@receiz/mcp-server/dist/currentRecordOperations.js

MCP server for agents building and verifying Receiz proof-native applications through the canonical Receiz SDK rails.

import { verifyReceizOfflineSealedFile } from "@receiz/sdk/offline";
import { createHash } from "node:crypto";
import { createReceizSdkMutationConsent } from "./v127SdkOperations.js";
import { persistReceizSealedOutput, registerReceizSealedOutput, RECEIZ_SEALED_OUTPUT_URI } from "./sealedArtifactOutput.js";
export const RECEIZ_CURRENT_RECORD_TOOL = Object.freeze({ name: "receiz_connect_record",
    description: "Create a current record proof through SDK connect.record with exact optional account save and visibility/showcase intent. Preview performs no transport; execute only with its identical single-use confirmation. Always request the complete PNG, verify its enclosing canonical proof before projection or private persistence, and deliver exact bytes through host custody. Saved/visibility/showcase response headers describe server effects; they do not establish ownership. A failed response can follow a remote save: do not automatically retry. MCP is not authority.",
    inputSchema: { type: "object", additionalProperties: false, properties: {
            body: { type: "object", additionalProperties: false, properties: { ms: { type: "integer" }, tzMinutesEast: { type: "integer" },
                    vis: { type: "string", enum: ["public", "private", "hidden"] }, save: { type: "boolean" }, includeArtifact: { type: "boolean", const: true } } },
            confirmation: { type: "string", minLength: 1, description: "Exact single-use confirmationDigest for identical record/save/showcase arguments." },
        }, required: ["body"] },
    annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
    _meta: { ui: { resourceUri: RECEIZ_SEALED_OUTPUT_URI }, "openai/outputTemplate": RECEIZ_SEALED_OUTPUT_URI },
});
const plain = (value) => !!value && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype;
function argumentsFor(raw) {
    const fail = () => { throw Error("connect_record_arguments_invalid"); };
    if (!plain(raw) || Object.keys(raw).some(key => !["body", "confirmation"].includes(key)) || !plain(raw.body))
        fail();
    const args = raw;
    const body = args.body;
    if (Object.keys(body).some(key => !["ms", "tzMinutesEast", "vis", "save", "includeArtifact"].includes(key)))
        fail();
    for (const key of ["ms", "tzMinutesEast"])
        if (body[key] !== undefined && !Number.isSafeInteger(body[key]))
            fail();
    if (body.vis !== undefined && !["public", "private", "hidden"].includes(body.vis)
        || body.save !== undefined && typeof body.save !== "boolean"
        || body.includeArtifact !== undefined && body.includeArtifact !== true
        || args.confirmation !== undefined && (typeof args.confirmation !== "string" || !args.confirmation))
        fail();
    return { body: { ...body, includeArtifact: true }, confirmation: args.confirmation };
}
/** Current creation uses delegated scope; returned proof verifies before local
 * custody. Remote save precedes delivery in the route and cannot be undone here. */
export function createReceizCurrentRecordOperations(input) {
    const consent = createReceizSdkMutationConsent();
    return { async call(raw) {
            const args = argumentsFor(raw);
            input.ensureDelegated();
            const preview = consent("connect.record", { body: args.body }, args.confirmation);
            if (preview)
                return { result: preview, transferToken: undefined };
            try {
                const response = await input.client.connect.record(args.body);
                if (!(response.artifact instanceof Blob) || response.artifact.type !== "image/png" || !response.artifact.size)
                    throw Error("connect_record_artifact_invalid");
                const exactBytes = new Uint8Array(await response.artifact.arrayBuffer());
                const artifactSha256 = createHash("sha256").update(exactBytes).digest("hex");
                const filename = `record-${artifactSha256.slice(0, 24)}.png`;
                const verification = await verifyReceizOfflineSealedFile({ bytes: exactBytes, filename, mimeType: response.artifact.type });
                if (!verification.ok || !verification.integrity.ok || verification.kind !== "png"
                    || createHash("sha256").update(exactBytes).digest("hex") !== artifactSha256)
                    throw Error("connect_record_enclosing_verification_failed");
                const output = await persistReceizSealedOutput(input.workspace, { exactBytes, filename, mimeType: response.artifact.type });
                const transferToken = registerReceizSealedOutput(input.runtime, output.artifactReference, output.artifactSha256, { exactBytes, filename, mimeType: response.artifact.type });
                return { result: { ...output, recordProjection: { saved: response.saved, visibility: response.visibility,
                            showOnProfile: response.showOnProfile, source: "connect-response-headers", proofAuthority: false } }, transferToken };
            }
            catch (cause) {
                // Consent has already been consumed. A saved/showcase append may have
                // occurred before output failed; never advertise zero remote writes.
                throw Error("connect_record_execution_outcome_unknown", { cause });
            }
        } };
}
//# sourceMappingURL=currentRecordOperations.js.map