[${backend}] ${operation} failed: ${message}`);
+        this.backend = backend;
+        this.operation = operation;
+        this.name = 'KeyBackendError';
+    }
+}
+/** Fixed, non-secret names every real backend stores the identity under. There is exactly one agent
+ *  identity per machine by design (see README) - a multi-identity store is a bigger feature than this
+ *  package builds. */
+export const SERVICE_NAME = 'botanary-mcp';
+export const ACCOUNT_NAME = 'agent-identity';
+//# sourceMappingURL=types.js.map

package/dist/src/identity/backends/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/identity/backends/types.ts"],"names":[],"mappings":"AA6BA,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAEtB;IACA;IAFlB,YACkB,OAAe,EACf,SAA+C,EAC/D,OAAe;QAEf,KAAK,CAAC,IAAI,OAAO,KAAK,SAAS,YAAY,OAAO,EAAE,CAAC,CAAC;QAJtC,YAAO,GAAP,OAAO,CAAQ;QACf,cAAS,GAAT,SAAS,CAAsC;QAI/D,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;sBAEsB;AACtB,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAC3C,MAAM,CAAC,MAAM,YAAY,GAAG,gBAAgB,CAAC"}

package/dist/src/identity/backends/windows-dpapi.js

@@ -0,0 +1,89 @@
+import { dirname, join } from 'node:path';
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { nodeExec } from './exec.js';
+import { KeyBackendError } from './types.js';
+import { botanaryMcpHome } from '../../paths.js';
+import { redactSecret } from '../redact.js';
+// Windows has no scriptable equivalent of macOS's `security`/Linux's `secret-tool` that round-trips a
+// secret through the CLI: `cmdkey` can WRITE a Windows Credential Manager entry but deliberately gives
+// no way to read the password back out (by design - Credential Manager entries are meant to be
+// consumed by Windows components with a matching target, not read back by arbitrary scripts).
+//
+// The mechanism Credential Manager itself is built on IS scriptable, though: DPAPI
+// (`ProtectedData.Protect`/`Unprotect`, `DataProtectionScope.CurrentUser`), reachable from PowerShell
+// (built in on every Windows install, no extra dependency). This backend calls PowerShell to do only
+// the encrypt/decrypt step (the secret is piped to it over stdin, never passed as an argument, so it
+// never appears in argv/`Get-Process` output); Node does the file I/O, writing/reading the CIPHERTEXT
+// (base64) - so the file on disk holds only DPAPI-encrypted bytes tied to the current Windows user's
+// login, not a plaintext key. This is genuinely equivalent to what Credential Manager provides
+// (OS-mediated, per-user secret confidentiality), and meaningfully stronger than the plain 0600 file
+// fallback (whose POSIX permission bit is not something Node's `fs` can even express as a real ACL on
+// NTFS) - we call it out as its own backend rather than folding it into file-fallback for that reason.
+const PROTECT_SCRIPT = [
+    'Add-Type -AssemblyName System.Security',
+    '$text = [Console]::In.ReadToEnd()',
+    '$bytes = [System.Text.Encoding]::UTF8.GetBytes($text)',
+    '$protected = [System.Security.Cryptography.ProtectedData]::Protect($bytes, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)',
+    '[Console]::Out.Write([Convert]::ToBase64String($protected))',
+].join('\n');
+const UNPROTECT_SCRIPT = [
+    'Add-Type -AssemblyName System.Security',
+    '$b64 = [Console]::In.ReadToEnd()',
+    '$bytes = [Convert]::FromBase64String($b64)',
+    '$unprotected = [System.Security.Cryptography.ProtectedData]::Unprotect($bytes, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)',
+    '[Console]::Out.Write([System.Text.Encoding]::UTF8.GetString($unprotected))',
+].join('\n');
+const PS_ARGS = ['-NoProfile', '-NonInteractive', '-Command'];
+function defaultFilePath() {
+    return join(botanaryMcpHome(), 'identity.dpapi');
+}
+export function createWindowsDpapiBackend(exec = nodeExec, filePath = defaultFilePath()) {
+    return {
+        id: 'windows-dpapi',
+        label: 'Windows credential storage (DPAPI, current user)',
+        async isAvailable() {
+            if (process.platform !== 'win32')
+                return false;
+            try {
+                const r = await exec('powershell', [...PS_ARGS, 'Write-Output ok']);
+                return r.code === 0 && r.stdout.trim() === 'ok';
+            }
+            catch {
+                return false;
+            }
+        },
+        async save(secret) {
+            const r = await exec('powershell', [...PS_ARGS, PROTECT_SCRIPT], { input: secret });
+            if (r.code !== 0 || !r.stdout.trim()) {
+                // PowerShell doesn't echo stdin back on error, but redact defensively anyway - see libsecret.ts.
+                throw new KeyBackendError('windows-dpapi', 'save', redactSecret(r.stderr || `exit ${r.code}`, secret));
+            }
+            await mkdir(dirname(filePath), { recursive: true, mode: 0o700 });
+            // The file holds DPAPI ciphertext, not the secret - 0600 here is extra caution, not the primary
+            // protection (DPAPI itself is what makes the content unreadable off this Windows account).
+            await writeFile(filePath, r.stdout.trim(), { encoding: 'utf8', mode: 0o600 });
+        },
+        async load() {
+            let ciphertext;
+            try {
+                ciphertext = (await readFile(filePath, 'utf8')).trim();
+            }
+            catch (e) {
+                if (e.code === 'ENOENT')
+                    return null;
+                throw new KeyBackendError('windows-dpapi', 'load', e.message);
+            }
+            if (!ciphertext)
+                return null;
+            const r = await exec('powershell', [...PS_ARGS, UNPROTECT_SCRIPT], { input: ciphertext });
+            if (r.code !== 0) {
+                throw new KeyBackendError('windows-dpapi', 'load', r.stderr || `exit ${r.code}`);
+            }
+            return r.stdout.trim();
+        },
+        async delete() {
+            await rm(filePath, { force: true });
+        },
+    };
+}
+//# sourceMappingURL=windows-dpapi.js.map

package/dist/src/identity/backends/windows-dpapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows-dpapi.js","sourceRoot":"","sources":["../../../../src/identity/backends/windows-dpapi.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAa,QAAQ,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAmB,eAAe,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,sGAAsG;AACtG,uGAAuG;AACvG,+FAA+F;AAC/F,8FAA8F;AAC9F,EAAE;AACF,mFAAmF;AACnF,sGAAsG;AACtG,qGAAqG;AACrG,qGAAqG;AACrG,sGAAsG;AACtG,qGAAqG;AACrG,+FAA+F;AAC/F,qGAAqG;AACrG,sGAAsG;AACtG,uGAAuG;AACvG,MAAM,cAAc,GAAG;IACrB,wCAAwC;IACxC,mCAAmC;IACnC,uDAAuD;IACvD,oJAAoJ;IACpJ,6DAA6D;CAC9D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,gBAAgB,GAAG;IACvB,wCAAwC;IACxC,kCAAkC;IAClC,4CAA4C;IAC5C,wJAAwJ;IACxJ,4EAA4E;CAC7E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC;AAE9D,SAAS,eAAe;IACtB,OAAO,IAAI,CAAC,eAAe,EAAE,EAAE,gBAAgB,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAa,QAAQ,EAAE,WAAmB,eAAe,EAAE;IACnG,OAAO;QACL,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,kDAAkD;QAEzD,KAAK,CAAC,WAAW;YACf,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,GAAG,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;gBACpE,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,MAAc;YACvB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,GAAG,OAAO,EAAE,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACpF,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACrC,iGAAiG;gBACjG,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;YACzG,CAAC;YACD,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,gGAAgG;YAChG,2FAA2F;YAC3F,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,KAAK,CAAC,IAAI;YACR,IAAI,UAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,UAAU,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACzD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBAChE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;YAC7B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,GAAG,OAAO,EAAE,gBAAgB,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1F,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACjB,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,MAAM;YACV,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/identity/fingerprint.js

@@ -0,0 +1,47 @@
+import { randomBytes } from 'node:crypto';
+import { hexToBytes } from 'viem';
+// Crockford Base32: 32 symbols, excludes I/L/O/U so nothing is ambiguous when read aloud or typed by
+// hand (no risk of confusing 0/O, 1/I/L), case-insensitive by convention. This is the same alphabet
+// family used by ULIDs and plenty of other human-facing codes for exactly this reason.
+const ALPHABET = '0123456789ABCDEFGHJKMNPQRSTVWXYZ';
+/** Encode `bytes` as Crockford Base32. Not meant to round-trip (no decoder here, and slicing the
+ *  result to a shorter display length - see below - deliberately drops the tail) - this is a display
+ *  transform for short human-facing codes, not a data-interchange encoding. */
+export function crockfordBase32(bytes) {
+    let bitBuffer = 0;
+    let bitCount = 0;
+    let output = '';
+    for (const byte of bytes) {
+        bitBuffer = (bitBuffer << 8) | byte;
+        bitCount += 8;
+        while (bitCount >= 5) {
+            output += ALPHABET[(bitBuffer >>> (bitCount - 5)) & 0x1f];
+            bitCount -= 5;
+        }
+    }
+    if (bitCount > 0) {
+        output += ALPHABET[(bitBuffer << (5 - bitCount)) & 0x1f];
+    }
+    return output;
+}
+/** Bytes of address fingerprint / pairing nonce - chosen for "short to type" over "cryptographically
+ *  weighty", since neither is a secret (see README's "why intercepting the code alone grants nothing").
+ *  FINGERPRINT_BYTES: ~24 bits, purely a human recognition aid - the full address is always available
+ *  via get_identity for exact verification, so collisions here cost nothing but a moment's "hm, two
+ *  agents look similar", not a security property.
+ *  NONCE_BYTES: ~40 bits of fresh randomness per pairing code, the thing that actually makes each code
+ *  single-use in practice (combined with the short TTL - see pairing-code.ts). */
+export const FINGERPRINT_BYTES = 3;
+export const NONCE_BYTES = 5;
+/** A short, deterministic, human-typable id for an address - always the same for the same address.
+ *  Purely a display/recognition aid (see module doc); the address itself is the real identifier. */
+export function deriveFingerprint(address) {
+    const bytes = hexToBytes(address);
+    return crockfordBase32(bytes.slice(0, FINGERPRINT_BYTES));
+}
+/** A fresh random nonce for one pairing code. Never derived from the key - pure randomness, so a new
+ *  call can never be predicted from a previous one. */
+export function generatePairingNonce() {
+    return crockfordBase32(randomBytes(NONCE_BYTES));
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/src/identity/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../../src/identity/fingerprint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAGlC,qGAAqG;AACrG,oGAAoG;AACpG,uFAAuF;AACvF,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AAEpD;;+EAE+E;AAC/E,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,SAAS,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QACpC,QAAQ,IAAI,CAAC,CAAC;QACd,OAAO,QAAQ,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,QAAQ,CAAC,CAAC,SAAS,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1D,QAAQ,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;kFAMkF;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AACnC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC;AAE7B;oGACoG;AACpG,MAAM,UAAU,iBAAiB,CAAC,OAAY;IAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;uDACuD;AACvD,MAAM,UAAU,oBAAoB;IAClC,OAAO,eAAe,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;AACnD,CAAC"}

package/dist/src/identity/keypair.js

@@ -0,0 +1,40 @@
+import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts';
+/** A fresh, cryptographically random secp256k1 keypair. Never logged, never returned from any tool -
+ *  see store.ts, which is the only place this function is called from. */
+export function generateKeypair() {
+    const privateKey = generatePrivateKey();
+    return keypairFromPrivateKey(privateKey);
+}
+export function keypairFromPrivateKey(privateKey) {
+    const account = privateKeyToAccount(privateKey);
+    return { privateKey, address: account.address, publicKey: account.publicKey };
+}
+/**
+ * EIP-191 personal-message signature ("\x19Ethereum Signed Message:\n" + len + message) - the standard
+ * proof-of-possession primitive: "I hold the private key behind this address" without exposing it.
+ * Available for a caller that genuinely wants to sign arbitrary human-readable text (`IdentityStore.sign`,
+ * used directly by a couple of tests below). NOT what pairing/session/spend signing uses - see
+ * `signHashWithPrivateKey`.
+ */
+export async function signMessageWithPrivateKey(privateKey, message) {
+    const account = privateKeyToAccount(privateKey);
+    return account.signMessage({ message });
+}
+/**
+ * Raw ECDSA signature over an EXACT 32-byte hash - no EIP-191 prefix, no re-hashing. This is what the
+ * backend actually verifies for every proof-of-possession this package produces:
+ * `agents.service.ts`'s `pair()`/`mintSession()` both recover via `recoverPublicKey({ hash, signature })`
+ * over the raw hash, and Smart Sessions' USE-mode envelope (`AgentRuntime.spendUnderGrant`) packs a raw
+ * signature next to the permissionId for the SAME reason - neither one wraps or re-hashes first.
+ *
+ * `signMessageWithPrivateKey` (EIP-191) is the wrong primitive for any of the three: signing a hash
+ * through it re-hashes `keccak256("\x19Ethereum Signed Message:\n32" + hash)` and signs THAT instead,
+ * producing a signature that recovers to a completely different (still valid-looking) result - wrong
+ * silently, never with an error, which is exactly the shape of bug this package's whole reason for
+ * existing (verifiable proof-of-possession) cannot afford.
+ */
+export async function signHashWithPrivateKey(privateKey, hash) {
+    const account = privateKeyToAccount(privateKey);
+    return account.sign({ hash });
+}
+//# sourceMappingURL=keypair.js.map

package/dist/src/identity/keypair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keypair.js","sourceRoot":"","sources":["../../../src/identity/keypair.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAmBxE;0EAC0E;AAC1E,MAAM,UAAU,eAAe;IAC7B,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;IACxC,OAAO,qBAAqB,CAAC,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,UAAe;IACnD,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAChD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;AAChF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,UAAe,EAAE,OAAe;IAC9E,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,UAAe,EAAE,IAAS;IACrE,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AAChC,CAAC"}

package/dist/src/identity/pairing-code.js

@@ -0,0 +1,60 @@
+import { generatePairingNonce } from './fingerprint.js';
+/** 10 minutes: long enough to alt-tab to the Botanary app and type ~13 characters, short enough that a
+ *  code nobody redeemed stops being worth anything on its own quickly. See README for the full
+ *  "why intercepting the code alone grants nothing" argument - the TTL is one layer of it, not the
+ *  whole thing. */
+export const DEFAULT_PAIRING_CODE_TTL_MS = 10 * 60 * 1000;
+/**
+ * Owns exactly one pairing attempt at a time for this process, keyed off a fixed address fingerprint.
+ * `current()` is idempotent while the code is still valid - Flow 7d step 1 is "the agent ... shows the
+ * short code, and waits", which only makes sense if the code stays put while the owner is busy typing
+ * it, rather than rotating out from under them on every tool call. It mints automatically once the
+ * previous code expires, and `regenerate()` lets the owner (via the agent) burn a code early - e.g. if
+ * they suspect it was seen by someone else - without waiting out the TTL.
+ *
+ * Deliberately in-memory only: a pairing code is not part of the identity (see store.ts) and is not
+ * meant to survive a restart - a fresh process showing a fresh code is the correct behavior, not a bug.
+ */
+export class PairingCodeManager {
+    #fingerprint;
+    #ttlMs;
+    #now;
+    #nonce;
+    #current = null;
+    constructor(fingerprint, options) {
+        this.#fingerprint = fingerprint;
+        this.#ttlMs = options?.ttlMs ?? DEFAULT_PAIRING_CODE_TTL_MS;
+        this.#now = options?.now ?? Date.now;
+        this.#nonce = options?.nonce ?? generatePairingNonce;
+    }
+    /** The active code, minting a fresh one if there is none yet or the previous one expired. */
+    current() {
+        const t = this.#now();
+        if (!this.#current || this.#current.expiresAt <= t) {
+            this.#mint(t);
+        }
+        return this.#toPublic();
+    }
+    /** Always mints a fresh code, invalidating whatever was active. */
+    regenerate() {
+        this.#mint(this.#now());
+        return this.#toPublic();
+    }
+    #mint(t) {
+        this.#current = { nonce: this.#nonce(), issuedAt: t, expiresAt: t + this.#ttlMs };
+    }
+    #toPublic() {
+        const c = this.#current;
+        /* istanbul ignore next -- #mint always runs first in both call sites above */
+        if (!c)
+            throw new Error('unreachable: no pairing code minted');
+        return {
+            code: `${this.#fingerprint}-${c.nonce}`,
+            fingerprint: this.#fingerprint,
+            nonce: c.nonce,
+            issuedAt: new Date(c.issuedAt).toISOString(),
+            expiresAt: new Date(c.expiresAt).toISOString(),
+        };
+    }
+}
+//# sourceMappingURL=pairing-code.js.map

package/dist/src/identity/pairing-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing-code.js","sourceRoot":"","sources":["../../../src/identity/pairing-code.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD;;;mBAGmB;AACnB,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAa1D;;;;;;;;;;GAUG;AACH,MAAM,OAAO,kBAAkB;IACpB,YAAY,CAAS;IACrB,MAAM,CAAS;IACf,IAAI,CAAe;IACnB,MAAM,CAAe;IAC9B,QAAQ,GAAkE,IAAI,CAAC;IAE/E,YACE,WAAmB,EACnB,OAMC;QAED,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,KAAK,IAAI,2BAA2B,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,KAAK,IAAI,oBAAoB,CAAC;IACvD,CAAC;IAED,6FAA6F;IAC7F,OAAO;QACL,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED,mEAAmE;IACnE,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,CAAS;QACb,IAAI,CAAC,QAAQ,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IACpF,CAAC;IAED,SAAS;QACP,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QACxB,8EAA8E;QAC9E,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC/D,OAAO;YACL,IAAI,EAAE,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,KAAK,EAAE;YACvC,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;YAC5C,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;SAC/C,CAAC;IACJ,CAAC;CACF"}

package/dist/src/identity/redact.js

@@ -0,0 +1,21 @@
+// Defense in depth for the one invariant this whole package exists to protect: the private key must
+// never appear in anything that leaves this process's control - a log line, an error message, a
+// crash report. Nothing here is the PRIMARY guarantee (that's the type boundary in store.ts, which
+// never returns the key from any public method) - this is the belt under that belt, in case a raw
+// error from a shelled-out OS command (security/secret-tool/powershell) ever happened to echo back
+// something it was given on argv or stdin.
+/**
+ * Replace every exact occurrence of `secret` in `text` with a fixed placeholder. Safe to call with an
+ * empty/undefined secret (a no-op) so call sites never need their own guard.
+ */
+export function redactSecret(text, secret) {
+    if (!secret)
+        return text;
+    return text.split(secret).join('«redacted»');
+}
+/** Same, but for a value that might not be a string yet (an Error, an unknown thrown value, ...). */
+export function redactUnknown(value, secret) {
+    const text = value instanceof Error ? (value.stack ?? value.message) : String(value);
+    return redactSecret(text, secret);
+}
+//# sourceMappingURL=redact.js.map

package/dist/src/identity/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../../src/identity/redact.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,gGAAgG;AAChG,mGAAmG;AACnG,kGAAkG;AAClG,mGAAmG;AACnG,2CAA2C;AAE3C;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAiC;IAC1E,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,MAAiC;IAC7E,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrF,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC"}

package/dist/src/identity/store.js

@@ -0,0 +1,249 @@
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { publicMetadataPath } from '../paths.js';
+import { deriveFingerprint } from './fingerprint.js';
+import { generateKeypair, keypairFromPrivateKey, signHashWithPrivateKey, signMessageWithPrivateKey, } from './keypair.js';
+import { redactSecret } from './redact.js';
+export class IdentityCorruptError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'IdentityCorruptError';
+    }
+}
+export class IdentityMissingKeyError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'IdentityMissingKeyError';
+    }
+}
+export class IdentityMismatchError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'IdentityMismatchError';
+    }
+}
+/**
+ * The one boundary the private key ever crosses out of storage. Orchestrates:
+ *  - the non-secret public metadata file (address/publicKey/fingerprint/createdAt/backend) - read on
+ *    every `ensure()`/`get_identity` call, which therefore NEVER touches the keychain;
+ *  - the KeyBackend candidates (see backends/) - only touched by `sign()` (loads) and `#createNew()`/
+ *    `forget()` (save/delete). No method here caches the private key on `this`; it is read fresh for
+ *    each `sign()` call and let go out of scope immediately after.
+ *
+ * Two invariants worth stating explicitly, because they are the whole security story of this class:
+ *  1. A new key is written to exactly ONE backend - the first available candidate - never a second
+ *     "just in case" copy anywhere else. See #saveToFirstAvailable.
+ *  2. Reads never invent a replacement key. If metadata exists but no backend holds the matching
+ *     secret (deleted - see acceptance test "delete the agent's key on its own machine"), or the
+ *     backend's secret doesn't match the metadata's address, this throws rather than silently
+ *     generating a new identity that would orphan whatever grant the old address held.
+ */
+export class IdentityStore {
+    #candidates;
+    #metadataPath;
+    #keypairFactory;
+    constructor(candidates, options) {
+        if (candidates.length === 0)
+            throw new Error('IdentityStore needs at least one KeyBackend candidate');
+        this.#candidates = candidates;
+        this.#metadataPath = options?.metadataPath ?? publicMetadataPath();
+        this.#keypairFactory = options?.keypairFactory ?? generateKeypair;
+    }
+    async hasIdentity() {
+        return (await this.#readMetadata()) !== null;
+    }
+    /** Load the existing identity, or create one on first run. */
+    async ensure() {
+        const metadata = await this.#readMetadata();
+        if (metadata)
+            return toIdentity(metadata);
+        return this.#createNew();
+    }
+    /** Sign `message` as an EIP-191 personal message with the agent's private key. One of two methods on
+     *  this class that ever hold the key in a local variable (the other is `signHash`). */
+    async sign(message) {
+        const metadata = await this.#readMetadata();
+        if (!metadata) {
+            throw new Error('no agent identity yet - call ensure() (or the get_identity tool) first');
+        }
+        const privateKey = await this.#loadSecretForSigning(metadata);
+        return signMessageWithPrivateKey(privateKey, message);
+    }
+    /** Sign a 32-byte hash directly - raw ECDSA, no EIP-191 prefix. What `pair()`, `mintSession()`, and
+     *  `spendUnderGrant()`'s USE-mode envelope all actually need - see `signHashWithPrivateKey`'s doc
+     *  comment for why `sign()` above would silently produce the WRONG signature for any of them. */
+    async signHash(hash) {
+        const metadata = await this.#readMetadata();
+        if (!metadata) {
+            throw new Error('no agent identity yet - call ensure() (or the get_identity tool) first');
+        }
+        const privateKey = await this.#loadSecretForSigning(metadata);
+        return signHashWithPrivateKey(privateKey, hash);
+    }
+    /**
+     * Deletes the private key from EVERY backend candidate (not only whichever one metadata says holds
+     * it - a clean slate regardless of any drift) and clears the public metadata. This is the mechanism
+     * behind acceptance test §5-46: after this resolves, `hasIdentity()` is false and `sign()` throws -
+     * there is nothing left, anywhere on this machine, that can produce a signature for the old address.
+     * The grant a backend may still have on file for that address is untouched by this call - it was
+     * never this machine's to revoke (see README).
+     */
+    async forget() {
+        const errors = [];
+        for (const backend of this.#candidates) {
+            try {
+                await backend.delete();
+            }
+            catch (e) {
+                errors.push(e);
+            }
+        }
+        await rm(this.#metadataPath, { force: true });
+        if (errors.length > 0 && errors.length === this.#candidates.length) {
+            throw new AggregateError(errors, 'failed to delete the agent key from every backend');
+        }
+    }
+    /**
+     * Test-only accessor, so `no-leak.spec.ts` can assert that the exact secret never appears in an
+     * outbound request. GUARDED AT RUNTIME rather than by this comment: the whole point of this package
+     * is that the key never leaves the machine, and a doc-comment "never used in production" on a public
+     * method that hands out the raw private key is an instruction away from being untrue - an injected
+     * prompt reaching the runtime would only have to call it.
+     */
+    async exportForTest() {
+        if (!process.env.VITEST && process.env.NODE_ENV !== 'test') {
+            throw new Error('exportForTest is available only under the test runner.');
+        }
+        const metadata = await this.#readMetadata();
+        if (!metadata) {
+            throw new Error('no agent identity yet');
+        }
+        const privateKey = await this.#loadSecretForSigning(metadata);
+        return { privateKey };
+    }
+    async #createNew() {
+        const keypair = this.#keypairFactory();
+        const createdAt = new Date().toISOString();
+        const payload = { v: 1, privateKey: keypair.privateKey, createdAt };
+        const backend = await this.#saveToFirstAvailable(payload, keypair.privateKey);
+        const metadata = {
+            v: 1,
+            address: keypair.address,
+            publicKey: keypair.publicKey,
+            fingerprint: deriveFingerprint(keypair.address),
+            createdAt,
+            backend: backend.id,
+        };
+        await this.#writeMetadata(metadata);
+        return toIdentity(metadata);
+    }
+    /** Tries candidates in order and writes to the FIRST one that is available and accepts the save -
+     *  and stops there. Only advances to the next candidate if the previous one actually failed (probe
+     *  said available, save still errored), never as a redundant backup of a successful save. */
+    async #saveToFirstAvailable(payload, privateKey) {
+        const secret = JSON.stringify(payload);
+        let lastError;
+        for (const backend of this.#candidates) {
+            if (!(await backend.isAvailable()))
+                continue;
+            try {
+                await backend.save(secret);
+                return backend;
+            }
+            catch (e) {
+                lastError = e;
+            }
+        }
+        const detail = redactSecret(lastError instanceof Error ? lastError.message : String(lastError), privateKey);
+        throw new Error(`could not save the agent key to any storage backend: ${detail}`);
+    }
+    /** Sweeps every candidate in priority order for an existing secret. Distinguishes "nothing here"
+     *  (keep going) from "this backend errored" (also keep going, but the error is kept so a fully-empty
+     *  sweep can explain itself instead of just saying "not found" when something was actually broken). */
+    async #loadFromAnyBackend() {
+        const backendErrors = [];
+        for (const backend of this.#candidates) {
+            let raw;
+            try {
+                raw = await backend.load();
+            }
+            catch (e) {
+                backendErrors.push({ backendId: backend.id, message: e instanceof Error ? e.message : String(e) });
+                continue;
+            }
+            if (raw === null)
+                continue;
+            const payload = parseSecret(raw);
+            if (payload)
+                return { found: { backend, payload }, backendErrors };
+        }
+        return { found: null, backendErrors };
+    }
+    async #loadSecretForSigning(metadata) {
+        const { found, backendErrors } = await this.#loadFromAnyBackend();
+        if (!found) {
+            const hint = backendErrors.length > 0
+                ? ` (${backendErrors.map((e) => `${e.backendId}: ${e.message}`).join('; ')})`
+                : '';
+            throw new IdentityMissingKeyError(`identity metadata exists (address ${metadata.address}) but no backend holds its private key${hint} - ` +
+                'it may have been deleted (directly via the OS keychain, or via "botanary-mcp forget"). Run ' +
+                '"botanary-mcp forget" to clear stale metadata and let a fresh identity be created on next use, ' +
+                'or restore the key if you still have it.');
+        }
+        const keypair = keypairFromPrivateKey(found.payload.privateKey);
+        if (keypair.address.toLowerCase() !== metadata.address.toLowerCase()) {
+            throw new IdentityMismatchError(`the key found in ${found.backend.label} does not match the stored identity (expected ` +
+                `${metadata.address}, found a key for ${keypair.address}) - refusing to sign with it.`);
+        }
+        return keypair.privateKey;
+    }
+    async #readMetadata() {
+        let raw;
+        try {
+            raw = await readFile(this.#metadataPath, 'utf8');
+        }
+        catch (e) {
+            if (e.code === 'ENOENT')
+                return null;
+            throw e;
+        }
+        const parsed = parseMetadata(raw);
+        if (parsed)
+            return parsed;
+        throw new IdentityCorruptError(`${this.#metadataPath} exists but could not be read as agent identity metadata. Back it up and ` +
+            'remove it (or run "botanary-mcp forget") before continuing - refusing to silently overwrite it ' +
+            'with a new identity.');
+    }
+    async #writeMetadata(metadata) {
+        await mkdir(dirname(this.#metadataPath), { recursive: true });
+        await writeFile(this.#metadataPath, `${JSON.stringify(metadata, null, 2)}\n`, 'utf8');
+    }
+}
+function toIdentity(metadata) {
+    return {
+        address: metadata.address,
+        publicKey: metadata.publicKey,
+        fingerprint: metadata.fingerprint,
+        createdAt: metadata.createdAt,
+        backend: metadata.backend,
+    };
+}
+function parseSecret(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        return parsed && parsed.v === 1 && typeof parsed.privateKey === 'string' ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function parseMetadata(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        return parsed && parsed.v === 1 && typeof parsed.address === 'string' ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/src/identity/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/identity/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EACL,eAAe,EAEf,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAOD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,aAAa;IACf,WAAW,CAAe;IAC1B,aAAa,CAAS;IACtB,eAAe,CAAgB;IAExC,YAAY,UAAwB,EAAE,OAA8B;QAClE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACtG,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;QAC9B,IAAI,CAAC,aAAa,GAAG,OAAO,EAAE,YAAY,IAAI,kBAAkB,EAAE,CAAC;QACnE,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,cAAc,IAAI,eAAe,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,KAAK,IAAI,CAAC;IAC/C,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,MAAM;QACV,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC5C,IAAI,QAAQ;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;IAC3B,CAAC;IAED;2FACuF;IACvF,KAAK,CAAC,IAAI,CAAC,OAAe;QACxB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC9D,OAAO,yBAAyB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;qGAEiG;IACjG,KAAK,CAAC,QAAQ,CAAC,IAAS;QACtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC9D,OAAO,sBAAsB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;YACzB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YACnE,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,mDAAmD,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC9D,OAAO,EAAE,UAAU,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAkB,EAAE,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;QACnF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAuB;YACnC,CAAC,EAAE,CAAC;YACJ,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC;YAC/C,SAAS;YACT,OAAO,EAAE,OAAO,CAAC,EAAE;SACpB,CAAC;QACF,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED;;iGAE6F;IAC7F,KAAK,CAAC,qBAAqB,CAAC,OAAsB,EAAE,UAAe;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,SAAkB,CAAC;QACvB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACvC,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;gBAAE,SAAS;YAC7C,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC3B,OAAO,OAAO,CAAC;YACjB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,SAAS,GAAG,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;QAC5G,MAAM,IAAI,KAAK,CAAC,wDAAwD,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC;IAED;;2GAEuG;IACvG,KAAK,CAAC,mBAAmB;QAIvB,MAAM,aAAa,GAAkD,EAAE,CAAC;QACxE,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACvC,IAAI,GAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,aAAa,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACnG,SAAS;YACX,CAAC;YACD,IAAI,GAAG,KAAK,IAAI;gBAAE,SAAS;YAC3B,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,OAAO;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,QAA4B;QACtD,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,GACR,aAAa,CAAC,MAAM,GAAG,CAAC;gBACtB,CAAC,CAAC,KAAK,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAC7E,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,IAAI,uBAAuB,CAC/B,qCAAqC,QAAQ,CAAC,OAAO,yCAAyC,IAAI,KAAK;gBACrG,6FAA6F;gBAC7F,iGAAiG;gBACjG,0CAA0C,CAC7C,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAChE,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YACrE,MAAM,IAAI,qBAAqB,CAC7B,oBAAoB,KAAK,CAAC,OAAO,CAAC,KAAK,gDAAgD;gBACrF,GAAG,QAAQ,CAAC,OAAO,qBAAqB,OAAO,CAAC,OAAO,+BAA+B,CACzF,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC,UAAU,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAChE,MAAM,CAAC,CAAC;QACV,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAC5B,GAAG,IAAI,CAAC,aAAa,2EAA2E;YAC9F,iGAAiG;YACjG,sBAAsB,CACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAA4B;QAC/C,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxF,CAAC;CACF;AAED,SAAS,UAAU,CAAC,QAA4B;IAC9C,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;QACzD,OAAO,MAAM,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAwB,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgC,CAAC;QAC9D,OAAO,MAAM,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAE,MAA6B,CAAC,CAAC,CAAC,IAAI,CAAC;IAChH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/src/identity/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/identity/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/identity/types.ts"],"names":[],"mappings":""}

package/dist/src/paths.js

@@ -0,0 +1,22 @@
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/**
+ * Root directory for everything this package writes locally: the non-secret public identity metadata
+ * (identity.json) always, plus - only when no OS keychain/libsecret/DPAPI is available - the file
+ * fallback's 0600 secret file. `BOTANARY_MCP_HOME` is an escape hatch for tests and for running this
+ * server inside a container/CI box with an isolated home; it is not something a normal install needs
+ * to set.
+ */
+export function botanaryMcpHome() {
+    return process.env.BOTANARY_MCP_HOME || join(homedir(), '.botanary-mcp');
+}
+/** Public, non-secret identity metadata: address, public key, fingerprint, createdAt, which backend
+ *  holds the private key. Safe to read on every tool call - loading it never touches the keychain. */
+export function publicMetadataPath() {
+    return join(botanaryMcpHome(), 'identity.json');
+}
+/** Where the file-fallback backend stores the secret when no OS keychain is available. 0600. */
+export function fileFallbackSecretPath() {
+    return join(botanaryMcpHome(), 'identity.key');
+}
+//# sourceMappingURL=paths.js.map