neozip-mcp 0.1.0-beta

package/dist/archive/identity-key.js

@@ -0,0 +1,176 @@
+import * as crypto from "node:crypto";
+import { Wallet } from "ethers";
+import { WRAP_AEAD, WRAP_FORMAT_VERSION, WRAP_IV_LEN, WRAP_KDF_INFO, WRAP_KDF_SALT_LEN, X25519_SPKI_PREFIX, } from "../constants/wallet-identity.js";
+import { fetchCryptoSelf } from "./crypto-self.js";
+import { resolveTokenServiceBaseUrl } from "./recipient-lookup.js";
+export class IdentityKeyTamperError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "IdentityKeyTamperError";
+    }
+}
+export class IdentityKeyVersionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "IdentityKeyVersionError";
+    }
+}
+function buildCanonicalAad(params) {
+    const lowerAddr = params.evmAddress.toLowerCase();
+    const addrBytes = Buffer.from(lowerAddr, "ascii");
+    if (params.x25519SpkiDer.length !== 44) {
+        throw new Error(`Unexpected SPKI DER length ${params.x25519SpkiDer.length}, expected 44 bytes`);
+    }
+    return Buffer.concat([
+        addrBytes,
+        Buffer.from([WRAP_FORMAT_VERSION]),
+        params.x25519SpkiDer,
+    ]);
+}
+function deriveKek(rawEoaPrivBytes, saltB64) {
+    if (rawEoaPrivBytes.length !== 32) {
+        throw new Error("EOA private key must be 32 bytes");
+    }
+    const salt = Buffer.from(saltB64, "base64");
+    if (salt.length !== WRAP_KDF_SALT_LEN) {
+        throw new Error(`Wrap KDF salt must be ${WRAP_KDF_SALT_LEN} bytes`);
+    }
+    const okm = crypto.hkdfSync("sha256", rawEoaPrivBytes, salt, WRAP_KDF_INFO, 32);
+    return Buffer.from(okm);
+}
+function pkcs8FromRaw(rawPriv) {
+    const prefix = Buffer.from("302e020100300506032b656e04200420", "hex");
+    return Buffer.concat([prefix, rawPriv]);
+}
+export function unwrapX25519PrivateKey(params) {
+    const { bundle } = params;
+    if (bundle.wrapFormatVersion !== WRAP_FORMAT_VERSION) {
+        throw new IdentityKeyVersionError(`Unsupported wrap format version ${bundle.wrapFormatVersion}`);
+    }
+    if (bundle.wrapAead !== WRAP_AEAD || bundle.wrapKdfInfo !== WRAP_KDF_INFO) {
+        throw new IdentityKeyVersionError("Unsupported wrap format");
+    }
+    const expectedSpki = Buffer.from(params.expectedSpkiDerB64, "base64");
+    if (expectedSpki.length !== 44 ||
+        !expectedSpki.subarray(0, X25519_SPKI_PREFIX.length).equals(X25519_SPKI_PREFIX)) {
+        throw new IdentityKeyTamperError("Invalid server X25519 SPKI");
+    }
+    const recomputedAad = buildCanonicalAad({
+        evmAddress: params.expectedEvmAddress,
+        x25519SpkiDer: expectedSpki,
+    });
+    const advertisedAad = Buffer.from(bundle.wrapAadB64, "base64");
+    if (advertisedAad.length !== recomputedAad.length ||
+        !crypto.timingSafeEqual(advertisedAad, recomputedAad)) {
+        throw new IdentityKeyTamperError("Wrap AAD does not match local recomputation");
+    }
+    const kek = deriveKek(params.rawEoaPrivBytes, bundle.wrapKdfSaltB64);
+    const iv = Buffer.from(bundle.wrapIvB64, "base64");
+    if (iv.length !== WRAP_IV_LEN) {
+        kek.fill(0);
+        throw new IdentityKeyVersionError(`Invalid wrap IV length ${iv.length}`);
+    }
+    const wrapped = Buffer.from(bundle.wrappedPrivateKeyB64, "base64");
+    const ct = wrapped.subarray(0, wrapped.length - 16);
+    const tag = wrapped.subarray(wrapped.length - 16);
+    try {
+        const decipher = crypto.createDecipheriv("aes-256-gcm", kek, iv);
+        decipher.setAAD(recomputedAad);
+        decipher.setAuthTag(tag);
+        const pt = Buffer.concat([decipher.update(ct), decipher.final()]);
+        if (pt.length !== 32) {
+            pt.fill(0);
+            throw new IdentityKeyTamperError("Unwrapped key length is not 32 bytes");
+        }
+        return pt;
+    }
+    finally {
+        kek.fill(0);
+    }
+}
+async function fetchJson(url, init) {
+    const response = await fetch(url, init);
+    const ct = response.headers.get("content-type") || "";
+    if (!ct.includes("json")) {
+        return { ok: response.ok, status: response.status, data: null };
+    }
+    try {
+        return {
+            ok: response.ok,
+            status: response.status,
+            data: (await response.json()),
+        };
+    }
+    catch {
+        return { ok: response.ok, status: response.status, data: null };
+    }
+}
+async function loadIdentityKeyFromWallet(config) {
+    const accessToken = config.tokenServiceAccessToken?.trim();
+    const walletKey = config.walletKey?.trim();
+    if (!accessToken || !walletKey) {
+        throw new Error("Wallet identity key requires NEOZIP_TOKEN_SERVICE_ACCESS_TOKEN and NEOZIP_WALLET_PASSKEY in MCP env.");
+    }
+    const self = await fetchCryptoSelf(config);
+    if (!self.ok) {
+        throw new Error(self.hint
+            ? `${self.error} (${self.hint})`
+            : self.error);
+    }
+    const walletId = self.data.walletId;
+    const expectedSpkiB64 = self.data.x25519PublicKey;
+    const baseUrl = resolveTokenServiceBaseUrl(config);
+    const auth = { Authorization: `Bearer ${accessToken}` };
+    const keyRes = await fetchJson(`${baseUrl}/identity/wallets/${walletId}/identity-key`, {
+        headers: auth,
+    });
+    if (!keyRes.ok || !keyRes.data?.success || !keyRes.data.identityKey) {
+        throw new Error(keyRes.data?.error ||
+            `Failed to fetch identity key (HTTP ${keyRes.status})`);
+    }
+    const bundle = keyRes.data.identityKey;
+    const wallet = new Wallet(walletKey);
+    const rawEoa = Buffer.from(wallet.privateKey.startsWith("0x")
+        ? wallet.privateKey.slice(2)
+        : wallet.privateKey, "hex");
+    const expectedAddr = bundle.evmAddress || wallet.address;
+    let x25519Private = null;
+    try {
+        x25519Private = unwrapX25519PrivateKey({
+            rawEoaPrivBytes: rawEoa,
+            bundle,
+            expectedEvmAddress: expectedAddr,
+            expectedSpkiDerB64: expectedSpkiB64,
+        });
+        const hex = x25519Private.toString("hex");
+        return hex;
+    }
+    finally {
+        rawEoa.fill(0);
+        if (x25519Private)
+            x25519Private.fill(0);
+    }
+}
+export function hasConfiguredIdentityKey(config) {
+    return Boolean(config.identityPrivateKeyHex?.trim() ||
+        (config.tokenServiceAccessToken?.trim() && config.walletKey?.trim()));
+}
+/**
+ * Resolve X25519 private key hex for recipient-encrypted archives.
+ * Never pass through MCP tool arguments — env/config only.
+ */
+export async function resolveIdentityPrivateKeyHex(config) {
+    const envHex = config.identityPrivateKeyHex?.trim();
+    if (envHex) {
+        const clean = envHex.startsWith("0x") ? envHex.slice(2) : envHex;
+        if (!/^[0-9a-fA-F]{64}$/.test(clean)) {
+            throw new Error("NEOZIP_IDENTITY_PRIVATE_KEY_HEX must be 64 hex characters (32-byte X25519 key)");
+        }
+        return clean.toLowerCase();
+    }
+    if (config.tokenServiceAccessToken && config.walletKey) {
+        return loadIdentityKeyFromWallet(config);
+    }
+    return null;
+}
+//# sourceMappingURL=identity-key.js.map

package/dist/archive/manifest.js

@@ -0,0 +1,55 @@
+import { detectTextSafety } from "./detect-text.js";
+import { getEntryEncryptionLabel, isEntryEncrypted } from "./encryption.js";
+function compressionMethodName(cmpMethod) {
+    if (cmpMethod === 0)
+        return "Stored";
+    if (cmpMethod === 8)
+        return "Deflate";
+    if (cmpMethod === 93)
+        return "Zstd";
+    return `Method ${cmpMethod}`;
+}
+export function buildEntrySummary(entry) {
+    const filePath = entry.fileName || entry.filename || "";
+    const detection = detectTextSafety(filePath);
+    const encrypted = isEntryEncrypted(entry);
+    const encryptionScheme = getEntryEncryptionLabel(entry);
+    return {
+        path: filePath,
+        uncompressedSize: entry.uncompressedSize || 0,
+        compressedSize: entry.compressedSize || 0,
+        compressionMethod: compressionMethodName(entry.cmpMethod ?? -1),
+        lastModified: entry.lastModDate
+            ? new Date(entry.lastModDate).toISOString()
+            : null,
+        encrypted,
+        encryptionScheme,
+        hasSha256: Boolean(entry.sha256),
+        isDirectory: Boolean(entry.isDirectory),
+        isTextSafe: detection.isTextSafe && !entry.isDirectory,
+        contentType: detection.contentType,
+        recommendedTool: entry.isDirectory ? "extract" : detection.recommendedTool,
+    };
+}
+export function buildArchiveManifest(archivePath, entries, extras) {
+    const summaries = entries.map(buildEntrySummary);
+    let totalUncompressed = 0;
+    let totalCompressed = 0;
+    for (const s of summaries) {
+        totalUncompressed += s.uncompressedSize;
+        totalCompressed += s.compressedSize;
+    }
+    const compressionRatio = totalUncompressed > 0
+        ? Number(((1 - totalCompressed / totalUncompressed) * 100).toFixed(2))
+        : 0;
+    return {
+        archive: archivePath,
+        entryCount: entries.length,
+        totalUncompressed,
+        totalCompressed,
+        compressionRatio,
+        entries: summaries,
+        ...extras,
+    };
+}
+//# sourceMappingURL=manifest.js.map

package/dist/archive/merkle.js

@@ -0,0 +1,31 @@
+import neozipkit from "neozipkit";
+const { HashCalculator } = neozipkit;
+import { isMetadataEntryPath } from "./metadata-paths.js";
+export function computeMerkleRoot(entries) {
+    let hasSHA256 = false;
+    for (const entry of entries) {
+        const name = entry.fileName || entry.filename || "";
+        if (isMetadataEntryPath(name))
+            continue;
+        if (entry.sha256)
+            hasSHA256 = true;
+    }
+    if (!hasSHA256)
+        return null;
+    try {
+        const hashCalc = new HashCalculator({ enableAccumulation: true });
+        for (const entry of entries) {
+            const name = entry.fileName || entry.filename || "";
+            if (isMetadataEntryPath(name))
+                continue;
+            if (entry.sha256) {
+                hashCalc.addHash(Buffer.from(entry.sha256, "hex"));
+            }
+        }
+        return hashCalc.merkleRoot();
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=merkle.js.map

package/dist/archive/metadata-paths.js

@@ -0,0 +1,14 @@
+import { TOKENIZED_METADATA } from "neozip-blockchain";
+import { ACCESS_NZIP_PATH } from "./recipient-access.js";
+const META_INF_PREFIX = "META-INF/";
+export function isMetadataEntryPath(entryPath) {
+    const name = entryPath.replace(/\\/g, "/");
+    return (name.startsWith(META_INF_PREFIX) ||
+        name === TOKENIZED_METADATA ||
+        name === ACCESS_NZIP_PATH ||
+        name.endsWith("/TOKEN.NZIP") ||
+        name.endsWith("/TS-SUBMIT.NZIP") ||
+        name.endsWith("/TIMESTAMP.NZIP") ||
+        name.endsWith("/ACCESS.NZIP"));
+}
+//# sourceMappingURL=metadata-paths.js.map

package/dist/archive/mint-archive.js

@@ -0,0 +1,61 @@
+import { ZipkitMinter } from "neozip-blockchain";
+function suppressMinterStdoutProgress() {
+    const rawStdoutWrite = process.stdout.write.bind(process.stdout);
+    process.stdout.write = function (chunk, encodingOrCb, cb) {
+        const text = typeof chunk === "string" ? chunk : Buffer.from(chunk).toString();
+        if (text.includes("Waiting for confirmation") ||
+            text.includes("⏳") ||
+            text === ".") {
+            const done = typeof encodingOrCb === "function"
+                ? encodingOrCb
+                : typeof cb === "function"
+                    ? cb
+                    : undefined;
+            if (done)
+                process.nextTick(() => done());
+            return true;
+        }
+        return rawStdoutWrite(chunk, encodingOrCb, cb);
+    };
+    return () => {
+        process.stdout.write = rawStdoutWrite;
+    };
+}
+async function forceCloseProvider(minter) {
+    try {
+        minter.destroy();
+    }
+    catch {
+        // ignore cleanup errors
+    }
+    const provider = minter
+        .provider;
+    if (provider?.destroy) {
+        await Promise.resolve(provider.destroy());
+    }
+}
+export async function mintArchiveToken(merkleRoot, options) {
+    const minter = new ZipkitMinter(merkleRoot, {
+        walletPrivateKey: options.walletPrivateKey,
+        network: options.network,
+        debug: options.debug ?? false,
+    });
+    const restoreStdout = options.suppressProgress !== false
+        ? suppressMinterStdoutProgress()
+        : undefined;
+    try {
+        if (!options.debug) {
+            console.error("Minting on-chain (submitting transaction)...");
+        }
+        const result = await minter.completeMinting();
+        return {
+            mintingResult: result.mintingResult,
+            tokenMetadata: result.tokenMetadata,
+        };
+    }
+    finally {
+        restoreStdout?.();
+        await forceCloseProvider(minter);
+    }
+}
+//# sourceMappingURL=mint-archive.js.map

package/dist/archive/open-archive.js

@@ -0,0 +1,23 @@
+import { ZipkitNode } from "../neozipkit-node.js";
+import { applyArchivePassword } from "./encryption.js";
+import { applyRecipientDecryptIfNeeded } from "./recipient-decrypt.js";
+export async function openArchive(input, sandbox, resourceLimiter, config, options) {
+    const archivePath = await sandbox.validatePath(input);
+    await resourceLimiter.checkFileSize(archivePath);
+    const zip = new ZipkitNode();
+    await zip.loadZipFile(archivePath);
+    let entries = zip.getDirectory() || [];
+    resourceLimiter.checkEntryCount(entries.length);
+    const recipientResult = await applyRecipientDecryptIfNeeded(zip, archivePath, entries, config, options);
+    if (!recipientResult.decrypted) {
+        applyArchivePassword(zip, options?.password);
+    }
+    entries = zip.getDirectory() || [];
+    return {
+        archivePath,
+        zip,
+        entries,
+        recipientDecrypted: recipientResult.decrypted,
+    };
+}
+//# sourceMappingURL=open-archive.js.map

package/dist/archive/read-entry-buffer.js

@@ -0,0 +1,11 @@
+import { findEntryByPath } from "./find-entry.js";
+import { extractEntryToBuffer } from "./extract-entry-buffer.js";
+export async function readEntryBuffer(zip, entries, entryPath) {
+    const entry = findEntryByPath(entries, entryPath);
+    if (entry.isDirectory) {
+        throw new Error(`Entry is a directory, not a file: ${entryPath}`);
+    }
+    const buffer = await extractEntryToBuffer(zip, entry);
+    return { entry, buffer };
+}
+//# sourceMappingURL=read-entry-buffer.js.map

package/dist/archive/read-entry-content.js

@@ -0,0 +1,51 @@
+import { detectTextSafety, isBufferTextSafe } from "./detect-text.js";
+import { readEntryBuffer } from "./read-entry-buffer.js";
+import { translateContent } from "../translators/index.js";
+export function paginateText(text, offset, maxChars) {
+    const totalCharacters = text.length;
+    const slice = text.slice(offset, offset + maxChars);
+    const nextOffset = offset + maxChars;
+    const hasMore = nextOffset < totalCharacters;
+    return {
+        total_characters: totalCharacters,
+        has_more: hasMore,
+        next_offset: hasMore ? nextOffset : null,
+        content: slice,
+    };
+}
+export async function readEntryContent(zip, entries, config, options) {
+    const offset = Math.max(0, options.offset ?? 0);
+    let maxChars = options.maxChars ?? config.defaultMaxChars;
+    maxChars = Math.min(maxChars, config.maxReadChars);
+    const { buffer } = await readEntryBuffer(zip, entries, options.entryPath);
+    const detection = detectTextSafety(options.entryPath, buffer);
+    if (!detection.isTextSafe && !isBufferTextSafe(buffer)) {
+        throw new Error(`Entry is not text-safe (${detection.contentType}). Use extract for binary files.`);
+    }
+    let text = buffer.toString("utf-8");
+    const shouldTranslate = options.translate !== false;
+    if (shouldTranslate) {
+        const translated = translateContent(options.entryPath, text, {
+            maxChars: config.maxReadChars,
+        });
+        text = translated.content;
+    }
+    const paginated = paginateText(text, offset, maxChars);
+    const result = {
+        file_path: options.entryPath.replace(/\\/g, "/").replace(/^\/+/, ""),
+        ...paginated,
+        content: paginated.content,
+    };
+    if (shouldTranslate) {
+        const ext = options.entryPath.includes(".")
+            ? options.entryPath.slice(options.entryPath.lastIndexOf(".")).toLowerCase()
+            : "";
+        if (ext === ".json" || ext === ".csv") {
+            result.translation = {
+                format: ext === ".json" ? "json" : "csv-markdown",
+            };
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=read-entry-content.js.map

package/dist/archive/recipient-access.js

@@ -0,0 +1,26 @@
+import { ACCESS_NZIP_PATH, parseAccessMetadata, } from "../vendor/neozipkit-pro.js";
+import { extractEntryToBuffer } from "./extract-entry-buffer.js";
+export { ACCESS_NZIP_PATH };
+export function hasRecipientAccessMetadata(entries) {
+    return entries.some((entry) => {
+        const name = entry.fileName || entry.filename || "";
+        return name.replace(/\\/g, "/") === ACCESS_NZIP_PATH;
+    });
+}
+export function findAccessMetadataEntry(entries) {
+    return entries.find((entry) => {
+        const name = entry.fileName || entry.filename || "";
+        return name.replace(/\\/g, "/") === ACCESS_NZIP_PATH;
+    });
+}
+export async function parseRecipientAccessMetadata(zip, entries) {
+    const accessEntry = findAccessMetadataEntry(entries);
+    if (!accessEntry)
+        return null;
+    const raw = await extractEntryToBuffer(zip, accessEntry);
+    return parseAccessMetadata(raw);
+}
+export function recipientIdentitiesFromMetadata(metadata) {
+    return metadata.recipients.map((r) => r.identity);
+}
+//# sourceMappingURL=recipient-access.js.map

package/dist/archive/recipient-decrypt.js

@@ -0,0 +1,21 @@
+import { decryptAsRecipient } from "../vendor/neozipkit-pro.js";
+import { resolveIdentityPrivateKeyHex } from "./identity-key.js";
+import { hasRecipientAccessMetadata } from "./recipient-access.js";
+export async function applyRecipientDecryptIfNeeded(zip, archivePath, entries, config, options) {
+    if (!hasRecipientAccessMetadata(entries)) {
+        return { decrypted: false };
+    }
+    if (options?.password?.trim()) {
+        return { decrypted: false };
+    }
+    const privateKeyHex = await resolveIdentityPrivateKeyHex(config);
+    if (!privateKeyHex) {
+        if (options?.allowRecipientMetadataOnly) {
+            return { decrypted: false };
+        }
+        throw new Error("Recipient-encrypted archive (META-INF/ACCESS.NZIP). Configure NEOZIP_IDENTITY_PRIVATE_KEY_HEX or NEOZIP_TOKEN_SERVICE_ACCESS_TOKEN + NEOZIP_WALLET_PASSKEY in MCP env (not in tool arguments).");
+    }
+    await decryptAsRecipient(zip, archivePath, privateKeyHex);
+    return { decrypted: true };
+}
+//# sourceMappingURL=recipient-decrypt.js.map

package/dist/archive/recipient-lookup.js

@@ -0,0 +1,55 @@
+import { getTokenServiceUrl } from "neozip-blockchain/token-service";
+import { TOKEN_SERVICE_RECIPIENT_IDENTITY_TYPE } from "../constants/wallet-identity.js";
+export function spkiBase64ToRawHex(spkiBase64) {
+    const spkiDer = Buffer.from(spkiBase64, "base64");
+    if (spkiDer.length !== 44) {
+        throw new Error(`Unexpected SPKI DER length ${spkiDer.length}, expected 44 bytes for X25519`);
+    }
+    return spkiDer.subarray(12).toString("hex");
+}
+export function resolveTokenServiceBaseUrl(config, serverUrl) {
+    return getTokenServiceUrl({
+        serverUrl: serverUrl || config.tokenServiceUrl || undefined,
+    }).replace(/\/+$/, "");
+}
+export async function lookupRecipientByEmail(email, config, options) {
+    const trimmed = email.trim().toLowerCase();
+    if (!trimmed.includes("@")) {
+        throw new Error(`Invalid recipient email: ${email}`);
+    }
+    const baseUrl = resolveTokenServiceBaseUrl(config, options?.serverUrl);
+    const url = `${baseUrl}/crypto/public?email=${encodeURIComponent(trimmed)}`;
+    const response = await fetch(url, { method: "GET" });
+    const data = (await response.json());
+    if (!response.ok || !data.success || !data.crypto?.x25519PublicKey) {
+        throw new Error(data.error ||
+            `No public key found for ${trimmed} (HTTP ${response.status})`);
+    }
+    const publicKeyHex = spkiBase64ToRawHex(data.crypto.x25519PublicKey);
+    return {
+        identity: {
+            identity: trimmed,
+            identityType: TOKEN_SERVICE_RECIPIENT_IDENTITY_TYPE,
+            address: data.crypto.evmAddress || "",
+            publicKeyHex,
+            keyFormat: "x25519",
+        },
+        evmAddress: data.crypto.evmAddress || "",
+        recipientSuites: data.crypto.recipientSuites,
+        cryptoProvisionedAt: data.crypto.cryptoProvisionedAt,
+    };
+}
+export async function resolveRecipientsFromEmails(emails, config, options) {
+    const seen = new Set();
+    const recipients = [];
+    for (const email of emails) {
+        const normalized = email.trim().toLowerCase();
+        if (seen.has(normalized))
+            continue;
+        seen.add(normalized);
+        const { identity } = await lookupRecipientByEmail(normalized, config, options);
+        recipients.push(identity);
+    }
+    return recipients;
+}
+//# sourceMappingURL=recipient-lookup.js.map

package/dist/archive/timestamp-network.js

@@ -0,0 +1,54 @@
+import neoBlockchain from "neozip-blockchain";
+const { getChainIdByName, getNetworkByName, getContractConfig } = neoBlockchain;
+/** Infer network slug from Token Service batch IDs like `base-sep-v0.90-n58`. */
+export function inferNetworkFromBatchId(batchId) {
+    if (!batchId)
+        return null;
+    const slug = batchId.split("-")[0]?.toLowerCase();
+    if (slug === "base" && batchId.toLowerCase().includes("sep")) {
+        return "base-sepolia";
+    }
+    if (slug === "base")
+        return "base";
+    if (slug === "eth" && batchId.toLowerCase().includes("sep")) {
+        return "sepolia";
+    }
+    if (slug === "eth")
+        return "mainnet";
+    return slug || null;
+}
+export function resolveTimestampNetwork(metadata, configNetwork, networkOverride) {
+    if (networkOverride)
+        return networkOverride;
+    if (metadata.network && metadata.network !== "unknown") {
+        const byDisplay = getNetworkByName(metadata.network);
+        if (byDisplay?.nameAliases?.length) {
+            return configNetwork || byDisplay.nameAliases[0];
+        }
+        return metadata.network;
+    }
+    return inferNetworkFromBatchId(metadata.batchId) || configNetwork;
+}
+export function enrichTimestampMetadata(metadata, configNetwork, networkOverride) {
+    const networkSlug = resolveTimestampNetwork(metadata, configNetwork, networkOverride);
+    const chainId = getChainIdByName(networkSlug);
+    const networkConfig = getNetworkByName(networkSlug);
+    const contractConfig = chainId ? getContractConfig(chainId) : null;
+    const enriched = { ...metadata };
+    if (chainId && (!enriched.chainId || enriched.chainId === 0)) {
+        enriched.chainId = chainId;
+    }
+    if (networkConfig?.network &&
+        (!enriched.network || enriched.network === "unknown")) {
+        enriched.network = networkConfig.network;
+    }
+    if (!enriched.contractAddress && contractConfig?.address) {
+        enriched.contractAddress = contractConfig.address;
+    }
+    else if (!enriched.contractAddress &&
+        networkConfig?.registryAddress) {
+        enriched.contractAddress = networkConfig.registryAddress;
+    }
+    return enriched;
+}
+//# sourceMappingURL=timestamp-network.js.map

package/dist/config/capabilities.js

@@ -0,0 +1,37 @@
+import { computeConnectionPhase } from "../connection/phase.js";
+import { readActiveConnectionSecrets } from "../connection/store.js";
+import { isAccessTokenExpired } from "../connection/token-auth.js";
+const AUTO_READY = ["zip", "blockchain", "readonly"];
+const AUTO_PENDING = ["zip", "readonly"];
+export function isAutoCapabilitiesMode(raw) {
+    const trimmed = raw?.trim().toLowerCase();
+    return trimmed === undefined || trimmed === "" || trimmed === "auto";
+}
+export function isConnectReadyForAutoCapabilities() {
+    if (computeConnectionPhase() !== "ready") {
+        return false;
+    }
+    const secrets = readActiveConnectionSecrets();
+    return !isAccessTokenExpired(secrets);
+}
+function parseExplicitCapabilities(raw) {
+    const groups = raw
+        .split(",")
+        .map((s) => s.trim().toLowerCase())
+        .filter((s) => ["zip", "blockchain", "readonly", "account"].includes(s));
+    return groups.length > 0 ? groups : ["zip"];
+}
+export function resolveCapabilities(raw) {
+    if (isAutoCapabilitiesMode(raw)) {
+        const ready = isConnectReadyForAutoCapabilities();
+        return {
+            capabilities: ready ? [...AUTO_READY] : [...AUTO_PENDING],
+            mode: "auto",
+        };
+    }
+    return {
+        capabilities: parseExplicitCapabilities(raw),
+        mode: "explicit",
+    };
+}
+//# sourceMappingURL=capabilities.js.map