@receiz/mcp-server/dist/deviceMaterialHost.js

MCP server for agents building and verifying Receiz proof-native applications through the canonical Receiz SDK rails.

import { readFile, realpath } from "node:fs/promises";
import { createHash } from "node:crypto";
import { basename, isAbsolute, relative, resolve } from "node:path";
import { verifyReceizArtifact } from "@receiz/sdk";
/** A digest-bound file reference locates bytes; only the existing verifier
 * establishes artifact truth. No serialized admission/session is restored. */
export function createReceizDeviceMaterialHost(workspace) {
    const read = async (reference) => {
        const match = /^receiz:file:([a-f0-9]{64}):(.+)$/.exec(reference);
        if (!match)
            throw Error("RECEIZ_DEVICE_FILE_REFERENCE_REQUIRED");
        const root = await realpath(workspace);
        const path = await realpath(resolve(root, match[2]));
        const rel = relative(root, path);
        if (rel === ".." || rel.startsWith("../") || rel.startsWith("..\\") || isAbsolute(rel))
            throw Error("RECEIZ_DEVICE_WORKSPACE_REQUIRED");
        const exactBytes = new Uint8Array(await readFile(path));
        if (createHash("sha256").update(exactBytes).digest("hex") !== match[1])
            throw Error("RECEIZ_DEVICE_SOURCE_CHANGED");
        const filename = basename(path);
        const verification = await verifyReceizArtifact(new File([exactBytes], filename));
        if (verification.status !== "verified-artifact")
            throw Error("RECEIZ_DEVICE_SOURCE_VERIFICATION_REQUIRED");
        return { exactBytes, filename, mimeType: "application/octet-stream", verification };
    };
    return Object.freeze({
        resolveProofReference: async (reference) => {
            const { exactBytes, filename, mimeType } = await read(reference);
            return { exactBytes, filename, mimeType };
        },
        resolveMaterial: async ({ reference, kind }) => {
            if (!["identity-artifact", "subject-source-artifact", "sealed-source-artifact", "sealed-replay-proof-object"].includes(kind))
                throw Error("RECEIZ_DEVICE_RUNTIME_CUSTODY_REQUIRED");
            const { exactBytes, filename, mimeType, verification } = await read(reference);
            return Object.freeze({ schema: "receiz.sealed-artifact-bytes.v124", filename, mimeType,
                exactBytesB64u: Buffer.from(exactBytes).toString("base64url"), artifactSha256: verification.artifactDigest.value,
                payloadSha256: verification.payloadDigest.value });
        },
    });
}
//# sourceMappingURL=deviceMaterialHost.js.map