@receiz/mcp-server/dist/deviceBootstrap.js

MCP server for agents building and verifying Receiz proof-native applications through the canonical Receiz SDK rails.

import { mkdir, lstat, readFile, open, link, unlink, realpath } from "node:fs/promises";
import { randomBytes, randomUUID } from "node:crypto";
import { isAbsolute, join } from "node:path";
import { createReceizNodeOfflineSealer } from "@receiz/sdk/offline/node";
import { openReceizMcpDeviceRuntime } from "./deviceRuntime.js";
async function privateBytes(path) {
    try {
        const stat = await lstat(path);
        if (!stat.isFile() || (process.platform !== "win32" && (stat.mode & 0o077)))
            throw Error("RECEIZ_DEVICE_PRIVATE_CUSTODY_REQUIRED");
        return new Uint8Array(await readFile(path));
    }
    catch (error) {
        if (error.code === "ENOENT")
            return null;
        throw error;
    }
}
/** Publish fully written custody exactly once. A concurrent winner is retained. */
async function publishPrivate(path, bytes) {
    const temporary = `${path}.${randomUUID()}.pending`;
    const file = await open(temporary, "wx", 0o600);
    try {
        await file.writeFile(bytes);
        await file.sync();
    }
    finally {
        await file.close();
    }
    try {
        await link(temporary, path);
    }
    catch (error) {
        if (error.code !== "EEXIST")
            throw error;
    }
    finally {
        await unlink(temporary);
    }
}
/** Local installation onboarding. Never called from an anonymous HTTP runtime. */
export async function bootstrapReceizMcpDeviceRuntime(options) {
    const { directory, workspace, identityContextSharing } = options;
    const runtime = { ...options.runtime };
    if (!isAbsolute(directory) || !isAbsolute(workspace))
        throw Error("RECEIZ_MCP_DEVICE_ABSOLUTE_PATH_REQUIRED");
    if (identityContextSharing !== undefined && identityContextSharing !== "all-carried-state")
        throw Error("RECEIZ_DEVICE_CONTEXT_SHARING_INVALID");
    if (runtime.executionProfile !== undefined && runtime.executionProfile !== "phi-only" && runtime.executionProfile !== "marketplace-phi" && runtime.executionProfile !== "marketplace-nonfinancial")
        throw Error("RECEIZ_MCP_EXECUTION_PROFILE_INVALID");
    const workspacePath = await realpath(workspace);
    await mkdir(directory, { recursive: true, mode: 0o700 });
    const stat = await lstat(directory);
    if (!stat.isDirectory() || (process.platform !== "win32" && (stat.mode & 0o077)))
        throw Error("RECEIZ_DEVICE_PRIVATE_CUSTODY_REQUIRED");
    const identityPath = join(directory, "identity.receized.json");
    const passphrasePath = join(directory, "identity.secret");
    const sealDirectory = join(directory, "signer");
    let artifact = await privateBytes(identityPath);
    let secret = await privateBytes(passphrasePath);
    // Never manufacture replacement custody for an existing identity.
    if (artifact && !secret)
        throw Error("RECEIZ_DEVICE_IDENTITY_SECRET_MISSING");
    if (!secret) {
        await publishPrivate(passphrasePath, new TextEncoder().encode(randomBytes(32).toString("base64url")));
        secret = await privateBytes(passphrasePath);
    }
    if (!secret || secret.byteLength < 16)
        throw Error("RECEIZ_DEVICE_IDENTITY_SECRET_INVALID");
    const passphrase = new TextDecoder().decode(secret);
    if (!artifact) {
        const sealer = await createReceizNodeOfflineSealer({ directory: sealDirectory, ...(runtime.fetch ? { fetch: runtime.fetch } : {}) });
        if (!await sealer.ready()) {
            try {
                await sealer.enroll();
            }
            catch (error) {
                if (error.code !== "EEXIST" || !await sealer.ready())
                    throw error;
            }
        }
        const created = await sealer.createIdentity({ passphrase });
        await publishPrivate(identityPath, created.artifactBytes);
        artifact = await privateBytes(identityPath);
    }
    if (!artifact)
        throw Error("RECEIZ_DEVICE_IDENTITY_CUSTODY_MISSING");
    return openReceizMcpDeviceRuntime({ identityArtifactPath: identityPath, identityPassphrase: passphrase,
        workspace: workspacePath, sealDirectory, subjectDirectory: join(directory, "subjects"),
        ...(identityContextSharing ? { identityContextSharing } : {}), runtime });
}
//# sourceMappingURL=deviceBootstrap.js.map