Configuration

Quick summary

Edit devpay.json for the target and API base. The .devpay/ directory contains generated plans, evidence, and potentially secrets; do not commit it.

Credentials live outside the project in a user-only directory. Only use the environment overrides documented below.

devpay.json — the only config file

Lives at the project root (found in the project directory only — the CLI does not walk up). Shape, from lib/config.mjs:

{
  "version": 1,
  "project": { "id": "my-app", "name": "my-app", "type": "js|nuxt|rust|unknown" },
  "api":     { "base_url": "http://127.0.0.1:8787" },
  "protect": {
    "target":         "src/paid.mjs",
    "driver":         "src/driver.mjs",
    "vectors":        "devpay/vectors.json",
    "spec":           ".devpay/spec.json",
    "partition_auth": "dev-open",
    "port":           4930
  },
  "out_dir": ".devpay"
}

Field	Default	Meaning
version	1	Config schema version.
project.id / project.name / project.type	detected	Project identity; type is js|nuxt|rust|unknown.
api.base_url	http://127.0.0.1:8787	DevPay API base for platform commands and the verify API leg.
protect.target	—	Module to protect. Required for plan (.mjs/.js/.wasm).
protect.driver	null	Optional dynamic-analysis driver module.
protect.vectors	null	Optional equivalence-vectors file.
protect.spec	.devpay/spec.json	Approved spec path (the draft lives next to it as spec.draft.json).
protect.partition_auth	dev-open	Generated-server auth: dev-open | yp-license.
protect.port	4930	Generated partition-server loopback port.
out_dir	.devpay	Generated workspace (evidence, partitions, reports).

Containment rules (fail closed)

• out_dir must resolve inside the project root — a .. or absolute escape is refused with exit 2 (it would scatter pipeline artifacts and generated secrets outside the guard boundary).
• Every protect.* path (target, driver, vectors, spec) must also resolve inside the project root — a malicious devpay.json must not aim the pipeline at files outside the project, since target/driver are executed and spec/vectors are read as trusted input.

.devpay/ — the generated workspace

Safe to delete and regenerate; devpay.json is the source of truth.

Path	Producer
<name>.analysis.json	protect plan (analyzer)
spec.draft.json / spec.overrides.json	protect plan
plan.json	protect plan — sha-bound ProtectionPlan
apply-report.json	protect apply
verify-report.json	protect verify
state.json	pipeline state — plan_sha256, spec_sha256, target_sha256, updated_at
partitions/	generated server + partitioned client
evidence/	schema-valid evidence records

Credentials

auth login writes one credential file:

$XDG_CONFIG_HOME/yp/credentials.json   (when XDG_CONFIG_HOME is set)
~/.yp/credentials.json                 (otherwise)

Directory 0700, file 0600. YP_CONFIG_DIR overrides the directory (tests/CI — keep it out of the workspace). The stored shape depends on what the backend actually returned:

Backend	Login response	Stored type	Sent as
be-cloudflare	{ok, token(JWT), …}	bearer	Authorization: Bearer …
be/ (Axum)	{ok, role, …} — no token	dev-user	X-Dev-User: <email>

--api-base used at login is stored and becomes the default API base for later commands; a flag or api.base_url still overrides it.

dev-user is dev-auth

X-Dev-User only authenticates on dev-auth deployments — production backends reject it with 401, which the CLI surfaces honestly (exit 1/3), never retries around.

Environment variables

Variable	Used by
YP_EMAIL / YP_PASSWORD	auth login non-interactive credentials.
YP_CONFIG_DIR	Credential directory override (tests/CI).
YP_CLI	yp-mcp: explicit path to a devpay.mjs.
DEVPAY_MCP_WORKSPACE	yp-mcp: workspace root fallback (after --workspace, before cwd).
DEVPAY_MCP_CLI_TIMEOUT_MS	yp-mcp: per-call CLI timeout (default 600000).
DEVPAY_ISSUER / DEVPAY_AUDIENCE	Consumed by generated partition servers (yp-license auth); forwarded through the yp-mcp env allowlist.
PARTITION_*	The designed user→partition channel — generated partition servers read PARTITION_AUTH, PARTITION_DEV_OPEN, PARTITION_LICENSE_SEED, PARTITION_SECRET_* etc.