trustbase-seller-backend 0.1.5

package/mcp/migrations.js

@@ -0,0 +1,391 @@
+"use strict";
+/**
+ * MCP 扩展工具表迁移（PRD-H Phase 1 hotfix）
+ *
+ * 背景：6 个 *-tools.ts（security / ai / auto-dispatch / plugin-management /
+ * product-type / seller-query）直接引用了 14 张扩展表（login_attempts,
+ * device_bindings, two_fa_config, account_locks, ai_models, ai_scenarios,
+ * ai_model_calls, order_applications, service_subscriptions, plugin_registry,
+ * installed_plugins, plugin_ports, digital_purchases, download_logs,
+ * plugin_changelog, saas_plans），但 SQLitePlugin 的 createTables() 只创建了
+ * 核心表（products/sellers/reviews/orders/sync_state/index_updates/
+ * ai_pending_approvals/ai_settings/products_fts），未包含这些扩展表。
+ *
+ * 结果：NodeG 生产 record_login_attempt 报 "no such table: login_attempts"。
+ *
+ * 修复：本文件集中定义 14 张扩展表的 CREATE TABLE IF NOT EXISTS，
+ * 在 registerAllExtensionTools() 之前调用 ensureExtensionTables(db)，
+ * 幂等地补齐缺失表。原有表 schema 完全由 SQLitePlugin 负责，本文件不重复创建。
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureExtensionTables = ensureExtensionTables;
+/**
+ * 在 MCP 工具注册前创建/校验所有扩展表。
+ * 调用方需传入已经初始化的 better-sqlite3 实例（来自 SQLitePlugin.getRawDb()）。
+ *
+ * 所有语句使用 IF NOT EXISTS，可重复调用而不会报错。
+ */
+function ensureExtensionTables(db) {
+    // ===== security-tools.ts =====
+    // verify_device_binding
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS device_bindings (
+      device_id TEXT PRIMARY KEY,
+      bound_address TEXT NOT NULL,
+      user_agent TEXT DEFAULT '',
+      ip_address TEXT DEFAULT '',
+      bound_at TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_device_bindings_addr ON device_bindings(bound_address);
+    CREATE INDEX IF NOT EXISTS idx_device_bindings_time ON device_bindings(bound_at DESC);
+  `);
+    // check_2fa_status
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS two_fa_config (
+      address TEXT PRIMARY KEY,
+      enabled INTEGER NOT NULL DEFAULT 0,
+      method TEXT DEFAULT '',
+      secret TEXT DEFAULT '',
+      backup_codes_remaining INTEGER DEFAULT 0,
+      setup_at TEXT DEFAULT '',
+      last_used_at TEXT DEFAULT ''
+    );
+    CREATE INDEX IF NOT EXISTS idx_two_fa_enabled ON two_fa_config(enabled);
+  `);
+    // record_login_attempt
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS login_attempts (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      address TEXT NOT NULL,
+      success INTEGER NOT NULL DEFAULT 0,
+      ip_address TEXT DEFAULT '',
+      device_id TEXT DEFAULT '',
+      failure_reason TEXT DEFAULT '',
+      timestamp TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_login_attempts_addr ON login_attempts(address);
+    CREATE INDEX IF NOT EXISTS idx_login_attempts_ts ON login_attempts(timestamp DESC);
+    CREATE INDEX IF NOT EXISTS idx_login_attempts_success ON login_attempts(address, success, timestamp);
+  `);
+    // lock_account / check_account_lock
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS account_locks (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      address TEXT NOT NULL,
+      locked_until TEXT NOT NULL,
+      reason TEXT DEFAULT '',
+      locked_at TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_account_locks_addr ON account_locks(address);
+    CREATE INDEX IF NOT EXISTS idx_account_locks_until ON account_locks(locked_until DESC);
+  `);
+    // ===== ai-tools.ts =====
+    // configure_ai_model
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS ai_models (
+      model_id TEXT PRIMARY KEY,
+      model_name TEXT NOT NULL,
+      model_type TEXT NOT NULL,
+      provider TEXT NOT NULL,
+      api_config TEXT NOT NULL DEFAULT '{}',
+      parameters TEXT NOT NULL DEFAULT '{}',
+      limits TEXT NOT NULL DEFAULT '{}',
+      status TEXT NOT NULL DEFAULT 'active',
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_ai_models_provider ON ai_models(provider);
+    CREATE INDEX IF NOT EXISTS idx_ai_models_status ON ai_models(status);
+  `);
+    // configure_ai_scenario
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS ai_scenarios (
+      scenario_id TEXT PRIMARY KEY,
+      scenario_name TEXT NOT NULL,
+      scenario_type TEXT NOT NULL,
+      model_id TEXT NOT NULL,
+      enabled INTEGER NOT NULL DEFAULT 0,
+      auto_trigger INTEGER NOT NULL DEFAULT 0,
+      trigger_conditions TEXT NOT NULL DEFAULT '{}',
+      prompt_template TEXT DEFAULT '',
+      cost_bearer TEXT DEFAULT 'platform',
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_ai_scenarios_model ON ai_scenarios(model_id);
+    CREATE INDEX IF NOT EXISTS idx_ai_scenarios_enabled ON ai_scenarios(enabled);
+  `);
+    // call_ai_model / get_ai_usage_stats
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS ai_model_calls (
+      call_id TEXT PRIMARY KEY,
+      model_id TEXT NOT NULL,
+      action TEXT NOT NULL,
+      request TEXT NOT NULL DEFAULT '{}',
+      parameters TEXT NOT NULL DEFAULT '{}',
+      response TEXT DEFAULT '',
+      called_at TEXT NOT NULL,
+      duration_ms INTEGER DEFAULT 0,
+      success INTEGER NOT NULL DEFAULT 1,
+      error_message TEXT DEFAULT ''
+    );
+    CREATE INDEX IF NOT EXISTS idx_ai_calls_model ON ai_model_calls(model_id);
+    CREATE INDEX IF NOT EXISTS idx_ai_calls_called ON ai_model_calls(called_at DESC);
+  `);
+    // ===== auto-dispatch-tools.ts =====
+    // subscribe_service
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS service_subscriptions (
+      subscription_id TEXT PRIMARY KEY,
+      subscriber_address TEXT NOT NULL,
+      target_address TEXT NOT NULL,
+      subscription_type TEXT NOT NULL,
+      scope TEXT NOT NULL DEFAULT '{}',
+      conditions TEXT NOT NULL DEFAULT '{}',
+      status TEXT NOT NULL DEFAULT 'active',
+      subscribed_at TEXT NOT NULL,
+      last_active_at TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_subs_subscriber ON service_subscriptions(subscriber_address);
+    CREATE INDEX IF NOT EXISTS idx_subs_target ON service_subscriptions(target_address);
+    CREATE INDEX IF NOT EXISTS idx_subs_status ON service_subscriptions(status);
+  `);
+    // auto_apply_order / get_order_applications / dispatch_order / auto_dispatch
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS order_applications (
+      application_id TEXT PRIMARY KEY,
+      order_id TEXT NOT NULL,
+      applicant_address TEXT NOT NULL,
+      estimated_arrival INTEGER DEFAULT 0,
+      distance REAL DEFAULT 0,
+      rating REAL DEFAULT 0,
+      completed_orders INTEGER DEFAULT 0,
+      message TEXT DEFAULT '',
+      bid TEXT DEFAULT '{}',
+      priority_score REAL DEFAULT 0,
+      status TEXT NOT NULL DEFAULT 'pending',
+      applied_at TEXT NOT NULL,
+      accepted_at TEXT DEFAULT '',
+      rejected_at TEXT DEFAULT ''
+    );
+    CREATE INDEX IF NOT EXISTS idx_apps_order ON order_applications(order_id);
+    CREATE INDEX IF NOT EXISTS idx_apps_applicant ON order_applications(applicant_address);
+    CREATE INDEX IF NOT EXISTS idx_apps_status ON order_applications(status);
+    CREATE INDEX IF NOT EXISTS idx_apps_priority ON order_applications(order_id, status, priority_score DESC);
+  `);
+    // ===== plugin-management-tools.ts =====
+    // install_plugin / configure_plugin / enable_plugin / disable_plugin / uninstall_plugin
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS plugin_registry (
+      plugin_id TEXT PRIMARY KEY,
+      name TEXT NOT NULL,
+      plugin_type TEXT NOT NULL,
+      version TEXT NOT NULL DEFAULT '1.0.0',
+      exclusivity TEXT NOT NULL DEFAULT 'shared',
+      description TEXT DEFAULT '',
+      icon_url TEXT DEFAULT '',
+      homepage_url TEXT DEFAULT '',
+      created_at TEXT DEFAULT ''
+    );
+    CREATE INDEX IF NOT EXISTS idx_plugin_registry_type ON plugin_registry(plugin_type);
+  `);
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS installed_plugins (
+      install_id TEXT PRIMARY KEY,
+      seller_address TEXT NOT NULL,
+      plugin_id TEXT NOT NULL,
+      plugin_version TEXT DEFAULT '',
+      plugin_type TEXT DEFAULT '',
+      config TEXT NOT NULL DEFAULT '{}',
+      status TEXT NOT NULL DEFAULT 'active',
+      installed_at TEXT NOT NULL,
+      updated_at TEXT DEFAULT '',
+      uninstalled_at TEXT DEFAULT ''
+    );
+    CREATE INDEX IF NOT EXISTS idx_installed_seller ON installed_plugins(seller_address);
+    CREATE INDEX IF NOT EXISTS idx_installed_plugin ON installed_plugins(plugin_id);
+    CREATE INDEX IF NOT EXISTS idx_installed_status ON installed_plugins(status);
+  `);
+    // register_plugin_port
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS plugin_ports (
+      registry_id TEXT PRIMARY KEY,
+      plugin_id TEXT NOT NULL,
+      seller_address TEXT NOT NULL,
+      port INTEGER NOT NULL,
+      protocol TEXT NOT NULL,
+      access_url TEXT DEFAULT '',
+      access_permission TEXT NOT NULL DEFAULT 'private',
+      access_scope TEXT NOT NULL DEFAULT '{}',
+      access_fee TEXT NOT NULL DEFAULT '{}',
+      status TEXT NOT NULL DEFAULT 'active',
+      registered_at TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_plugin_ports_port ON plugin_ports(port);
+    CREATE INDEX IF NOT EXISTS idx_plugin_ports_plugin ON plugin_ports(plugin_id);
+    CREATE INDEX IF NOT EXISTS idx_plugin_ports_seller ON plugin_ports(seller_address);
+  `);
+    // ===== product-type-tools.ts =====
+    // purchase_digital_product / download_plugin / get_api_key
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS digital_purchases (
+      purchase_id TEXT PRIMARY KEY,
+      sku_id TEXT NOT NULL,
+      buyer_address TEXT NOT NULL,
+      license_key TEXT NOT NULL,
+      license_type TEXT NOT NULL DEFAULT 'perpetual',
+      subscription_duration TEXT DEFAULT '',
+      payment_method TEXT NOT NULL DEFAULT 'tct',
+      purchased_at TEXT NOT NULL,
+      expires_at TEXT DEFAULT '',
+      status TEXT NOT NULL DEFAULT 'active',
+      api_key TEXT DEFAULT ''
+    );
+    CREATE INDEX IF NOT EXISTS idx_purchases_sku ON digital_purchases(sku_id);
+    CREATE INDEX IF NOT EXISTS idx_purchases_buyer ON digital_purchases(buyer_address);
+    CREATE INDEX IF NOT EXISTS idx_purchases_status ON digital_purchases(status);
+    CREATE INDEX IF NOT EXISTS idx_purchases_expires ON digital_purchases(expires_at);
+  `);
+    // download_plugin
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS download_logs (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      purchase_id TEXT NOT NULL,
+      downloaded_at TEXT NOT NULL,
+      ip_address TEXT DEFAULT '',
+      version TEXT DEFAULT '',
+      user_agent TEXT DEFAULT ''
+    );
+    CREATE INDEX IF NOT EXISTS idx_download_logs_purchase ON download_logs(purchase_id);
+    CREATE INDEX IF NOT EXISTS idx_download_logs_time ON download_logs(downloaded_at DESC);
+  `);
+    // get_plugin_details
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS plugin_changelog (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      sku_id TEXT NOT NULL,
+      version TEXT NOT NULL,
+      release_date TEXT NOT NULL,
+      changes TEXT DEFAULT '',
+      is_breaking INTEGER NOT NULL DEFAULT 0
+    );
+    CREATE INDEX IF NOT EXISTS idx_changelog_sku ON plugin_changelog(sku_id);
+    CREATE INDEX IF NOT EXISTS idx_changelog_date ON plugin_changelog(release_date DESC);
+  `);
+    // get_saas_details
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS saas_plans (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      sku_id TEXT NOT NULL,
+      plan_name TEXT NOT NULL,
+      price REAL NOT NULL DEFAULT 0,
+      billing_period TEXT DEFAULT 'month',
+      features TEXT NOT NULL DEFAULT '[]',
+      quota INTEGER DEFAULT 0,
+      rate_limit INTEGER DEFAULT 0,
+      sort_order INTEGER DEFAULT 0,
+      created_at TEXT DEFAULT ''
+    );
+    CREATE INDEX IF NOT EXISTS idx_saas_plans_sku ON saas_plans(sku_id);
+    CREATE INDEX IF NOT EXISTS idx_saas_plans_price ON saas_plans(sku_id, price);
+  `);
+    // ===== peer-tools.ts (PRD-F Phase 2 §4.4 / §5.2) =====
+    // 本地白名单：管理本节点信任的对端节点，敏感 MCP 工具的二次鉴权依据
+    // 仅存本节点视角的信任关系，不上链；链上白名单由 PRD-F Phase 2.5 council 模块负责
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS peer_trust (
+      peer_node_id TEXT PRIMARY KEY,
+      trust_level  TEXT NOT NULL CHECK (trust_level IN ('read', 'write', 'admin')),
+      added_at     INTEGER NOT NULL,
+      added_by     TEXT NOT NULL,
+      note         TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_peer_trust_level ON peer_trust(trust_level);
+    CREATE INDEX IF NOT EXISTS idx_peer_trust_added ON peer_trust(added_at DESC);
+  `);
+    // ===== peer_call_log (PRD-F Phase 2 §6) =====
+    // 入站/出站 P2P 调用流水，供 Web 监控页 (M2MMonitor.vue) 实时拉取/展示
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS peer_call_log (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      ts INTEGER NOT NULL,              -- Date.now() 毫秒
+      direction TEXT NOT NULL,          -- 'inbound' | 'outbound'
+      remote_node_id TEXT,              -- 对端 node_id（inbound 时是 X-Node-ID，outbound 时是 destination peer）
+      remote_ip TEXT,
+      method TEXT NOT NULL,             -- HTTP method
+      path TEXT NOT NULL,               -- HTTP path
+      tool_name TEXT,                   -- 如果是 /api/p2p/tools/invoke，解析 body.tool_name
+      status INTEGER NOT NULL,          -- HTTP status
+      error TEXT,                       -- 失败原因，成功为 null
+      rtt_ms INTEGER,                   -- inbound 用 res.finish - req.start
+      trust_level TEXT,                 -- 命中白名单时的 level
+      request_body  TEXT,               -- 请求体（JSON 字符串，截断 10KB，PRD-F §6.1）
+      response_body TEXT                -- 响应体（JSON 字符串，截断 10KB，PRD-F §6.1）
+    );
+    CREATE INDEX IF NOT EXISTS idx_peer_call_log_ts ON peer_call_log(ts DESC);
+    CREATE INDEX IF NOT EXISTS idx_peer_call_log_remote ON peer_call_log(remote_node_id);
+  `);
+    // ===== m2m_chat_log (M2M v0.6, table kept in v0.7 for backward compat) =====
+    // 跨节点语义消息表：AI peer A → invoke m2m_inbox_store → 服务方 B 落库 → B 用
+    // m2m_inbox_list 拉收件箱 → B 回信 → A 拉收件箱。与 peer_call_log 的区别：
+    // peer_call_log 记的是"调用流水"（HTTP 维度），m2m_chat_log 记的是"对话
+    // 语义"（消息维度，带 from/to/content/codename/reply_to，可标记已读）。
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS m2m_chat_log (
+      id          INTEGER PRIMARY KEY AUTOINCREMENT,
+      ts          INTEGER NOT NULL,        -- Date.now() ms
+      from_node   TEXT NOT NULL,
+      to_node     TEXT NOT NULL,
+      content     TEXT NOT NULL,
+      codename    TEXT,
+      reply_to    INTEGER,                 -- FK to m2m_chat_log.id
+      read_at     INTEGER                  -- NULL until consumer marks read
+    );
+    CREATE INDEX IF NOT EXISTS idx_m2m_chat_to_unread
+      ON m2m_chat_log(to_node, read_at);
+    CREATE INDEX IF NOT EXISTS idx_m2m_chat_ts ON m2m_chat_log(ts);
+  `);
+    // 幂等迁移：旧部署可能已有 peer_call_log 但没有 request_body/response_body 列。
+    // ALTER TABLE ADD COLUMN 在列已存在时会抛 "duplicate column"，用 try/catch 静默吞掉。
+    try {
+        db.exec(`ALTER TABLE peer_call_log ADD COLUMN request_body  TEXT;`);
+    }
+    catch (e) {
+        if (!String(e?.message ?? '').includes('duplicate column')) {
+            console.error('[MCP Migrations] peer_call_log.request_body add failed:', e?.message ?? e);
+        }
+    }
+    try {
+        db.exec(`ALTER TABLE peer_call_log ADD COLUMN response_body TEXT;`);
+    }
+    catch (e) {
+        if (!String(e?.message ?? '').includes('duplicate column')) {
+            console.error('[MCP Migrations] peer_call_log.response_body add failed:', e?.message ?? e);
+        }
+    }
+    // ===== Phase 6 P0 (baobei #15680): 子链质押穿透 indexer 层 =====
+    // 三池余额 (Free/Pledge/Stabilization), 等 Phase 2 链上落地填数据
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS pool_balance (
+      chain_id   TEXT NOT NULL,
+      pool_type  TEXT NOT NULL,          -- free | pledge | stabilization
+      amount     TEXT NOT NULL,          -- sdk.Int 字符串 (int64 溢出)
+      updated_at INTEGER NOT NULL,
+      PRIMARY KEY (chain_id, pool_type)
+    );
+  `);
+    // 穿透汇率快照 (质押瞬间固化), 等 Phase 2 链上落地填数据
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS rate_snapshot (
+      chain_id  TEXT NOT NULL,
+      height    INTEGER NOT NULL,        -- 快照区块高度
+      rate      TEXT NOT NULL,           -- sdkmath.LegacyDec 字符串 (18 位精度)
+      effective_weight TEXT NOT NULL,    -- Pledge 池有效存量 (sdk.Int 字符串)
+      created_at INTEGER NOT NULL,
+      PRIMARY KEY (chain_id, height)
+    );
+  `);
+    // 幂等性保障：表与索引都已使用 IF NOT EXISTS，重复调用安全。
+    console.error('[MCP Migrations] All extension tables ensured (21 tables)');
+}
+//# sourceMappingURL=migrations.js.map

package/mcp/migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/mcp/migrations.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;AAYH,sDA8XC;AApYD;;;;;GAKG;AACH,SAAgB,qBAAqB,CAAC,EAAc;IAClD,gCAAgC;IAChC,wBAAwB;IACxB,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;GAUP,CAAC,CAAC;IAEH,mBAAmB;IACnB,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;GAWP,CAAC,CAAC;IAEH,uBAAuB;IACvB,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;GAaP,CAAC,CAAC;IAEH,oCAAoC;IACpC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;GAUP,CAAC,CAAC;IAEH,0BAA0B;IAC1B,qBAAqB;IACrB,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;GAeP,CAAC,CAAC;IAEH,wBAAwB;IACxB,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;GAgBP,CAAC,CAAC;IAEH,qCAAqC;IACrC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;GAeP,CAAC,CAAC;IAEH,qCAAqC;IACrC,oBAAoB;IACpB,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;GAeP,CAAC,CAAC;IAEH,6EAA6E;IAC7E,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;GAqBP,CAAC,CAAC;IAEH,yCAAyC;IACzC,wFAAwF;IACxF,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;GAaP,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;GAgBP,CAAC,CAAC;IAEH,uBAAuB;IACvB,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;GAiBP,CAAC,CAAC;IAEH,oCAAoC;IACpC,2DAA2D;IAC3D,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;GAkBP,CAAC,CAAC;IAEH,kBAAkB;IAClB,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;GAWP,CAAC,CAAC;IAEH,qBAAqB;IACrB,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;GAWP,CAAC,CAAC;IAEH,mBAAmB;IACnB,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;GAeP,CAAC,CAAC;IAEH,wDAAwD;IACxD,sCAAsC;IACtC,uDAAuD;IACvD,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;GAUP,CAAC,CAAC;IAEH,+CAA+C;IAC/C,oDAAoD;IACpD,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;GAmBP,CAAC,CAAC;IAEH,8EAA8E;IAC9E,+DAA+D;IAC/D,2DAA2D;IAC3D,uDAAuD;IACvD,uDAAuD;IACvD,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;GAcP,CAAC,CAAC;IAEH,+DAA+D;IAC/D,uEAAuE;IACvE,IAAI,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,KAAK,CAAC,yDAAyD,EAAE,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,KAAK,CAAC,0DAA0D,EAAE,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,sDAAsD;IACtD,EAAE,CAAC,IAAI,CAAC;;;;;;;;GAQP,CAAC,CAAC;IAEH,qCAAqC;IACrC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;GASP,CAAC,CAAC;IAEH,uCAAuC;IACvC,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;AAC7E,CAAC"}

package/mcp/peer-tools.d.ts

@@ -0,0 +1,163 @@
+/**
+ * TrustChain MCP `peer.*` Tools (PRD-F Phase 2 §4)
+ *
+ * Five tools that turn any MCP client into a peer of the TrustBase network:
+ *
+ *   peer.discover       — query the on-chain x/indexer registry
+ *   peer.send_request   — signed HTTP call to a remote /api/p2p/* endpoint
+ *   peer.invoke_tool    — sugar over peer.send_request to call a remote MCP tool
+ *   peer.list_trusted   — list this node's local trust whitelist
+ *   peer.add_trusted    — add an entry to the local whitelist
+ *   peer.remove_trusted — remove an entry from the local whitelist
+ *
+ * Design choices (mapped to the lessons in PRD/CLAUDE-CODE-PLAYBOOK.md):
+ *
+ *   - Reuse `peer/chain-signer.ts` 65-byte compact sig for chain discovery
+ *     (byte-for-byte matches the Go keeper's `ecdsa.SignCompact`).
+ *   - Reuse `peer/proto-codec.ts` decode functions (added in PR #3) so
+ *     peer.discover can actually parse the chain response.
+ *   - Reuse `p2p/signing.ts` canonicalize + r||s for HTTP body signing —
+ *     this is the format the remote /api/p2p/* handlers already accept.
+ *   - Whitelist persistence goes through a single SQLite table `peer_trust`
+ *     (migration is in migrations.ts), boolean-as-0/1 in any future field.
+ *   - Don't break if the chain RPC is unreachable: peer.send_request falls
+ *     back to the local peer registry if discover fails (useful for tests).
+ *
+ * Test injection:
+ *
+ *   We export `setChainClientFactory()` and `setFetchImpl()` so unit tests
+ *   can swap out the chain RPC and HTTP fetcher with mocks. Production code
+ *   leaves them at their defaults.
+ */
+import Database from 'better-sqlite3';
+/** A single IndexerEndpoint returned by peer.discover. */
+export interface DiscoveredEndpoint {
+    node_id: string;
+    chain_id: string;
+    version: string;
+    /** base64-encoded 33-byte compressed pubkey */
+    public_key: string;
+    ipv6: string;
+    ipv4: string;
+    relay_id: string;
+    capabilities: string[];
+    last_updated: number;
+    /** base64-encoded 65-byte compact signature */
+    signature: string;
+}
+export interface DiscoverResult {
+    endpoints: DiscoveredEndpoint[];
+    total: number;
+    next_offset?: number;
+    /** which chain RPC we asked */
+    source: 'chain';
+}
+export interface SendRequestResult {
+    status: number;
+    body: any;
+    signature_valid: boolean;
+    remote_pubkey: string;
+    rtt_ms: number;
+    /** what endpoint URL we hit (debug) */
+    url: string;
+}
+export interface TrustedPeer {
+    peer_node_id: string;
+    trust_level: 'read' | 'write' | 'admin';
+    added_at: number;
+    added_by: string;
+    note: string | null;
+}
+/** Minimal chain-client shape we need (mockable in tests). */
+export interface ChainClient {
+    queryAbci(path: string, data: Uint8Array): Promise<{
+        value: Uint8Array;
+        height: number;
+    }>;
+}
+export type ChainClientFactory = () => Promise<ChainClient>;
+export type FetchImpl = (url: string, init?: any) => Promise<{
+    status: number;
+    text(): Promise<string>;
+    json(): Promise<any>;
+    headers: Headers;
+}>;
+/** Test seam: replace the chain RPC client factory. */
+export declare function setChainClientFactory(factory: ChainClientFactory): void;
+/** Test seam: replace the HTTP fetcher. */
+export declare function setFetchImpl(impl: FetchImpl): void;
+/** Test seam: reset to defaults. */
+export declare function resetPeerDeps(): void;
+export declare function selectEndpointUrl(ep: DiscoveredEndpoint): string | null;
+export declare function listTrustedPeers(db: Database.Database): TrustedPeer[];
+export declare function addTrustedPeer(db: Database.Database, peerNodeId: string, trustLevel: 'read' | 'write' | 'admin', addedBy: string, note?: string): TrustedPeer;
+export declare function removeTrustedPeer(db: Database.Database, peerNodeId: string): boolean;
+/**
+ * Discover IndexerEndpoints from the on-chain x/indexer registry.
+ *
+ * Three filter dimensions:
+ *   - node_id    → exact match via GetIndexerEndpoint
+ *   - chain_id   → all endpoints registered for a chain
+ *   - capability → all endpoints that declared this capability
+ */
+export declare function discoverEndpoints(args: {
+    by: 'node_id' | 'chain_id' | 'capability';
+    value: string;
+    limit?: number;
+    offset?: number;
+}): Promise<DiscoverResult>;
+export interface SendRequestArgs {
+    node_id: string;
+    method: 'GET' | 'POST';
+    path: string;
+    body?: any;
+    timeout_ms?: number;
+    verify_signature?: boolean;
+    /** Optional injected privkey for tests; production reads from peer.key */
+    signing_privkey?: Uint8Array;
+    /** Optional injected node_id for the X-Node-ID header (defaults to the privkey's nodeId) */
+    signing_node_id?: string;
+}
+/**
+ * Send a signed HTTP request to a remote /api/p2p/* endpoint.
+ *
+ * Sequence:
+ *   1. Resolve the target's IndexerEndpoint on-chain (peer.discover by node_id)
+ *   2. Pick endpoint URL (IPv6 > IPv4 > Relay)
+ *   3. Build request envelope { method, path, body, nonce, timestamp, node_id }
+ *   4. Sign with signObject (r||s 64 bytes — same scheme the remote accepts)
+ *   5. Send via fetchImpl with X-Signature, X-Node-ID, X-Nonce, X-Timestamp
+ *   6. If verify_signature=true, verify the response body signature against the
+ *      on-chain public_key
+ */
+export declare function sendRequest(args: SendRequestArgs): Promise<SendRequestResult>;
+export interface InvokeToolArgs {
+    node_id: string;
+    tool_name: string;
+    arguments: Record<string, any>;
+    timeout_ms?: number;
+    signing_privkey?: Uint8Array;
+    signing_node_id?: string;
+}
+export declare function invokeRemoteTool(args: InvokeToolArgs): Promise<SendRequestResult>;
+export declare function registerPeerTools(server: any, indexer: any): void;
+export declare function setSigningKey(privkey: Uint8Array, nodeId: string): void;
+export declare function clearSigningKey(): void;
+/**
+ * Read this node's own bech32 node_id (set via setSigningKey at startup).
+ * Used by the m2m_inbox tools to validate `to == self_node_id` and to scope
+ * m2m_inbox_list to this node's inbox. Returns null if peer.key was never
+ * loaded (in which case inbox tools fall back to best-effort / reject).
+ */
+export declare function getSigningNodeId(): string | null;
+/**
+ * Read this node's own signing keypair (privkey + nodeId), set via setSigningKey
+ * at startup. Used by m2m_send to build and sign an m2m_inbox_store envelope for
+ * delivery to a remote peer. Returns null if peer.key was never loaded (in which
+ * case m2m_send rejects with a clear message — it cannot sign outbound).
+ */
+export declare function getSigningKey(): {
+    privkey: Uint8Array;
+    nodeId: string;
+} | null;
+//# sourceMappingURL=peer-tools.d.ts.map

package/mcp/peer-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"peer-tools.d.ts","sourceRoot":"","sources":["../../src/mcp/peer-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAqBtC,0DAA0D;AAC1D,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+BAA+B;IAC/B,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,GAAG,CAAC;IACV,eAAe,EAAE,OAAO,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3F;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;AAE5D,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC,CAAC;AAuCH,uDAAuD;AACvD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAEvE;AAED,2CAA2C;AAC3C,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAElD;AAED,oCAAoC;AACpC,wBAAgB,aAAa,IAAI,IAAI,CAcpC;AAOD,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAMvE;AAqBD,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,WAAW,EAAE,CAWrE;AAED,wBAAgB,cAAc,CAC5B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,EACtC,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,GACZ,WAAW,CAcb;AAED,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAGpF;AAMD;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,EAAE,EAAE,SAAS,GAAG,UAAU,GAAG,YAAY,CAAC;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,cAAc,CAAC,CAmD1B;AAqBD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,0EAA0E;IAC1E,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,4FAA4F;IAC5F,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoFnF;AAMD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAWvF;AAMD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,CAiLjE;AAkBD,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAMvE;AAED,wBAAgB,eAAe,IAAI,IAAI,CAGtC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAEhD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,IAAI;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAG9E"}