@gwilll/vouch-mcp 0.1.0 → 0.1.1

package/dist/index.js

@@ -1,32 +1,780 @@
+// src/index.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { createServer as createHttpServer } from "node:http";
-import { loadConfig } from "./config.js";
-import { createServer } from "./server.js";
-export { createServer } from "./server.js";
-export { VouchClient, VouchError } from "./client.js";
-export { loadConfig } from "./config.js";
-/** Entry point: stdio by default; `VOUCH_HTTP_PORT=…` serves Streamable HTTP at /mcp instead. */
-export async function main() {
-    const cfg = loadConfig();
-    if (cfg.VOUCH_HTTP_PORT) {
-        const { StreamableHTTPServerTransport } = await import("@modelcontextprotocol/sdk/server/streamableHttp.js");
-        const http = createHttpServer(async (req, res) => {
-            if (!req.url?.startsWith("/mcp")) {
-                res.writeHead(404).end();
-                return;
-            }
-            // Stateless: one server + transport per request.
-            const server = createServer(cfg);
-            const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
-            res.on("close", () => { void transport.close(); void server.close(); });
-            await server.connect(transport);
-            await transport.handleRequest(req, res);
+
+// src/config.ts
+import { z } from "zod";
+var Schema = z.object({
+  VOUCH_API_URL: z.string().url().default("https://vouch.dev"),
+  VOUCH_API_KEY: z.string().optional(),
+  VOUCH_AGENT_PRIVATE_KEY: z.string().regex(/^0x[0-9a-fA-F]{64}$/).optional(),
+  VOUCH_DEFAULT_CHAIN: z.coerce.number().default(4217),
+  VOUCH_MAX_PAYMENT: z.string().default("100"),
+  // display units; the payer's own cap per fund call
+  VOUCH_HTTP_PORT: z.coerce.number().optional()
+});
+function loadConfig(env = process.env) {
+  const r = Schema.safeParse(env);
+  if (!r.success) {
+    const issues = r.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
+    throw new Error(`Invalid Vouch MCP configuration: ${issues}`);
+  }
+  return r.data;
+}
+
+// src/server.ts
+import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z as z4 } from "zod";
+
+// ../shared/dist/chains.js
+var TEMPO_MAINNET_ID = 4217;
+var TEMPO_MODERATO_ID = 42431;
+var BASE_MAINNET_ID = 8453;
+var BASE_SEPOLIA_ID = 84532;
+var TOKENS = {
+  [TEMPO_MAINNET_ID]: [
+    { address: "0x20C0000000000000000000000000000000000000", symbol: "pathUSD", name: "pathUSD", decimals: 6, eip3009: false, tip20: true },
+    { address: "0x20C000000000000000000000b9537d11c60E8b50", symbol: "USDC.e", name: "Bridged USDC", decimals: 6, eip3009: false, tip20: true }
+  ],
+  [TEMPO_MODERATO_ID]: [
+    { address: "0x20C0000000000000000000000000000000000000", symbol: "pathUSD", name: "pathUSD (testnet)", decimals: 6, eip3009: false, tip20: true },
+    { address: "0x20C000000000000000000000b9537d11c60E8b50", symbol: "USDC.e", name: "Bridged USDC (testnet)", decimals: 6, eip3009: false, tip20: true }
+  ],
+  [BASE_MAINNET_ID]: [
+    { address: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", symbol: "USDC", name: "USD Coin", decimals: 6, eip3009: true, tip20: false }
+  ],
+  [BASE_SEPOLIA_ID]: [
+    { address: "0x036CbD53842c5426634e7929541eC2318f3dCF7e", symbol: "USDC", name: "USD Coin (testnet)", decimals: 6, eip3009: true, tip20: false }
+  ]
+};
+var CHAINS = {
+  [TEMPO_MAINNET_ID]: { id: TEMPO_MAINNET_ID, name: "Tempo", shortName: "Tempo", rpcUrl: "https://rpc.tempo.xyz", explorer: "https://explore.mainnet.tempo.xyz", testnet: false, feeSponsorship: true },
+  [TEMPO_MODERATO_ID]: { id: TEMPO_MODERATO_ID, name: "Tempo Moderato", shortName: "Tempo testnet", rpcUrl: "https://rpc.moderato.tempo.xyz", explorer: "https://explore.moderato.tempo.xyz", testnet: true, feeSponsorship: true },
+  [BASE_MAINNET_ID]: { id: BASE_MAINNET_ID, name: "Base", shortName: "Base", rpcUrl: "https://mainnet.base.org", explorer: "https://basescan.org", testnet: false, feeSponsorship: false },
+  [BASE_SEPOLIA_ID]: { id: BASE_SEPOLIA_ID, name: "Base Sepolia", shortName: "Base testnet", rpcUrl: "https://sepolia.base.org", explorer: "https://sepolia.basescan.org", testnet: true, feeSponsorship: false }
+};
+
+// ../shared/dist/policy.js
+import { z as z2 } from "zod";
+var ZERO_EARN_VAULT = "0x0000000000000000000000000000000000000000";
+var AddressField = z2.string().regex(/^0x[0-9a-fA-F]{40}$/, "address expected");
+var PolicySchema = z2.object({
+  autoRelease: z2.union([z2.literal(0), z2.literal(1), z2.literal(2)]),
+  minConfidenceBps: z2.number().int().min(0).max(1e4),
+  maxAutoAmount: z2.bigint().nonnegative(),
+  reviewWindow: z2.number().int().min(0).max(2 ** 32 - 1),
+  submitDeadline: z2.number().int().min(0).max(2 ** 32 - 1),
+  /** Allow-listed Tempo Earn vault that holds the locked principal ("Earn while locked"); zero address = off. */
+  earnVault: AddressField.default(ZERO_EARN_VAULT)
+});
+var PolicyWireSchema = z2.object({
+  autoRelease: z2.union([z2.literal(0), z2.literal(1), z2.literal(2)]),
+  minConfidenceBps: z2.number().int().min(0).max(1e4),
+  maxAutoAmount: z2.string().regex(/^\d+$/),
+  reviewWindow: z2.number().int().min(0),
+  submitDeadline: z2.number().int().min(0),
+  earnVault: AddressField.default(ZERO_EARN_VAULT)
+});
+var POLICY_PRESET_NAMES = ["manual", "trusted", "autopilot", "custom"];
+var DAY = 86400;
+var POLICY_PRESETS = {
+  manual: { autoRelease: 0, minConfidenceBps: 0, maxAutoAmount: 0n, reviewWindow: 0, submitDeadline: 14 * DAY, earnVault: ZERO_EARN_VAULT },
+  trusted: { autoRelease: 1, minConfidenceBps: 8500, maxAutoAmount: 200000000n, reviewWindow: 3 * DAY, submitDeadline: 14 * DAY, earnVault: ZERO_EARN_VAULT },
+  autopilot: { autoRelease: 1, minConfidenceBps: 9e3, maxAutoAmount: 50000000n, reviewWindow: 1 * DAY, submitDeadline: 7 * DAY, earnVault: ZERO_EARN_VAULT }
+};
+
+// ../shared/dist/commit.js
+import { encodeAbiParameters, keccak256, toHex, stringToHex, pad } from "viem";
+var ZERO_BYTES32 = `0x${"0".repeat(64)}`;
+function normaliseText(s) {
+  return s.replace(/\r\n?/g, "\n").trim();
+}
+function canonicalJson(value) {
+  return JSON.stringify(sortKeys(value));
+}
+function sortKeys(v) {
+  if (Array.isArray(v))
+    return v.map(sortKeys);
+  if (v && typeof v === "object") {
+    return Object.fromEntries(Object.keys(v).sort().map((k) => [k, sortKeys(v[k])]));
+  }
+  return v;
+}
+function deliveryCore(m) {
+  return {
+    jobId: m.jobId.toLowerCase(),
+    submittedBy: m.submittedBy.toLowerCase(),
+    files: m.files.map((f) => ({ name: f.name, sha256: f.sha256.toLowerCase(), size: f.size, contentType: f.contentType })),
+    links: [...m.links],
+    note: normaliseText(m.note)
+  };
+}
+function hashManifest(m) {
+  return keccak256(toHex(canonicalJson(deliveryCore(m))));
+}
+
+// ../shared/dist/schemas.js
+import { z as z3 } from "zod";
+var HexSchema = z3.string().regex(/^0x[0-9a-fA-F]*$/, "hex expected");
+var AddressSchema = z3.string().regex(/^0x[0-9a-fA-F]{40}$/, "address expected");
+var Bytes32Schema = z3.string().regex(/^0x[0-9a-fA-F]{64}$/, "bytes32 expected");
+var AmountSchema = z3.string().regex(/^\d+$/, "base-unit amount expected");
+var ChainIdSchema = z3.union([z3.literal(4217), z3.literal(42431), z3.literal(8453), z3.literal(84532)]);
+var CreateJobInputSchema = z3.object({
+  title: z3.string().min(3).max(120),
+  scopeMd: z3.string().min(10).max(2e4),
+  /** Base units (6 decimals), as a string. */
+  amount: AmountSchema,
+  token: AddressSchema.optional(),
+  chainId: ChainIdSchema.optional(),
+  /** Email, 0x address, or agent URL. Optional: first submitter becomes the worker. */
+  worker: z3.string().max(200).optional(),
+  policyPreset: z3.enum(POLICY_PRESET_NAMES).optional(),
+  policy: PolicyWireSchema.optional(),
+  /** Tempo only: allow-listed Earn vault for "Earn while locked" (GET /earn/vaults). Omit for off. */
+  earnVault: AddressSchema.optional(),
+  /** Seconds the pay link stays valid before the job is considered abandoned (off-chain only). */
+  paymentDeadline: z3.number().int().min(300).max(90 * 86400).optional()
+});
+var FundRouteSchema = z3.object({
+  kind: z3.enum(["balance", "batched", "mpp", "x402", "eip3009", "transfer"]),
+  label: z3.string(),
+  description: z3.string(),
+  /** Endpoint or address relevant to the route. */
+  target: z3.string(),
+  memo: Bytes32Schema.optional()
+});
+var EarnVaultDtoSchema = z3.object({
+  address: AddressSchema,
+  chainId: ChainIdSchema,
+  label: z3.string(),
+  asset: AddressSchema,
+  assetSymbol: z3.string(),
+  venue: z3.string().nullable(),
+  engineType: z3.string().nullable(),
+  /** Net APY as a decimal string ("0.035"), null when the API has no measurement yet. */
+  apy: z3.string().nullable(),
+  tvl: z3.string().nullable(),
+  verified: z3.boolean(),
+  access: z3.string(),
+  /** On-chain allow-list state in the Vouch Vault: the only thing that decides whether a job may use it. */
+  allowed: z3.boolean()
+});
+var JobDtoSchema = z3.object({
+  id: Bytes32Schema,
+  shortId: z3.string(),
+  chainId: ChainIdSchema,
+  title: z3.string(),
+  scopeMd: z3.string(),
+  scopeHash: Bytes32Schema,
+  token: AddressSchema,
+  tokenSymbol: z3.string(),
+  /** Visible to the payer, the worker, and after settlement; null for the public. */
+  amount: AmountSchema.nullable(),
+  payer: AddressSchema.nullable(),
+  worker: AddressSchema.nullable(),
+  workerHint: z3.string().nullable(),
+  status: z3.string(),
+  pill: z3.string(),
+  verdict: z3.enum(["PASS", "NEEDS_REVIEW", "FAIL"]).nullable(),
+  confidenceBps: z3.number().nullable(),
+  policy: PolicyWireSchema,
+  fundedAt: z3.string().nullable(),
+  submittedAt: z3.string().nullable(),
+  attestedAt: z3.string().nullable(),
+  settledAt: z3.string().nullable(),
+  submitDeadlineAt: z3.string().nullable(),
+  autoSettleAt: z3.string().nullable(),
+  resubmits: z3.number(),
+  deliverableHash: Bytes32Schema.nullable(),
+  attestationHash: Bytes32Schema.nullable(),
+  txs: z3.record(z3.string(), z3.string()),
+  payUrl: z3.string(),
+  fundRoutes: z3.array(FundRouteSchema),
+  feeBps: z3.number(),
+  createdAt: z3.string(),
+  updatedAt: z3.string(),
+  role: z3.enum(["payer", "worker", "arbiter", "public"])
+});
+var CreateJobOutputSchema = z3.object({
+  jobId: Bytes32Schema,
+  shortId: z3.string(),
+  commit: Bytes32Schema,
+  payUrl: z3.string(),
+  mcpHint: z3.string(),
+  fundRoutes: z3.array(FundRouteSchema),
+  job: JobDtoSchema
+});
+var SubmitFileSchema = z3.object({
+  name: z3.string().min(1).max(200),
+  contentType: z3.string().max(100),
+  /** base64 payload; ≤ 2 MB per artifact after decoding (spec §7.6). */
+  base64: z3.string().max(28e5)
+});
+var SubmitInputSchema = z3.object({
+  files: z3.array(SubmitFileSchema).max(20).default([]),
+  links: z3.array(z3.string().url().max(500)).max(20).default([]),
+  note: z3.string().max(5e3).default(""),
+  /** Worker address; required when the job has no worker yet and the caller is an API key. */
+  worker: AddressSchema.optional(),
+  /** Optional pre-signed EIP-712 Submit/Resubmit so the relayer can pay gas. */
+  signature: z3.object({ signer: AddressSchema, deadline: z3.string(), signature: HexSchema }).optional()
+});
+var ActionSignatureSchema = z3.object({ signer: AddressSchema, deadline: z3.string(), signature: HexSchema });
+var DisputeInputSchema = z3.object({
+  reason: z3.string().min(10).max(5e3),
+  signature: ActionSignatureSchema.optional()
+});
+var ApproveInputSchema = z3.object({ signature: ActionSignatureSchema.optional() });
+var ResolveInputSchema = z3.object({
+  workerBps: z3.number().int().min(0).max(1e4),
+  note: z3.string().max(5e3).default("")
+});
+var ScopeItemStatus = z3.enum(["met", "partial", "missing", "unverifiable"]);
+var VerdictOutputSchema = z3.object({
+  verdict: z3.enum(["PASS", "NEEDS_REVIEW", "FAIL"]),
+  confidence: z3.number().min(0).max(1),
+  scope_items: z3.array(z3.object({
+    item: z3.string().min(1).max(500),
+    status: ScopeItemStatus,
+    evidence: z3.string().max(2e3)
+  })).min(1).max(50),
+  summary: z3.string().min(1).max(3e3),
+  questions_for_worker: z3.array(z3.string().max(500)).max(20).default([]),
+  red_flags: z3.array(z3.string().max(500)).max(20).default([])
+});
+var VerdictReportSchema = VerdictOutputSchema.extend({
+  version: z3.literal(1),
+  jobId: Bytes32Schema,
+  deliverableHash: Bytes32Schema,
+  scopeHash: Bytes32Schema,
+  model: z3.string(),
+  promptHash: Bytes32Schema,
+  responseHash: Bytes32Schema,
+  contentHashes: z3.array(Bytes32Schema),
+  resubmission: z3.number().int().min(0),
+  createdAt: z3.string(),
+  /** Post-rule adjustments applied by the service (caps), for auditability. */
+  adjustments: z3.array(z3.string())
+});
+var VerdictDtoSchema = z3.object({
+  jobId: Bytes32Schema,
+  verdict: z3.enum(["PASS", "NEEDS_REVIEW", "FAIL"]).nullable(),
+  confidence: z3.number().nullable(),
+  confidenceBps: z3.number().nullable(),
+  scope_items: VerdictOutputSchema.shape.scope_items.nullable(),
+  summary: z3.string().nullable(),
+  questions_for_worker: z3.array(z3.string()),
+  red_flags: z3.array(z3.string()),
+  attestationTx: z3.string().nullable(),
+  attestationHash: Bytes32Schema.nullable(),
+  reportUrl: z3.string().nullable(),
+  stage: z3.enum(["queued", "reading_scope", "checking_files", "writing_report", "attesting", "done", "failed"]).nullable(),
+  autoSettleAt: z3.string().nullable()
+});
+var TimelineEventSchema = z3.object({
+  kind: z3.string(),
+  at: z3.string(),
+  txHash: z3.string().nullable(),
+  chainId: ChainIdSchema.nullable(),
+  detail: z3.string().nullable(),
+  source: z3.enum(["chain", "service"])
+});
+var CreateAgentKeyInputSchema = z3.object({
+  label: z3.string().min(1).max(100),
+  /** Wallet the key is bound to; actions are signed by this wallet (agent holds the private key). */
+  address: AddressSchema,
+  /** Signature over `Vouch API key for <address> at <timestamp>` proving control of the wallet. */
+  timestamp: z3.number().int(),
+  signature: HexSchema
+});
+function agentKeyChallenge(address, timestamp) {
+  return `Vouch API key for ${address.toLowerCase()} at ${timestamp}`;
+}
+var ApiErrorSchema = z3.object({
+  error: z3.object({
+    code: z3.string(),
+    message: z3.string(),
+    next: z3.string().optional(),
+    retryable: z3.boolean().default(false)
+  })
+});
+
+// ../shared/dist/format.js
+import { formatUnits, parseUnits } from "viem";
+function formatAmount(base, opts = {}) {
+  const v = typeof base === "bigint" ? base : BigInt(base);
+  const s = formatUnits(v, 6);
+  const n = Number(s);
+  const text2 = n.toLocaleString("en-US", { minimumFractionDigits: opts.compact ? 0 : 2, maximumFractionDigits: 2 });
+  return opts.symbol ? `${text2} ${opts.symbol}` : `$${text2}`;
+}
+function parseAmount(human) {
+  const t = human.trim().replace(/^\$/, "").replace(/,/g, "");
+  if (!/^\d+(\.\d{1,6})?$/.test(t))
+    throw new Error("Enter an amount with up to 6 decimal places");
+  return parseUnits(t, 6);
+}
+
+// ../shared/dist/zone.js
+import * as Bytes from "ox/Bytes";
+import * as Hex from "ox/Hex";
+import * as PublicKey from "ox/PublicKey";
+import * as Secp256k1 from "ox/Secp256k1";
+var ZERO_MEMO = `0x${"00".repeat(32)}`;
+
+// src/client.ts
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { basename, extname } from "node:path";
+import { privateKeyToAccount } from "viem/accounts";
+import { Mppx, evm, tempo } from "mppx/client";
+var VouchError = class extends Error {
+  constructor(message, code, next) {
+    super(message);
+    this.code = code;
+    this.next = next;
+  }
+  code;
+  next;
+};
+var MIME = {
+  ".md": "text/markdown",
+  ".txt": "text/plain",
+  ".json": "application/json",
+  ".csv": "text/csv",
+  ".html": "text/html",
+  ".pdf": "application/pdf",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".js": "text/javascript",
+  ".ts": "text/typescript",
+  ".py": "text/x-python",
+  ".sol": "text/plain",
+  ".zip": "application/zip"
+};
+var VouchClient = class {
+  constructor(cfg) {
+    this.cfg = cfg;
+    this.account = cfg.VOUCH_AGENT_PRIVATE_KEY ? privateKeyToAccount(cfg.VOUCH_AGENT_PRIVATE_KEY) : null;
+    this.apiKey = cfg.VOUCH_API_KEY;
+  }
+  cfg;
+  account;
+  apiKey;
+  payer = null;
+  get address() {
+    return this.account?.address ?? null;
+  }
+  url(path) {
+    return `${this.cfg.VOUCH_API_URL.replace(/\/$/, "")}/api/v1${path}`;
+  }
+  /** Issue an API key bound to the agent wallet on first use (no login: the wallet is the identity). */
+  async ensureApiKey() {
+    if (this.apiKey) return this.apiKey;
+    if (!this.account) return void 0;
+    const timestamp = Math.floor(Date.now() / 1e3);
+    const signature = await this.account.signMessage({ message: agentKeyChallenge(this.account.address, timestamp) });
+    const res = await fetch(this.url("/agents/keys"), {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ label: `mcp ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}`, address: this.account.address, timestamp, signature })
+    });
+    const data = await res.json();
+    if (!res.ok || !data.key) throw new VouchError(data.error?.message ?? "could not create API key", "key_error");
+    this.apiKey = data.key;
+    return this.apiKey;
+  }
+  async request(method, path, body, extraHeaders = {}) {
+    const key = await this.ensureApiKey();
+    const res = await fetch(this.url(path), {
+      method,
+      // x-api-key (not Authorization) so the MPP `Authorization: Payment …` credential can coexist on /fund.
+      headers: { "content-type": "application/json", ...key ? { "x-api-key": key } : {}, ...extraHeaders },
+      body: body === void 0 ? void 0 : JSON.stringify(body)
+    });
+    const text2 = await res.text();
+    let data = {};
+    try {
+      data = text2 ? JSON.parse(text2) : {};
+    } catch {
+      data = { raw: text2 };
+    }
+    if (!res.ok) {
+      const err = data.error;
+      throw new VouchError(err?.message ?? `HTTP ${res.status}`, err?.code ?? `http_${res.status}`, err?.next);
+    }
+    return data;
+  }
+  // ---- jobs ----
+  createJob(input) {
+    return this.request("POST", "/jobs", input);
+  }
+  getJob(id) {
+    return this.request("GET", `/jobs/${id}`);
+  }
+  listJobs(status) {
+    return this.request("GET", `/jobs${status ? `?status=${encodeURIComponent(status)}` : ""}`);
+  }
+  getVerdict(id) {
+    return this.request("GET", `/jobs/${id}/verdict`);
+  }
+  getTimeline(id) {
+    return this.request("GET", `/jobs/${id}/timeline`);
+  }
+  // ---- payments (MPP on Tempo, x402-compatible evm/charge on Base) ----
+  payerFetch() {
+    if (!this.account) throw new VouchError("VOUCH_AGENT_PRIVATE_KEY is not set.", "no_wallet", "Set VOUCH_AGENT_PRIVATE_KEY to a wallet holding pathUSD (Tempo) or USDC (Base).");
+    if (!this.payer) {
+      const max = this.cfg.VOUCH_MAX_PAYMENT;
+      const mppx = Mppx.create({
+        polyfill: false,
+        methods: [tempo({ account: this.account }), evm({ account: this.account, maxAmount: max })]
+      });
+      this.payer = { fetch: mppx.fetch };
+    }
+    return this.payer.fetch;
+  }
+  /** POST /fund. A 402 is paid automatically by mppx (Tempo charge or EIP-3009), then the 200 comes back. */
+  async fundJob(id) {
+    const key = await this.ensureApiKey();
+    const doFetch = this.payerFetch();
+    const res = await doFetch(this.url(`/jobs/${id}/fund`), {
+      method: "POST",
+      headers: { "content-type": "application/json", ...key ? { "x-api-key": key } : {} },
+      body: "{}"
+    });
+    const data = await res.json().catch(() => ({}));
+    if (res.status === 402) throw new VouchError("Payment required but the wallet could not pay.", "payment_failed", "Check the agent wallet holds enough pathUSD/USDC on the job's chain, or set VOUCH_MAX_PAYMENT higher.");
+    if (!res.ok || !data.job) throw new VouchError(data.error?.message ?? `HTTP ${res.status}`, data.error?.code ?? "fund_failed", data.error?.next);
+    return { status: data.status ?? data.job.status, route: data.route, tx: data.tx, paymentTx: data.paymentTx, job: data.job, note: data.note };
+  }
+  // ---- signed actions ----
+  async signAction(id, action, params) {
+    if (!this.account) throw new VouchError("VOUCH_AGENT_PRIVATE_KEY is not set.", "no_wallet");
+    const qs = new URLSearchParams({ action, signer: this.account.address, ...params }).toString();
+    const { typedData } = await this.request("GET", `/jobs/${id}/sign?${qs}`);
+    const message = Object.fromEntries(Object.entries(typedData.message).map(([k, v]) => [k, k === "nonce" || k === "deadline" ? BigInt(v) : v]));
+    const signature = await this.account.signTypedData({
+      domain: typedData.domain,
+      types: typedData.types,
+      primaryType: typedData.primaryType,
+      message
+    });
+    return { signer: this.account.address, deadline: typedData.message.deadline, signature };
+  }
+  async submitDelivery(id, input, resubmit = false) {
+    if (!this.account) throw new VouchError("VOUCH_AGENT_PRIVATE_KEY is not set.", "no_wallet");
+    const files = [];
+    const payload = [];
+    for (const path of input.files) {
+      const bytes = await readFile(path);
+      const sha256 = `0x${createHash("sha256").update(bytes).digest("hex")}`;
+      const contentType = MIME[extname(path).toLowerCase()] ?? "application/octet-stream";
+      files.push({ name: basename(path), sha256, size: bytes.length, contentType });
+      payload.push({ name: basename(path), contentType, base64: bytes.toString("base64") });
+    }
+    const core = { jobId: id, submittedBy: this.account.address, files, links: input.links, note: input.note };
+    const deliverableHash = hashManifest(core);
+    const signature = await this.signAction(id, resubmit ? "Resubmit" : "Submit", { deliverableHash });
+    return this.request(
+      "POST",
+      `/jobs/${id}/${resubmit ? "resubmit" : "submit"}`,
+      { files: payload, links: input.links, note: input.note, worker: this.account.address, signature }
+    );
+  }
+  async approve(id) {
+    const signature = await this.signAction(id, "Settle", {});
+    return this.request("POST", `/jobs/${id}/approve`, { signature });
+  }
+  async dispute(id, reason) {
+    const signature = await this.signAction(id, "Dispute", { reason });
+    return this.request("POST", `/jobs/${id}/dispute`, { reason, signature });
+  }
+  /** Poll until the verifier is done (or a timeout). */
+  async waitForVerdict(id, timeoutMs = 18e4, intervalMs = 5e3) {
+    const deadline = Date.now() + timeoutMs;
+    let last = null;
+    while (Date.now() < deadline) {
+      last = await this.getVerdict(id);
+      if (last.stage === "done" || last.stage === "failed") return last;
+      await new Promise((r) => setTimeout(r, intervalMs));
+    }
+    return last ?? await this.getVerdict(id);
+  }
+};
+
+// src/server.ts
+var text = (v) => ({ content: [{ type: "text", text: typeof v === "string" ? v : JSON.stringify(v, null, 2) }] });
+var fail = (e) => {
+  const err = e instanceof VouchError ? e : e instanceof Error ? new VouchError(e.message, "error") : new VouchError(String(e), "error");
+  return { isError: true, content: [{ type: "text", text: JSON.stringify({ error: err.code, message: err.message, next: err.next }, null, 2) }] };
+};
+function summarise(job) {
+  return {
+    jobId: job.id,
+    shortId: job.shortId,
+    title: job.title,
+    status: job.status,
+    pill: job.pill,
+    chainId: job.chainId,
+    amount: job.amount ? formatAmount(job.amount, { symbol: job.tokenSymbol }) : null,
+    verdict: job.verdict,
+    confidence: job.confidenceBps != null ? job.confidenceBps / 1e4 : null,
+    autoSettleAt: job.autoSettleAt,
+    payUrl: job.payUrl,
+    txs: job.txs,
+    yourRole: job.role
+  };
+}
+function createServer(cfg) {
+  const client = new VouchClient(cfg);
+  const server = new McpServer({ name: "vouch", version: "0.1.1" });
+  server.registerTool(
+    "vouch_create_job",
+    {
+      title: "Create a Vouch job",
+      description: 'Lock stablecoins against a written scope. Returns a jobId to fund with vouch_fund_job, a pay link for humans, and the fund routes. Amount is in dollars (e.g. "5" or "12.50"). Policy presets: manual (you approve), trusted (auto-pay on PASS \u226585% after 3 days, \u2264$200), autopilot (auto-pay on PASS \u226590% after 1 day, \u2264$50).',
+      inputSchema: {
+        title: z4.string().min(3).max(120).describe("Short job title"),
+        scope: z4.string().min(10).max(2e4).describe("The scope in markdown: deliverables, format, deadline, out of scope. This is the contract the verifier checks against."),
+        amount: z4.string().describe('Amount in dollars, e.g. "5" or "12.50"'),
+        chainId: z4.number().int().optional().describe("4217 Tempo (default), 42431 Tempo testnet, 8453 Base, 84532 Base Sepolia"),
+        token: z4.string().optional().describe("Token address; defaults to pathUSD on Tempo, USDC on Base"),
+        worker: z4.string().optional().describe("Worker wallet address, email or agent URL. Leave empty to let the first submitter take the job."),
+        policyPreset: z4.enum(POLICY_PRESET_NAMES).optional().describe("manual | trusted | autopilot | custom"),
+        policy: z4.object({ autoRelease: z4.number().int().min(0).max(2), minConfidenceBps: z4.number().int().min(0).max(1e4), maxAutoAmount: z4.string(), reviewWindow: z4.number().int(), submitDeadline: z4.number().int() }).optional(),
+        earnVault: z4.string().optional().describe("Tempo only: Earn vault address for 'Earn while locked' \u2014 the locked principal earns yield for the payer while the work happens. Use vouch_list_earn_vaults to pick one. Omit for off.")
+      }
+    },
+    async (args) => {
+      try {
+        const amount = parseAmount(args.amount).toString();
+        const r = await client.createJob({
+          title: args.title,
+          scopeMd: args.scope,
+          amount,
+          chainId: args.chainId ?? cfg.VOUCH_DEFAULT_CHAIN,
+          token: args.token,
+          worker: args.worker,
+          policyPreset: args.policyPreset,
+          policy: args.policy,
+          earnVault: args.earnVault
         });
-        http.listen(cfg.VOUCH_HTTP_PORT, () => console.error(`vouch-mcp listening on http://localhost:${cfg.VOUCH_HTTP_PORT}/mcp`));
-        return;
+        return text({ jobId: r.jobId, shortId: r.shortId, payUrl: r.payUrl, nextStep: `Call vouch_fund_job with jobId ${r.jobId} to lock the funds.`, fundRoutes: r.fundRoutes, job: summarise(r.job) });
+      } catch (e) {
+        return fail(e);
+      }
+    }
+  );
+  server.registerTool(
+    "vouch_fund_job",
+    {
+      title: "Fund a Vouch job",
+      description: "Lock the job's amount in the vault from the agent wallet (VOUCH_AGENT_PRIVATE_KEY). On Tempo this pays an MPP charge (TIP-20 transfer with memo = jobId, fees sponsored); on Base an x402/EIP-3009 authorisation. If the wallet already has a Vouch balance, no payment is taken. Returns the funding transaction.",
+      inputSchema: { jobId: z4.string().describe("The job id (0x\u2026 or short id)") }
+    },
+    async ({ jobId }) => {
+      try {
+        const r = await client.fundJob(jobId);
+        return text({ status: r.status, route: r.route, fundTx: r.tx, paymentTx: r.paymentTx, note: r.note, job: summarise(r.job) });
+      } catch (e) {
+        return fail(e);
+      }
+    }
+  );
+  server.registerTool(
+    "vouch_submit_delivery",
+    {
+      title: "Submit a delivery",
+      description: "Deliver work for a funded job as the worker (agent wallet). Files are read from local paths, fingerprinted (sha256) and pinned before review; links and a note are included. Signs the on-chain Submit with the agent wallet. The verifier runs automatically afterwards \u2014 call vouch_get_verdict to read the result.",
+      inputSchema: {
+        jobId: z4.string(),
+        files: z4.array(z4.string()).default([]).describe("Local file paths (\u2264 2 MB each)"),
+        links: z4.array(z4.string().url()).default([]).describe("URLs: GitHub repos/PRs, Figma files, documents"),
+        note: z4.string().default("").describe("Message to the payer / verifier"),
+        resubmit: z4.boolean().default(false).describe("true when resubmitting after a FAIL verdict")
+      }
+    },
+    async (args) => {
+      try {
+        const r = await client.submitDelivery(args.jobId, { files: args.files, links: args.links, note: args.note }, args.resubmit);
+        return text({ status: r.status, tx: r.tx, deliverableHash: r.deliverableHash, verifier: r.verifier, nextStep: "Call vouch_get_verdict (it polls until the verifier finishes).", job: summarise(r.job) });
+      } catch (e) {
+        return fail(e);
+      }
+    }
+  );
+  server.registerTool(
+    "vouch_get_verdict",
+    {
+      title: "Get the verification verdict",
+      description: "Verdict (PASS | NEEDS_REVIEW | FAIL), confidence, per-scope-item checklist with evidence, questions for the worker, red flags, attestation tx and full report URL. Waits up to `waitSeconds` for the verifier to finish.",
+      inputSchema: { jobId: z4.string(), waitSeconds: z4.number().int().min(0).max(600).default(120) }
+    },
+    async ({ jobId, waitSeconds }) => {
+      try {
+        const v = waitSeconds > 0 ? await client.waitForVerdict(jobId, waitSeconds * 1e3) : await client.getVerdict(jobId);
+        return text(v);
+      } catch (e) {
+        return fail(e);
+      }
+    }
+  );
+  server.registerTool(
+    "vouch_approve",
+    {
+      title: "Approve and pay",
+      description: "As the payer, release payment to the worker now (signs a Settle authorisation with the agent wallet; Vouch relays it). Use after reading the verdict, or to pay early.",
+      inputSchema: { jobId: z4.string() }
+    },
+    async ({ jobId }) => {
+      try {
+        const r = await client.approve(jobId);
+        return text({ status: r.status, tx: r.tx, job: summarise(r.job) });
+      } catch (e) {
+        return fail(e);
+      }
+    }
+  );
+  server.registerTool(
+    "vouch_dispute",
+    {
+      title: "Open a dispute",
+      description: "Either party objects to the delivery or the verdict. An arbiter reviews the same pinned evidence and splits the locked amount. Give a concrete reason (\u2265 10 characters).",
+      inputSchema: { jobId: z4.string(), reason: z4.string().min(10).max(5e3) }
+    },
+    async ({ jobId, reason }) => {
+      try {
+        const r = await client.dispute(jobId, reason);
+        return text({ status: r.status, tx: r.tx, job: summarise(r.job) });
+      } catch (e) {
+        return fail(e);
+      }
     }
-    const server = createServer(cfg);
-    await server.connect(new StdioServerTransport());
-    console.error(`vouch-mcp ready (stdio) → ${cfg.VOUCH_API_URL}`);
+  );
+  server.registerTool(
+    "vouch_get_job",
+    { title: "Get a job", description: "Current status, pill, policy, timestamps, transactions and your role on the job.", inputSchema: { jobId: z4.string(), includeTimeline: z4.boolean().default(false) } },
+    async ({ jobId, includeTimeline }) => {
+      try {
+        const { job } = await client.getJob(jobId);
+        const timeline = includeTimeline ? (await client.getTimeline(jobId)).events : void 0;
+        return text({ ...summarise(job), scope: job.scopeMd, policy: job.policy, submitDeadlineAt: job.submitDeadlineAt, fundRoutes: job.fundRoutes, timeline });
+      } catch (e) {
+        return fail(e);
+      }
+    }
+  );
+  server.registerTool(
+    "vouch_list_jobs",
+    { title: "List my jobs", description: "Jobs where the agent wallet is payer or worker.", inputSchema: { status: z4.string().optional().describe("Filter: Open | Funded | Submitted | Attested | Settled | Disputed | Resolved | Refunded") } },
+    async ({ status }) => {
+      try {
+        const { jobs } = await client.listJobs(status);
+        return text({ count: jobs.length, jobs: jobs.map(summarise) });
+      } catch (e) {
+        return fail(e);
+      }
+    }
+  );
+  server.registerTool(
+    "vouch_list_earn_vaults",
+    { title: "List Earn vaults", description: "Tempo Earn vaults a job may use for 'Earn while locked': label, venue, APY, and whether the Vouch vault allow-lists it on-chain.", inputSchema: { chainId: z4.number().int().optional() } },
+    async ({ chainId }) => {
+      try {
+        const r = await client.request("GET", `/earn/vaults?chainId=${chainId ?? cfg.VOUCH_DEFAULT_CHAIN}`);
+        return text(r);
+      } catch (e) {
+        return fail(e);
+      }
+    }
+  );
+  server.registerResource(
+    "job",
+    new ResourceTemplate("vouch://job/{id}", { list: void 0 }),
+    { title: "Vouch job", description: "Job status, scope and policy as JSON", mimeType: "application/json" },
+    async (uri, { id }) => {
+      const { job } = await client.getJob(String(id));
+      return { contents: [{ uri: uri.href, mimeType: "application/json", text: JSON.stringify(job, null, 2) }] };
+    }
+  );
+  server.registerResource(
+    "verdict",
+    new ResourceTemplate("vouch://verdict/{id}", { list: void 0 }),
+    { title: "Vouch verdict", description: "Verifier report for a job as JSON", mimeType: "application/json" },
+    async (uri, { id }) => {
+      const v = await client.getVerdict(String(id));
+      return { contents: [{ uri: uri.href, mimeType: "application/json", text: JSON.stringify(v, null, 2) }] };
+    }
+  );
+  server.registerPrompt(
+    "hire_for_task",
+    {
+      title: "Hire for a task",
+      description: "Guides an agent through create \u2192 fund \u2192 wait \u2192 verdict \u2192 approve/dispute for a piece of work.",
+      argsSchema: { task: z4.string().describe("What you need done"), budget: z4.string().describe("Dollar budget, e.g. 5"), worker: z4.string().optional().describe("Worker address/URL if known") }
+    },
+    ({ task, budget, worker }) => ({
+      messages: [
+        {
+          role: "user",
+          content: {
+            type: "text",
+            text: [
+              `You are hiring for: ${task}. Budget: $${budget}.${worker ? ` Worker: ${worker}.` : ""}`,
+              "",
+              "Follow these steps with the vouch_* tools:",
+              "1. Write a precise scope in markdown with sections: Deliverables, Format, Deadline, Out of scope. Be concrete: the verifier checks each line.",
+              '2. vouch_create_job with that scope, the budget, and policyPreset "autopilot" (or "trusted" if budget > $50). Share the payUrl if a human worker needs it.',
+              "3. vouch_fund_job to lock the money. Tell the worker the jobId.",
+              "4. When the worker delivers, vouch_get_verdict (it waits for the verifier).",
+              "5. If PASS and the policy auto-settles, do nothing \u2014 the vault pays after the review window. If you are satisfied earlier, vouch_approve.",
+              "6. If NEEDS_REVIEW, read the checklist and questions_for_worker; either vouch_approve, ask the worker to resubmit, or vouch_dispute with a specific reason.",
+              "7. If FAIL, wait for a resubmission (max 2) or let the delivery deadline refund you.",
+              "Report every jobId, verdict and transaction hash you receive."
+            ].join("\n")
+          }
+        }
+      ]
+    })
+  );
+  return server;
+}
+
+// src/index.ts
+async function main() {
+  const cfg = loadConfig();
+  if (cfg.VOUCH_HTTP_PORT) {
+    const { StreamableHTTPServerTransport } = await import("@modelcontextprotocol/sdk/server/streamableHttp.js");
+    const http = createHttpServer(async (req, res) => {
+      if (!req.url?.startsWith("/mcp")) {
+        res.writeHead(404).end();
+        return;
+      }
+      const server2 = createServer(cfg);
+      const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: void 0 });
+      res.on("close", () => {
+        void transport.close();
+        void server2.close();
+      });
+      await server2.connect(transport);
+      await transport.handleRequest(req, res);
+    });
+    http.listen(cfg.VOUCH_HTTP_PORT, () => console.error(`vouch-mcp listening on http://localhost:${cfg.VOUCH_HTTP_PORT}/mcp`));
+    return;
+  }
+  const server = createServer(cfg);
+  await server.connect(new StdioServerTransport());
+  console.error(`vouch-mcp ready (stdio) \u2192 ${cfg.VOUCH_API_URL}`);
 }
-//# sourceMappingURL=index.js.map
+export {
+  VouchClient,
+  VouchError,
+  createServer,
+  loadConfig,
+  main
+};