@muhaven/mcp 0.1.0

package/dist/index.js

@@ -0,0 +1,1942 @@
+import { unlink, readFile, mkdir, chmod, writeFile, stat } from 'fs/promises';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+import { z, ZodError } from 'zod';
+import { platform, homedir } from 'os';
+import { connect, createServer } from 'net';
+import { createHash } from 'crypto';
+import { keccak256, toBytes } from 'viem';
+import { privateKeyToAccount } from 'viem/accounts';
+
+// src/server.ts
+var DEFAULT_BACKEND_URL = "https://api.muhaven.app";
+var DEFAULT_DASHBOARD_URL = "https://muhaven.app";
+var DEFAULT_REQUEST_TIMEOUT_MS = 15e3;
+var DEFAULT_BROKER_TIMEOUT_MS = 5e3;
+var DEFAULT_BROKER_MAX_BYTES = 64 * 1024;
+var DEFAULT_JWT_CACHE_TTL_SEC = 30;
+function defaultBrokerEndpoint() {
+  if (platform() === "win32") {
+    const user = process.env.USERNAME ?? "default";
+    const sanitized = user.replace(/[^A-Za-z0-9_-]/g, "_");
+    return `\\\\.\\pipe\\muhaven-broker-${sanitized}`;
+  }
+  return join(homedir(), ".muhaven", "broker.sock");
+}
+function readEnv(name, env) {
+  const value = env[name];
+  if (value === void 0 || value === "") return void 0;
+  return value;
+}
+function readEnvBool(name, defaultValue, env) {
+  const raw = readEnv(name, env);
+  if (raw === void 0) return defaultValue;
+  return /^(1|true|yes|on)$/i.test(raw);
+}
+function readEnvInt(name, defaultValue, env) {
+  const raw = readEnv(name, env);
+  if (raw === void 0) return defaultValue;
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    throw new Error(`${name} must be a positive integer (got "${raw}")`);
+  }
+  return parsed;
+}
+function deriveAllowedHosts(baseUrl) {
+  try {
+    const u = new URL(baseUrl);
+    return [u.host];
+  } catch {
+    throw new Error(`MUHAVEN_BACKEND_URL is not a valid URL (got "${baseUrl}")`);
+  }
+}
+function trimTrailingSlash(s) {
+  return s.endsWith("/") ? s.slice(0, -1) : s;
+}
+function loadMcpConfig(env = process.env) {
+  const backendBaseUrl = trimTrailingSlash(env.MUHAVEN_BACKEND_URL ?? DEFAULT_BACKEND_URL);
+  const dashboardBaseUrl = trimTrailingSlash(env.MUHAVEN_DASHBOARD_URL ?? DEFAULT_DASHBOARD_URL);
+  const brokerEndpoint = env.MUHAVEN_BROKER_ENDPOINT ?? defaultBrokerEndpoint();
+  const readOnly = readEnvBool("MUHAVEN_READ_ONLY", false, env);
+  const requestTimeoutMs = readEnvInt("MUHAVEN_REQUEST_TIMEOUT_MS", DEFAULT_REQUEST_TIMEOUT_MS, env);
+  const brokerTimeoutMs = readEnvInt("MUHAVEN_BROKER_TIMEOUT_MS", DEFAULT_BROKER_TIMEOUT_MS, env);
+  const jwtCacheTtlSec = readEnvInt("MUHAVEN_JWT_CACHE_TTL_SEC", DEFAULT_JWT_CACHE_TTL_SEC, env);
+  return {
+    backendBaseUrl,
+    dashboardBaseUrl,
+    brokerEndpoint,
+    readOnly,
+    requestTimeoutMs,
+    brokerTimeoutMs,
+    allowedBackendHosts: deriveAllowedHosts(backendBaseUrl),
+    jwtCacheTtlSec
+  };
+}
+var PRIVKEY_HEX_RE = /^0x[0-9a-fA-F]{64}$/;
+function loadBrokerConfig(env = process.env) {
+  const sessionKeyHex = env.MUHAVEN_BROKER_SESSION_KEY;
+  if (!sessionKeyHex) {
+    throw new Error(
+      "MUHAVEN_BROKER_SESSION_KEY is required (0x-prefixed 32-byte hex). Mint a session key via the dashboard policy-template install flow."
+    );
+  }
+  if (!PRIVKEY_HEX_RE.test(sessionKeyHex)) {
+    throw new Error("MUHAVEN_BROKER_SESSION_KEY must be a 0x-prefixed 32-byte hex string");
+  }
+  const endpoint = env.MUHAVEN_BROKER_ENDPOINT ?? defaultBrokerEndpoint();
+  const maxRequestBytes = readEnvInt("MUHAVEN_BROKER_MAX_BYTES", DEFAULT_BROKER_MAX_BYTES, env);
+  const requestTimeoutMs = readEnvInt("MUHAVEN_BROKER_TIMEOUT_MS", DEFAULT_BROKER_TIMEOUT_MS, env);
+  return {
+    endpoint,
+    sessionKeyHex,
+    maxRequestBytes,
+    requestTimeoutMs
+  };
+}
+var BrokerClientError = class extends Error {
+  constructor(code, message, cause) {
+    super(message);
+    this.code = code;
+    this.cause = cause;
+    this.name = "BrokerClientError";
+  }
+  code;
+  cause;
+};
+var BrokerClient = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  async hello() {
+    const res = await this.exchange({ type: "hello" });
+    if (res.type !== "hello") {
+      throw new BrokerClientError("protocol_error", `expected hello response, got ${res.type}`);
+    }
+    return res;
+  }
+  async signHash(hash, intent) {
+    const res = await this.exchange({
+      type: "sign_hash",
+      hash,
+      ...intent ? { intent } : {}
+    });
+    if (res.type !== "sign_hash") {
+      throw new BrokerClientError(
+        "protocol_error",
+        `expected sign_hash response, got ${res.type}`
+      );
+    }
+    return res;
+  }
+  async storeJwt(jwt, expiresAtSec) {
+    const res = await this.exchange({
+      type: "store_jwt",
+      jwt,
+      ...expiresAtSec === void 0 ? {} : { expiresAtSec }
+    });
+    if (res.type !== "store_jwt") {
+      throw new BrokerClientError(
+        "protocol_error",
+        `expected store_jwt response, got ${res.type}`
+      );
+    }
+    return res;
+  }
+  async getJwt() {
+    const res = await this.exchange({ type: "get_jwt" });
+    if (res.type !== "get_jwt") {
+      throw new BrokerClientError(
+        "protocol_error",
+        `expected get_jwt response, got ${res.type}`
+      );
+    }
+    return res;
+  }
+  async clearJwt() {
+    const res = await this.exchange({ type: "clear_jwt" });
+    if (res.type !== "clear_jwt") {
+      throw new BrokerClientError(
+        "protocol_error",
+        `expected clear_jwt response, got ${res.type}`
+      );
+    }
+  }
+  exchange(request) {
+    return new Promise((resolve, reject) => {
+      let socket;
+      let buffer = "";
+      let settled = false;
+      const settleErr = (err2) => {
+        if (settled) return;
+        settled = true;
+        socket?.destroy();
+        reject(err2);
+      };
+      const settleOk = (res) => {
+        if (settled) return;
+        settled = true;
+        socket?.destroy();
+        resolve(res);
+      };
+      const timer = setTimeout(() => {
+        settleErr(new BrokerClientError("timeout", "broker IPC timeout"));
+      }, this.options.timeoutMs);
+      try {
+        socket = connect(this.options.endpoint);
+      } catch (err2) {
+        clearTimeout(timer);
+        settleErr(new BrokerClientError("connect_failed", "cannot connect to broker", err2));
+        return;
+      }
+      socket.once("connect", () => {
+        socket.write(JSON.stringify(request) + "\n");
+      });
+      socket.on("data", (chunk) => {
+        buffer += chunk.toString("utf8");
+        const newlineIdx = buffer.indexOf("\n");
+        if (newlineIdx < 0) return;
+        const line = buffer.slice(0, newlineIdx);
+        clearTimeout(timer);
+        try {
+          const parsed = JSON.parse(line);
+          if (parsed.type === "error") {
+            settleErr(
+              new BrokerClientError("broker_error", `${parsed.code}: ${parsed.message}`)
+            );
+            return;
+          }
+          settleOk(parsed);
+        } catch (err2) {
+          settleErr(new BrokerClientError("protocol_error", "invalid JSON from broker", err2));
+        }
+      });
+      socket.on("error", (err2) => {
+        clearTimeout(timer);
+        settleErr(new BrokerClientError("connect_failed", err2.message, err2));
+      });
+      socket.on("close", () => {
+        clearTimeout(timer);
+        if (!settled) {
+          settleErr(new BrokerClientError("protocol_error", "broker closed without response"));
+        }
+      });
+    });
+  }
+};
+
+// src/auth/jwt-source.ts
+var NoJwtAvailableError = class extends Error {
+  code = "no_jwt";
+  constructor() {
+    super(
+      "No JWT in broker keystore \u2014 run `muhaven-broker login` to authenticate via the device-code flow."
+    );
+    this.name = "NoJwtAvailableError";
+  }
+};
+var JwtSource = class {
+  constructor(broker, cacheTtlSec, nowMs = () => Date.now()) {
+    this.broker = broker;
+    this.cacheTtlSec = cacheTtlSec;
+    this.nowMs = nowMs;
+  }
+  broker;
+  cacheTtlSec;
+  nowMs;
+  cached = null;
+  /**
+   * Fetch the current JWT, throwing `NoJwtAvailableError` when the
+   * broker keystore is empty.
+   */
+  async get() {
+    const cached = this.cachedJwtIfValid();
+    if (cached !== null) return cached;
+    let res;
+    try {
+      res = await this.broker.getJwt();
+    } catch (err2) {
+      if (err2 instanceof BrokerClientError) throw err2;
+      throw err2;
+    }
+    if (!res.jwt) {
+      this.cached = null;
+      throw new NoJwtAvailableError();
+    }
+    this.cached = {
+      jwt: res.jwt,
+      expiresAtSec: res.expiresAtSec,
+      cachedAtMs: this.nowMs()
+    };
+    return res.jwt;
+  }
+  /** Drop the in-process cache. Call after a backend 401 to force refresh. */
+  invalidate() {
+    this.cached = null;
+  }
+  /** Returns the cached JWT iff it's fresh AND not past `expiresAtSec`. */
+  cachedJwtIfValid() {
+    if (!this.cached) return null;
+    const ageMs = this.nowMs() - this.cached.cachedAtMs;
+    if (ageMs > this.cacheTtlSec * 1e3) return null;
+    if (this.cached.expiresAtSec !== null) {
+      const nowSec = Math.floor(this.nowMs() / 1e3);
+      if (this.cached.expiresAtSec - nowSec < 30) return null;
+    }
+    return this.cached.jwt;
+  }
+};
+
+// src/clients/backend-client.ts
+var BackendError = class extends Error {
+  constructor(code, message, status, body) {
+    super(message);
+    this.code = code;
+    this.status = status;
+    this.body = body;
+    this.name = "BackendError";
+  }
+  code;
+  status;
+  body;
+};
+var BackendClient = class {
+  constructor(options) {
+    this.options = options;
+    this.fetchImpl = options.fetchImpl ?? globalThis.fetch.bind(globalThis);
+  }
+  options;
+  fetchImpl;
+  async get(path, query) {
+    const url = this.buildUrl(path, query);
+    return this.exchangeWithRetry("GET", url);
+  }
+  async post(path, body) {
+    const url = this.buildUrl(path);
+    return this.exchangeWithRetry("POST", url, body);
+  }
+  /**
+   * Path-less variant for unauthenticated calls (e.g., device-code
+   * flow's `/auth/device/code` and `/auth/device/token`). Sends no
+   * Authorization header.
+   */
+  async postUnauth(path, body) {
+    const url = this.buildUrl(path);
+    return this.exchange(
+      "POST",
+      url,
+      body,
+      /* withAuth */
+      false
+    );
+  }
+  buildUrl(path, query) {
+    if (!path.startsWith("/")) {
+      throw new BackendError("bad_request", `path must start with "/": ${path}`);
+    }
+    const url = new URL(this.options.baseUrl + path);
+    if (!this.options.allowedHosts.includes(url.host)) {
+      throw new BackendError(
+        "host_not_allowed",
+        `request host ${url.host} not in allowedHosts`
+      );
+    }
+    if (query) {
+      for (const [k, v] of Object.entries(query)) {
+        if (v !== void 0 && v !== null && v !== "") url.searchParams.set(k, String(v));
+      }
+    }
+    return url;
+  }
+  async exchangeWithRetry(method, url, body) {
+    try {
+      return await this.exchange(method, url, body, true);
+    } catch (err2) {
+      if (err2 instanceof BackendError && err2.code === "unauthorized") {
+        this.options.jwtSource.invalidate();
+        return this.exchange(method, url, body, true);
+      }
+      throw err2;
+    }
+  }
+  async exchange(method, url, body, withAuth) {
+    const headers = {
+      accept: "application/json",
+      ...body !== void 0 ? { "content-type": "application/json" } : {}
+    };
+    if (withAuth) {
+      const jwt = await this.options.jwtSource.get();
+      headers.authorization = `Bearer ${jwt}`;
+    }
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), this.options.timeoutMs);
+    let res;
+    try {
+      res = await this.fetchImpl(url, {
+        method,
+        headers,
+        body: body !== void 0 ? JSON.stringify(body) : void 0,
+        signal: ctrl.signal
+      });
+    } catch (err2) {
+      clearTimeout(timer);
+      if (err2.name === "AbortError") {
+        throw new BackendError("timeout", `${method} ${url.pathname} timed out`);
+      }
+      throw new BackendError("network", `${method} ${url.pathname} network error`, void 0, err2);
+    } finally {
+      clearTimeout(timer);
+    }
+    const status = res.status;
+    const contentType = res.headers.get("content-type") ?? "";
+    let payload = void 0;
+    if (contentType.includes("application/json")) {
+      try {
+        payload = await res.json();
+      } catch {
+      }
+    } else {
+      try {
+        payload = await res.text();
+      } catch {
+      }
+    }
+    if (status >= 200 && status < 300) {
+      return payload;
+    }
+    throw new BackendError(
+      mapStatus(status),
+      `${method} ${url.pathname} \u2192 ${status}`,
+      status,
+      payload
+    );
+  }
+};
+function mapStatus(status) {
+  if (status === 401) return "unauthorized";
+  if (status === 403) return "forbidden";
+  if (status === 404) return "not_found";
+  if (status === 410) return "gone";
+  if (status === 429) return "rate_limited";
+  if (status >= 400 && status < 500) return "bad_request";
+  if (status >= 500) return "server_error";
+  return "invalid_response";
+}
+var TOOL_DESCRIPTORS = [
+  {
+    name: "muhaven.read.portfolio",
+    group: "read",
+    description: "Return the authenticated investor's encrypted-balance portfolio summary. Output exposes only public aggregates (token list, ebool isOverexposed / isUnderYield handles); decrypted balances are NEVER included in the response. The LLM should call muhaven.read.portfolio for fact-checks about the user's state, not estimate from chat history.",
+    sensitive: false
+  },
+  {
+    name: "muhaven.read.yields",
+    group: "read",
+    description: 'Return per-token yield history (cleartext aggregates only \u2014 distribution dates, total funded amounts, epoch numbers). Use to answer "what was my yield last epoch?" with authoritative data, not from cached LLM context.',
+    sensitive: false
+  },
+  {
+    name: "muhaven.read.distribution",
+    group: "read",
+    description: "Return distribution status for a (token, epoch). Inputs: token address (Hex), epoch (uint). Output: { state, totalFunded, escrowsCreated, escrowsFunded } \u2014 all cleartext aggregates.",
+    sensitive: false
+  },
+  {
+    name: "muhaven.read.tokens",
+    group: "read",
+    description: "List the RWA tokens the authenticated user holds (token addresses + symbols + decimals). Balances are NOT included; use muhaven.read.portfolio for the encrypted-balance aggregates.",
+    sensitive: false
+  },
+  {
+    name: "muhaven.read.audit",
+    group: "read",
+    description: `Return the authenticated user's tiered-autonomy audit log entries. Cursor-paginated. Useful for forensic review ("why was I paused?") and grant-reviewer demos. Read-only \u2014 never exposes other users' data.`,
+    sensitive: false
+  },
+  {
+    name: "muhaven.position.buy",
+    group: "position",
+    description: "PROPOSE a Subscription buy. Returns an unsigned UserOp envelope plus a broker-signed session-key signature. The host MUST present the unsigned envelope to the user for passkey confirmation before submission to the bundler \u2014 this tool NEVER auto-submits. Fails when the user is in Advisory or Paused tier.",
+    sensitive: true
+  },
+  {
+    name: "muhaven.position.sell",
+    group: "position",
+    description: "PROPOSE a redemption-queue sell. Same envelope-plus-signature pattern as muhaven.position.buy. Requires the user to be in Confirm-per-action or Policy-bound tier on the MCP surface.",
+    sensitive: true
+  },
+  {
+    name: "muhaven.position.claim",
+    group: "position",
+    description: "PROPOSE a yield claim from RedemptionQueue / YieldSnapshot for a given token. Returns an unsigned UserOp + broker signature. Idempotent \u2014 proposing twice produces the same intent hash.",
+    sensitive: true
+  },
+  {
+    name: "muhaven.position.rebalance",
+    group: "position",
+    description: "PROPOSE a multi-leg atomic rebalance bundling buy + sell legs into a single UserOp. Each leg is constrained by the user's installed @zerodev/permissions CallPolicy.",
+    sensitive: true
+  },
+  {
+    name: "muhaven.policy.set_tier",
+    group: "policy",
+    description: "REQUEST or COMMIT a tiered-autonomy transition (Advisory \u2194 Confirm-per-action \u2194 Policy-bound) on the MCP surface. Two-step: first call returns a single-use confirmation token; the user passkey-signs in the dashboard; the host re-invokes with the token to commit. Step-down transitions skip the token. NEVER allows Advisory \u2192 Policy-bound in a single call (ADR-0).",
+    sensitive: true
+  },
+  {
+    name: "muhaven.policy.pause",
+    group: "policy",
+    description: "Activate the /pause kill-switch. Backend marks the surface Paused immediately; the on-chain @zerodev/permissions uninstallPlugin UserOp envelope is returned for the user to submit via passkey. Cascade-mode (no surface arg) pauses all four Wave 4 surfaces atomically.",
+    sensitive: true
+  },
+  {
+    name: "muhaven.policy.audit_export",
+    group: "policy",
+    description: "Stream the authenticated user's full audit log to a single JSON document. Convenience wrapper over muhaven.read.audit that drains the cursor \u2014 useful for compliance handoffs.",
+    sensitive: false
+  },
+  {
+    name: "muhaven.policy.session_key_status",
+    group: "policy",
+    description: "Return the current ZeroDev session-key validator state for the MCP surface: tier, validator address, valid-until timestamp, recent action count. Pure read; never modifies state.",
+    sensitive: false
+  },
+  // ── Wave 4 P7 — issuer-side tools (ADR-8) ──────────────────────────
+  // Same use-case backing as HavenBot's `muhaven_propose_*` tools; the
+  // dotted MCP names follow the namespace rule established in P3
+  // (TOOL_NAMESPACE.md §"`@muhaven/mcp` namespaces"). Every issuer tool
+  // is sensitive=true (host MUST render confirmation cue); they require
+  // an approved issuer kernel — the backend returns a structured 403
+  // when the JWT subject isn't issuer-roled.
+  {
+    name: "muhaven.issuer.distribute_yield",
+    group: "issuer",
+    description: "PROPOSE a yield distribution for a registered RWA token. Wraps the @muhaven/sdk distributeYield pipeline (startDistribution \u2192 batchCreate \u2192 fundEscrows). Returns an ActionDescriptor + confirmation token. Issuer-only \u2014 the use-case rejects non-issuer kernels with NOT_APPROVED_ISSUER.",
+    sensitive: true
+  },
+  {
+    name: "muhaven.issuer.kyc_add",
+    group: "issuer",
+    description: "PROPOSE adding an investor to the ERC-3643 whitelist for a registered token. kycTier=1 is retail KYC; kycTier=2 is accredited (which also requires tier 1). Returns an ActionDescriptor + confirmation token. Issuer-only.",
+    sensitive: true
+  },
+  {
+    name: "muhaven.issuer.kyc_remove",
+    group: "issuer",
+    description: "PROPOSE removing an investor from the ERC-3643 whitelist for a registered token. Tier-2 accredited status is auto-cleared by the contract. The on-chain T-5 KYC-revocation cascade across investor surfaces wires up in Wave 5 once the indexer subscribes. Issuer-only.",
+    sensitive: true
+  },
+  {
+    name: "muhaven.issuer.unpause_token",
+    group: "issuer",
+    description: "PROPOSE the F2 wizard step 6 closure: oracle.setNAV(token, initialNav) + tokenRegistry.setPaused(token, false). Both signed by the applicant kernel. Idempotent \u2014 refuses if the token is already active. Issuer-only.",
+    sensitive: true
+  },
+  {
+    name: "muhaven.issuer.audit_query",
+    group: "issuer",
+    description: "Return the calling issuer's tiered-autonomy audit log entries (cursor-paginated). Useful for compliance review of past distributions, KYC additions, and unpause events. Wave 4 = issuer-self only; Wave 5 adds permit-gated cross-user access for compliance officers.",
+    sensitive: false
+  },
+  // ── Wave 4 P11 — governance / protection / KYC tools ──────────────
+  // Reads land in `read` so `--read-only` keeps them available.
+  // State-mutating governance ceremony lives in the new `governance`
+  // group, filtered off by `--read-only`.
+  {
+    name: "muhaven.read.protection_coverage",
+    group: "read",
+    description: 'Read-only inspection of DefaultProtection coverage for an RWA token. Returns the public reserveRateBps, status, issuer address, and a human-readable explanation. Encrypted reserve balances are NEVER decrypted server-side; only public aggregates surface. Returns "not_deployed" when the P11.A contract is not yet on-chain.',
+    sensitive: false
+  },
+  {
+    name: "muhaven.read.kyc_attestation",
+    group: "read",
+    description: 'Read-only informational tool that explains MuHaven cross-chain KYC attestations + returns the registry config (default validity period, attestation signer, jurisdiction hash). Use to answer "how does cross-chain KYC work?" with authoritative data. Returns "not_deployed" when the P11.C registry is not yet on-chain.',
+    sensitive: false
+  },
+  {
+    name: "muhaven.governance.propose",
+    group: "governance",
+    description: "PROPOSE opening a governance proposal on the EncryptedGovernance contract. Wave 4 supports proposalType=0 (TRIGGER_PROTECTION) only; type=1 reserved for Wave 5. Returns an ActionDescriptor + confirmation token; the user signs through the dashboard ConfirmModal. Tier-gated. Refuses with P11_NOT_DEPLOYED when the contract is not yet on-chain.",
+    sensitive: true
+  },
+  {
+    name: "muhaven.governance.cast_vote",
+    group: "governance",
+    description: "PROPOSE submitting an FHE-encrypted ballot on an EncryptedGovernance proposal. The cleartext yes/no is rendered for the user in ConfirmModal; the SDK encrypts to InEuint128 client-side BEFORE the on-chain write so the agent surface NEVER sees the encrypted handle. The audit log records that a vote was cast but does NOT record which way (privacy invariant).",
+    sensitive: true
+  }
+];
+var _seenNames = /* @__PURE__ */ new Set();
+for (const t of TOOL_DESCRIPTORS) {
+  if (_seenNames.has(t.name)) {
+    throw new Error(`Duplicate tool descriptor name: ${t.name}`);
+  }
+  _seenNames.add(t.name);
+}
+var TOOL_NAME_RE = /^muhaven\.[a-z]+\.[a-z][a-z0-9_]*$/;
+for (const t of TOOL_DESCRIPTORS) {
+  if (!TOOL_NAME_RE.test(t.name)) {
+    throw new Error(
+      `Tool name "${t.name}" violates muhaven.<group>.<verb> regex (TOOL_NAMESPACE.md rule)`
+    );
+  }
+}
+function hashToolDescriptor(d) {
+  const canonical = JSON.stringify({
+    name: d.name,
+    description: d.description,
+    sensitive: d.sensitive
+  });
+  return createHash("sha256").update(canonical, "utf-8").digest("hex");
+}
+function buildToolHashTable() {
+  return TOOL_DESCRIPTORS.map((d) => ({ name: d.name, sha256: hashToolDescriptor(d) }));
+}
+function verifyDescriptorAgainstPin(descriptor, pinnedSha256) {
+  const live = hashToolDescriptor(descriptor);
+  if (live === pinnedSha256) return null;
+  return { liveSha256: live, pinnedSha256 };
+}
+var HEX_ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
+var addressSchema = z.string().regex(HEX_ADDRESS_RE, "must be a 0x-prefixed 20-byte hex address");
+var tierSchema = z.enum(["advisory", "confirm-per-action", "policy-bound", "paused"]);
+var surfaceSchema = z.enum(["havenbot", "mcp", "openclaw", "checkout"]);
+z.union([z.literal(1), z.literal(2), z.literal(3), z.literal(4)]);
+var auditEventTypeSchema = z.enum([
+  "tier_changed",
+  "paused",
+  "resumed",
+  "cron_tick",
+  "confirm_token_issued",
+  "confirm_token_consumed",
+  "permit_granted",
+  "permit_revoked",
+  "validator_installed",
+  "validator_uninstalled",
+  "kyc_revocation_received",
+  "risk_questionnaire_complete"
+]);
+var ReadPortfolioInputSchema = z.object({}).strict();
+var ReadYieldsInputSchema = z.object({
+  token: addressSchema.optional(),
+  limit: z.number().int().min(1).max(50).optional()
+}).strict();
+var ReadDistributionInputSchema = z.object({
+  token: addressSchema,
+  epoch: z.number().int().min(0)
+}).strict();
+var ReadTokensInputSchema = z.object({}).strict();
+var ReadAuditInputSchema = z.object({
+  surface: surfaceSchema.optional(),
+  eventTypes: z.array(auditEventTypeSchema).max(20).optional(),
+  since: z.string().datetime().optional(),
+  until: z.string().datetime().optional(),
+  cursor: z.string().min(1).max(512).optional(),
+  limit: z.number().int().min(1).max(200).optional()
+}).strict();
+var PositionBuyInputSchema = z.object({
+  token: addressSchema,
+  /** Investor candidate spend, denominated in USDC base units (uint64). */
+  amountUsdc6: z.string().regex(/^\d+$/, "must be a base-10 integer string")
+}).strict();
+var PositionSellInputSchema = z.object({
+  token: addressSchema,
+  /** Encrypted-balance share count to redeem, denominated in fhERC-20 base units. */
+  amountShares: z.string().regex(/^\d+$/, "must be a base-10 integer string")
+}).strict();
+var PositionClaimInputSchema = z.object({
+  token: addressSchema,
+  /** When set, claim only the named escrow id; else claim-all. */
+  escrowId: z.string().regex(/^\d+$/).optional()
+}).strict();
+var PositionRebalanceInputSchema = z.object({
+  legs: z.array(
+    z.object({
+      token: addressSchema,
+      side: z.enum(["buy", "sell"]),
+      amount: z.string().regex(/^\d+$/)
+    }).strict()
+  ).min(2).max(8)
+}).strict();
+var PolicySetTierInputSchema = z.object({
+  targetTier: tierSchema,
+  /** Returned by an earlier `request` call. Omit for step-down or first-call. */
+  confirmationToken: z.string().min(8).max(128).optional()
+}).strict();
+var PolicyPauseInputSchema = z.object({
+  /** Omit to cascade a pause across all four surfaces (panic button). */
+  surface: surfaceSchema.optional()
+}).strict();
+var PolicyAuditExportInputSchema = z.object({
+  surface: surfaceSchema.optional(),
+  since: z.string().datetime().optional(),
+  until: z.string().datetime().optional(),
+  /** Hard cap on rows to export, defends against runaway loops. */
+  maxRows: z.number().int().min(1).max(5e3).default(1e3)
+}).strict();
+var PolicySessionKeyStatusInputSchema = z.object({}).strict();
+var IssuerDistributeYieldInputSchema = z.object({
+  tokenAddress: addressSchema,
+  /** Cleartext mhUSDC base units — encrypted SDK-side before submit. */
+  totalYieldUsd6: z.string().regex(/^[1-9]\d*$/, "must be a positive integer string"),
+  label: z.string().min(1).max(200).optional()
+}).strict();
+var IssuerKycAddInputSchema = z.object({
+  tokenAddress: addressSchema,
+  investorAddress: addressSchema,
+  kycTier: z.union([z.literal(1), z.literal(2)]).default(1)
+}).strict();
+var IssuerKycRemoveInputSchema = z.object({
+  tokenAddress: addressSchema,
+  investorAddress: addressSchema
+}).strict();
+var IssuerUnpauseTokenInputSchema = z.object({
+  tokenAddress: addressSchema,
+  /** Initial NAV in mhUSDC base units (6 decimals). 1_000_000 = $1.00. */
+  initialNavUsd6: z.string().regex(/^[1-9]\d*$/, "must be a positive integer string")
+}).strict();
+var IssuerAuditQueryInputSchema = z.object({
+  surface: surfaceSchema.optional(),
+  eventTypes: z.array(auditEventTypeSchema).max(20).optional(),
+  since: z.string().datetime().optional(),
+  until: z.string().datetime().optional(),
+  cursor: z.string().min(1).max(512).optional(),
+  limit: z.number().int().min(1).max(200).optional()
+}).strict();
+var ReadProtectionCoverageInputSchema = z.object({
+  tokenAddress: addressSchema
+}).strict();
+var ReadKycAttestationInputSchema = z.object({
+  investorAddress: addressSchema.optional()
+}).strict();
+var GovernanceProposeInputSchema = z.object({
+  tokenAddress: addressSchema,
+  /** 0 = TRIGGER_PROTECTION (Wave 4 only); 1 reserved Wave 5. */
+  proposalType: z.union([z.literal(0), z.literal(1)])
+}).strict();
+var GovernanceCastVoteInputSchema = z.object({
+  proposalId: z.string().regex(/^[1-9]\d*$/, "must be a positive integer string"),
+  voteYes: z.boolean()
+}).strict();
+
+// src/tools/auth-required.ts
+function authRequiredPayload() {
+  return {
+    ok: false,
+    code: "AUTH_REQUIRED",
+    message: "No JWT in broker keystore. Run `muhaven-broker login` to authenticate via the device-code ceremony, then retry this tool.",
+    loginCommand: "muhaven-broker login"
+  };
+}
+
+// src/tools/handlers.ts
+function ok(data) {
+  return { ok: true, data };
+}
+function err(code, message) {
+  return { ok: false, code, message };
+}
+function mapBackendError(e) {
+  if (e instanceof BackendError) {
+    if (e.code === "unauthorized") return authRequiredPayload();
+    return err(`backend.${e.code}`, e.message);
+  }
+  if (e instanceof Error) return err("backend.network", e.message);
+  return err("backend.network", "unknown backend error");
+}
+function mapBrokerError(e) {
+  if (e instanceof BrokerClientError) return err(`broker.${e.code}`, e.message);
+  if (e instanceof Error) return err("broker.network", e.message);
+  return err("broker.network", "unknown broker error");
+}
+async function readPortfolio(_input, deps) {
+  try {
+    const data = await deps.backend.get("/api/v1/portfolio");
+    return ok(data);
+  } catch (e) {
+    return mapBackendError(e);
+  }
+}
+async function readYields(input, deps) {
+  try {
+    const data = await deps.backend.get("/api/v1/yields", {
+      token: input.token,
+      limit: input.limit
+    });
+    return ok(data);
+  } catch (e) {
+    return mapBackendError(e);
+  }
+}
+async function readDistribution(input, deps) {
+  try {
+    const data = await deps.backend.get("/api/v1/distributions", {
+      token: input.token,
+      epoch: input.epoch
+    });
+    return ok(data);
+  } catch (e) {
+    return mapBackendError(e);
+  }
+}
+async function readTokens(_input, deps) {
+  try {
+    const data = await deps.backend.get("/api/v1/tokens");
+    return ok(data);
+  } catch (e) {
+    return mapBackendError(e);
+  }
+}
+async function readAudit(input, deps) {
+  try {
+    const data = await deps.backend.get("/api/v1/agent/policy/audit", {
+      surface: input.surface,
+      eventTypes: input.eventTypes?.join(","),
+      since: input.since,
+      until: input.until,
+      cursor: input.cursor,
+      limit: input.limit
+    });
+    return ok(data);
+  } catch (e) {
+    return mapBackendError(e);
+  }
+}
+var PLACEHOLDER_INTENT_DOMAIN = "muhaven.placeholder.intent.v0:";
+function computeIntentHash(intent) {
+  const canonical = JSON.stringify(sortKeys(intent));
+  return keccak256(toBytes(PLACEHOLDER_INTENT_DOMAIN + canonical));
+}
+function sortKeys(value) {
+  if (Array.isArray(value)) return value.map(sortKeys);
+  if (value && typeof value === "object") {
+    const obj = value;
+    const sorted = {};
+    for (const k of Object.keys(obj).sort()) sorted[k] = sortKeys(obj[k]);
+    return sorted;
+  }
+  return value;
+}
+async function signEnvelope(intent, toolName, summary, deps) {
+  const intentHash = computeIntentHash(intent);
+  if (!deps.broker) {
+    return err(
+      "broker.unavailable",
+      "position tools require a running muhaven-broker daemon \u2014 see README \xA7Broker setup"
+    );
+  }
+  try {
+    const sig = await deps.broker.signHash(intentHash, { tool: toolName, summary });
+    return ok({
+      intentHash,
+      unsignedUserOp: {
+        target: "see backend",
+        data: "see backend",
+        note: "P3 returns a placeholder envelope; P6 wires the canonical UserOp shape."
+      },
+      brokerSignature: sig.signature,
+      signerAddress: sig.signerAddress
+    });
+  } catch (e) {
+    return mapBrokerError(e);
+  }
+}
+async function positionBuy(input, deps) {
+  return signEnvelope(
+    { kind: "buy", token: input.token, amountUsdc6: input.amountUsdc6 },
+    "muhaven.position.buy",
+    `buy ${input.amountUsdc6} USDC of ${input.token}`,
+    deps
+  );
+}
+async function positionSell(input, deps) {
+  return signEnvelope(
+    { kind: "sell", token: input.token, amountShares: input.amountShares },
+    "muhaven.position.sell",
+    `sell ${input.amountShares} shares of ${input.token}`,
+    deps
+  );
+}
+async function positionClaim(input, deps) {
+  return signEnvelope(
+    { kind: "claim", token: input.token, escrowId: input.escrowId ?? null },
+    "muhaven.position.claim",
+    `claim ${input.token}${input.escrowId ? ` escrow#${input.escrowId}` : " (all)"}`,
+    deps
+  );
+}
+async function positionRebalance(input, deps) {
+  return signEnvelope(
+    { kind: "rebalance", legs: input.legs },
+    "muhaven.position.rebalance",
+    `rebalance ${input.legs.length} legs`,
+    deps
+  );
+}
+async function policySetTier(input, deps) {
+  try {
+    const data = await deps.backend.post("/api/v1/agent/policy/transition", {
+      surface: deps.surface,
+      targetTier: input.targetTier,
+      ...input.confirmationToken ? { confirmationToken: input.confirmationToken } : {}
+    });
+    return ok(data);
+  } catch (e) {
+    return mapBackendError(e);
+  }
+}
+async function policyPause(input, deps) {
+  try {
+    const data = await deps.backend.post("/api/v1/agent/policy/pause", {
+      ...input.surface ? { surface: input.surface } : {}
+    });
+    return ok({
+      backend: data,
+      onChain: {
+        action: "uninstallPlugin",
+        note: "Submit via dashboard passkey or follow-up muhaven.position.* invocation."
+      }
+    });
+  } catch (e) {
+    return mapBackendError(e);
+  }
+}
+async function policyAuditExport(input, deps) {
+  const items = [];
+  let cursor = void 0;
+  let pages = 0;
+  const PAGE_LIMIT = 200;
+  const MAX_PAGES = Math.ceil(input.maxRows / PAGE_LIMIT) + 1;
+  try {
+    while (items.length < input.maxRows && pages < MAX_PAGES) {
+      const page = await deps.backend.get("/api/v1/agent/policy/audit", {
+        surface: input.surface,
+        since: input.since,
+        until: input.until,
+        cursor,
+        limit: PAGE_LIMIT
+      });
+      const got = Array.isArray(page.items) ? page.items : [];
+      for (const row of got) {
+        if (items.length >= input.maxRows) break;
+        items.push(row);
+      }
+      pages++;
+      if (!page.cursor || got.length === 0) break;
+      cursor = page.cursor;
+    }
+    return ok({ items, total: items.length, truncated: items.length === input.maxRows });
+  } catch (e) {
+    return mapBackendError(e);
+  }
+}
+async function policySessionKeyStatus(_input, deps) {
+  try {
+    const data = await deps.backend.get("/api/v1/agent/policy/state", { surface: deps.surface });
+    return ok(data);
+  } catch (e) {
+    return mapBackendError(e);
+  }
+}
+async function issuerDistributeYield(input, deps) {
+  try {
+    const data = await deps.backend.post("/api/v1/agent/tools/propose_distribute_yield", {
+      tokenAddress: input.tokenAddress,
+      totalYieldUsd6: input.totalYieldUsd6,
+      ...input.label ? { label: input.label } : {}
+    });
+    return ok(data);
+  } catch (e) {
+    return mapBackendError(e);
+  }
+}
+async function issuerKycAdd(input, deps) {
+  try {
+    const data = await deps.backend.post("/api/v1/agent/tools/propose_kyc_add", {
+      tokenAddress: input.tokenAddress,
+      investorAddress: input.investorAddress,
+      kycTier: input.kycTier
+    });
+    return ok(data);
+  } catch (e) {
+    return mapBackendError(e);
+  }
+}
+async function issuerKycRemove(input, deps) {
+  try {
+    const data = await deps.backend.post("/api/v1/agent/tools/propose_kyc_remove", {
+      tokenAddress: input.tokenAddress,
+      investorAddress: input.investorAddress
+    });
+    return ok(data);
+  } catch (e) {
+    return mapBackendError(e);
+  }
+}
+async function issuerUnpauseToken(input, deps) {
+  try {
+    const data = await deps.backend.post("/api/v1/agent/tools/propose_unpause_token", {
+      tokenAddress: input.tokenAddress,
+      initialNavUsd6: input.initialNavUsd6
+    });
+    return ok(data);
+  } catch (e) {
+    return mapBackendError(e);
+  }
+}
+async function issuerAuditQuery(input, deps) {
+  try {
+    const data = await deps.backend.get("/api/v1/agent/tools/audit_query", {
+      surface: input.surface,
+      eventTypes: input.eventTypes?.join(","),
+      since: input.since,
+      until: input.until,
+      cursor: input.cursor,
+      limit: input.limit
+    });
+    return ok(data);
+  } catch (e) {
+    return mapBackendError(e);
+  }
+}
+async function readProtectionCoverage(input, deps) {
+  try {
+    const data = await deps.backend.post("/api/v1/agent/tools/check_protection_coverage", {
+      tokenAddress: input.tokenAddress
+    });
+    return ok(data);
+  } catch (e) {
+    return mapBackendError(e);
+  }
+}
+async function readKycAttestation(input, deps) {
+  try {
+    const data = await deps.backend.post("/api/v1/agent/tools/explain_kyc_attestation", {
+      ...input.investorAddress ? { investorAddress: input.investorAddress } : {}
+    });
+    return ok(data);
+  } catch (e) {
+    return mapBackendError(e);
+  }
+}
+async function governancePropose(input, deps) {
+  try {
+    const data = await deps.backend.post("/api/v1/agent/tools/propose_governance_vote", {
+      tokenAddress: input.tokenAddress,
+      proposalType: input.proposalType
+    });
+    return ok(data);
+  } catch (e) {
+    return mapBackendError(e);
+  }
+}
+async function governanceCastVote(input, deps) {
+  try {
+    const data = await deps.backend.post("/api/v1/agent/tools/cast_encrypted_vote", {
+      proposalId: input.proposalId,
+      voteYes: input.voteYes
+    });
+    return ok(data);
+  } catch (e) {
+    return mapBackendError(e);
+  }
+}
+
+// src/tools/registry.ts
+var HANDLERS = {
+  "muhaven.read.portfolio": {
+    schema: ReadPortfolioInputSchema,
+    handler: readPortfolio
+  },
+  "muhaven.read.yields": {
+    schema: ReadYieldsInputSchema,
+    handler: readYields
+  },
+  "muhaven.read.distribution": {
+    schema: ReadDistributionInputSchema,
+    handler: readDistribution
+  },
+  "muhaven.read.tokens": {
+    schema: ReadTokensInputSchema,
+    handler: readTokens
+  },
+  "muhaven.read.audit": {
+    schema: ReadAuditInputSchema,
+    handler: readAudit
+  },
+  "muhaven.position.buy": {
+    schema: PositionBuyInputSchema,
+    handler: positionBuy
+  },
+  "muhaven.position.sell": {
+    schema: PositionSellInputSchema,
+    handler: positionSell
+  },
+  "muhaven.position.claim": {
+    schema: PositionClaimInputSchema,
+    handler: positionClaim
+  },
+  "muhaven.position.rebalance": {
+    schema: PositionRebalanceInputSchema,
+    handler: positionRebalance
+  },
+  "muhaven.policy.set_tier": {
+    schema: PolicySetTierInputSchema,
+    handler: policySetTier
+  },
+  "muhaven.policy.pause": {
+    schema: PolicyPauseInputSchema,
+    handler: policyPause
+  },
+  "muhaven.policy.audit_export": {
+    schema: PolicyAuditExportInputSchema,
+    handler: policyAuditExport
+  },
+  "muhaven.policy.session_key_status": {
+    schema: PolicySessionKeyStatusInputSchema,
+    handler: policySessionKeyStatus
+  },
+  // ── Wave 4 P7 — issuer group ────────────────────────────────────
+  "muhaven.issuer.distribute_yield": {
+    schema: IssuerDistributeYieldInputSchema,
+    handler: issuerDistributeYield
+  },
+  "muhaven.issuer.kyc_add": {
+    schema: IssuerKycAddInputSchema,
+    handler: issuerKycAdd
+  },
+  "muhaven.issuer.kyc_remove": {
+    schema: IssuerKycRemoveInputSchema,
+    handler: issuerKycRemove
+  },
+  "muhaven.issuer.unpause_token": {
+    schema: IssuerUnpauseTokenInputSchema,
+    handler: issuerUnpauseToken
+  },
+  "muhaven.issuer.audit_query": {
+    schema: IssuerAuditQueryInputSchema,
+    handler: issuerAuditQuery
+  },
+  // ── Wave 4 P11 — governance / protection / KYC group ──────────────
+  "muhaven.read.protection_coverage": {
+    schema: ReadProtectionCoverageInputSchema,
+    handler: readProtectionCoverage
+  },
+  "muhaven.read.kyc_attestation": {
+    schema: ReadKycAttestationInputSchema,
+    handler: readKycAttestation
+  },
+  "muhaven.governance.propose": {
+    schema: GovernanceProposeInputSchema,
+    handler: governancePropose
+  },
+  "muhaven.governance.cast_vote": {
+    schema: GovernanceCastVoteInputSchema,
+    handler: governanceCastVote
+  }
+};
+var fullRegistry = TOOL_DESCRIPTORS.map((descriptor) => {
+  const entry = HANDLERS[descriptor.name];
+  if (!entry) {
+    throw new Error(`Tool descriptor "${descriptor.name}" has no handler wired in registry.ts`);
+  }
+  return { descriptor, schema: entry.schema, handler: entry.handler };
+});
+var wiredNames = new Set(fullRegistry.map((e) => e.descriptor.name));
+for (const name of Object.keys(HANDLERS)) {
+  if (!wiredNames.has(name)) {
+    throw new Error(`Handler "${name}" has no descriptor in TOOL_DESCRIPTORS`);
+  }
+}
+function fullToolRegistry() {
+  return fullRegistry;
+}
+function registryForReadOnly() {
+  return fullRegistry.filter((e) => e.descriptor.group === "read");
+}
+function selectRegistry(readOnly) {
+  return readOnly ? registryForReadOnly() : fullRegistry;
+}
+
+// src/server.ts
+var SERVER_NAME = "@muhaven/mcp";
+var SERVER_VERSION = "0.1.0";
+function toJsonInputSchema(schema) {
+  return {
+    type: "object",
+    additionalProperties: false
+  };
+}
+async function loadPinnedToolHashes() {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const candidates = [
+    join(here, "..", "tool-hashes.json"),
+    join(here, "tool-hashes.json")
+  ];
+  for (const path of candidates) {
+    try {
+      const raw = await readFile(path, "utf8");
+      const parsed = JSON.parse(raw);
+      if (Array.isArray(parsed?.tools)) return parsed.tools;
+    } catch {
+    }
+  }
+  return null;
+}
+function verifyToolHashes(pinned) {
+  if (!pinned) return { ok: true, drift: [] };
+  const pinnedMap = new Map(pinned.map((p) => [p.name, p.sha256]));
+  const drift = [];
+  for (const t of TOOL_DESCRIPTORS) {
+    const live = hashToolDescriptor(t);
+    const pin = pinnedMap.get(t.name);
+    if (!pin || pin !== live) {
+      drift.push({ name: t.name, live, pinned: pin ?? "<missing>" });
+    }
+  }
+  return { ok: drift.length === 0, drift };
+}
+function buildMcpServer(opts) {
+  const server = new Server(
+    { name: SERVER_NAME, version: SERVER_VERSION },
+    { capabilities: { tools: {} } }
+  );
+  server.setRequestHandler(ListToolsRequestSchema, async () => {
+    return {
+      tools: opts.registry.map((entry) => ({
+        name: entry.descriptor.name,
+        description: entry.descriptor.description,
+        inputSchema: toJsonInputSchema(entry.schema)
+      }))
+    };
+  });
+  server.setRequestHandler(CallToolRequestSchema, async (req) => {
+    const name = req.params.name;
+    const entry = opts.registry.find((e) => e.descriptor.name === name);
+    if (!entry) {
+      return toolJsonResponse({ ok: false, code: "unknown_tool", message: `unknown tool: ${name}` });
+    }
+    let parsed;
+    try {
+      parsed = entry.schema.parse(req.params.arguments ?? {});
+    } catch (err2) {
+      if (err2 instanceof ZodError) {
+        return toolJsonResponse({
+          ok: false,
+          code: "invalid_input",
+          message: "tool input failed schema validation",
+          issues: err2.issues
+        });
+      }
+      throw err2;
+    }
+    try {
+      const result = await entry.handler(parsed, {
+        backend: opts.backend,
+        broker: opts.broker,
+        surface: "mcp"
+      });
+      return toolJsonResponse(result);
+    } catch (err2) {
+      if (err2 instanceof NoJwtAvailableError) {
+        return toolJsonResponse(authRequiredPayload());
+      }
+      if (err2 instanceof BackendError && err2.code === "unauthorized") {
+        return toolJsonResponse(authRequiredPayload());
+      }
+      if (err2 instanceof BackendError) {
+        return toolJsonResponse({ ok: false, code: `backend.${err2.code}`, message: err2.message });
+      }
+      if (err2 instanceof BrokerClientError) {
+        return toolJsonResponse({ ok: false, code: `broker.${err2.code}`, message: err2.message });
+      }
+      return toolJsonResponse({
+        ok: false,
+        code: "internal",
+        message: err2 instanceof Error ? err2.message : String(err2)
+      });
+    }
+  });
+  return server;
+}
+function toolJsonResponse(payload) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(payload) }]
+  };
+}
+async function runMcpStdioCli(opts = {}) {
+  const config = loadMcpConfig();
+  const pinned = await loadPinnedToolHashes();
+  const verify = verifyToolHashes(pinned);
+  if (!verify.ok) {
+    process.stderr.write(
+      "tool-description hash drift detected \u2014 refusing to start. drift:\n" + JSON.stringify(verify.drift, null, 2) + "\n"
+    );
+    process.exit(70);
+  }
+  const broker = new BrokerClient({
+    endpoint: config.brokerEndpoint,
+    timeoutMs: config.brokerTimeoutMs
+  });
+  const jwtSource = new JwtSource(broker, config.jwtCacheTtlSec);
+  const backend = new BackendClient({
+    baseUrl: config.backendBaseUrl,
+    jwtSource,
+    timeoutMs: config.requestTimeoutMs,
+    allowedHosts: config.allowedBackendHosts
+  });
+  const baseRegistry = selectRegistry(config.readOnly);
+  const registry = opts.filterRegistry ? opts.filterRegistry(baseRegistry) : baseRegistry;
+  if (registry.length === 0) {
+    process.stderr.write(
+      "[muhaven-mcp] tool registry is empty after filtering \u2014 refusing to start.\n"
+    );
+    process.exit(70);
+  }
+  const server = buildMcpServer({
+    registry,
+    backend,
+    broker: config.readOnly ? void 0 : broker
+  });
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  await new Promise((resolve) => {
+    process.stdin.once("end", resolve);
+    process.stdin.once("close", resolve);
+    process.once("SIGINT", resolve);
+    process.once("SIGTERM", resolve);
+  });
+}
+
+// src/auth/device-flow.ts
+var DEFAULT_POLL_INTERVAL_MS = 2e3;
+var DEFAULT_OVERALL_TIMEOUT_MS = 5 * 60 * 1e3;
+var DeviceFlowAbortedError = class extends Error {
+  constructor(detail) {
+    super(`device flow aborted: ${detail.code}`);
+    this.detail = detail;
+    this.name = "DeviceFlowAbortedError";
+  }
+  detail;
+};
+var DeviceFlowClient = class {
+  constructor(options) {
+    this.options = options;
+    this.fetchImpl = options.fetchImpl ?? globalThis.fetch.bind(globalThis);
+    this.sleep = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    this.nowMs = options.nowMs ?? (() => Date.now());
+  }
+  options;
+  fetchImpl;
+  sleep;
+  nowMs;
+  /**
+   * Run the full ceremony: request a code, yield events for the caller
+   * to display the URL, then poll until authorized / denied / expired.
+   * Throws `DeviceFlowAbortedError` on terminal failure.
+   */
+  async *run(opts) {
+    const overallTimeout = opts?.overallTimeoutMs ?? DEFAULT_OVERALL_TIMEOUT_MS;
+    const code = await this.requestCode();
+    yield { type: "code_issued", code };
+    const startedAt = this.nowMs();
+    const pollMs = Math.max(1, code.pollIntervalSec) * 1e3;
+    let attempt = 0;
+    while (this.nowMs() - startedAt < overallTimeout) {
+      attempt += 1;
+      yield { type: "polling", attempt, nextPollMs: pollMs };
+      await this.sleep(pollMs);
+      const res = await this.pollOnce(code.deviceCode);
+      switch (res.state) {
+        case "pending":
+          continue;
+        case "authorized":
+          if (!res.jwt) {
+            throw new DeviceFlowAbortedError({
+              code: "invalid_response",
+              body: { reason: "authorized state missing jwt" }
+            });
+          }
+          yield {
+            type: "authorized",
+            jwt: res.jwt,
+            expiresAtSec: res.expiresAtSec ?? null,
+            scope: res.scope ?? null
+          };
+          return {
+            jwt: res.jwt,
+            expiresAtSec: res.expiresAtSec ?? null,
+            scope: res.scope ?? null
+          };
+        case "denied":
+          yield { type: "denied", reason: res.reason };
+          throw new DeviceFlowAbortedError({ code: "denied", reason: res.reason });
+        case "expired":
+          yield { type: "expired" };
+          throw new DeviceFlowAbortedError({ code: "expired" });
+      }
+    }
+    throw new DeviceFlowAbortedError({ code: "timeout" });
+  }
+  async requestCode() {
+    const url = new URL("/api/v1/auth/device/code", this.options.backendBaseUrl);
+    const requesterMetadata = {
+      processName: this.options.requesterMetadata?.processName ?? "muhaven-broker",
+      hostname: this.options.requesterMetadata?.hostname ?? "",
+      os: this.options.requesterMetadata?.os ?? ""
+    };
+    let res;
+    try {
+      res = await this.fetchImpl(url, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify({ requesterMetadata })
+      });
+    } catch (err2) {
+      throw new DeviceFlowAbortedError({ code: "network", cause: err2 });
+    }
+    if (res.status === 429) {
+      throw new DeviceFlowAbortedError({ code: "rate_limited" });
+    }
+    if (res.status >= 400) {
+      const body2 = await safeJson(res);
+      throw new DeviceFlowAbortedError({ code: "invalid_response", status: res.status, body: body2 });
+    }
+    const body = await safeJson(res);
+    if (!body || !body.deviceCode || !body.userCode) {
+      throw new DeviceFlowAbortedError({ code: "invalid_response", status: res.status, body });
+    }
+    const verificationUri = `${trim(this.options.dashboardBaseUrl)}/link`;
+    const verificationUriComplete = `${verificationUri}?code=${encodeURIComponent(body.userCode)}`;
+    return {
+      deviceCode: body.deviceCode,
+      userCode: body.userCode,
+      verificationUri,
+      verificationUriComplete,
+      expiresInSec: body.expiresInSec ?? 300,
+      pollIntervalSec: body.pollIntervalSec ?? Math.floor(DEFAULT_POLL_INTERVAL_MS / 1e3)
+    };
+  }
+  async pollOnce(deviceCode) {
+    const url = new URL("/api/v1/auth/device/token", this.options.backendBaseUrl);
+    let res;
+    try {
+      res = await this.fetchImpl(url, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify({ deviceCode })
+      });
+    } catch (err2) {
+      throw new DeviceFlowAbortedError({ code: "network", cause: err2 });
+    }
+    if (res.status === 429) {
+      return { state: "pending" };
+    }
+    const body = await safeJson(res);
+    if (!body || typeof body.state !== "string") {
+      throw new DeviceFlowAbortedError({ code: "invalid_response", status: res.status, body });
+    }
+    return body;
+  }
+};
+function trim(s) {
+  return s.endsWith("/") ? s.slice(0, -1) : s;
+}
+async function safeJson(res) {
+  try {
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+
+// src/broker/protocol.ts
+var BROKER_PROTOCOL_VERSION = "0.2.0";
+var HASH_HEX_RE = /^0x[0-9a-fA-F]{64}$/;
+var JWT_RE = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+function isHashHex(value) {
+  return typeof value === "string" && HASH_HEX_RE.test(value);
+}
+function isJwtShape(value) {
+  return typeof value === "string" && value.length <= 8192 && JWT_RE.test(value);
+}
+function parseBrokerRequest(line) {
+  let parsed;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    return { type: "error", code: "invalid_request", message: "request is not valid JSON" };
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return { type: "error", code: "invalid_request", message: "request must be a JSON object" };
+  }
+  const obj = parsed;
+  switch (obj.type) {
+    case "hello":
+      return { type: "hello" };
+    case "sign_hash": {
+      const hash = obj.hash;
+      if (!isHashHex(hash)) {
+        return {
+          type: "error",
+          code: "invalid_request",
+          message: "sign_hash.hash must be a 0x-prefixed 32-byte hex string"
+        };
+      }
+      const intent = obj.intent;
+      const intentValid = intent === void 0 || typeof intent === "object" && intent !== null && typeof intent.tool === "string";
+      if (!intentValid) {
+        return {
+          type: "error",
+          code: "invalid_request",
+          message: "sign_hash.intent.tool must be a string when provided"
+        };
+      }
+      return {
+        type: "sign_hash",
+        hash,
+        ...intent === void 0 ? {} : { intent }
+      };
+    }
+    case "store_jwt": {
+      const jwt = obj.jwt;
+      if (!isJwtShape(jwt)) {
+        return {
+          type: "error",
+          code: "invalid_request",
+          message: "store_jwt.jwt must be a JWT-shaped string \u22648192 chars"
+        };
+      }
+      const expiresAtSec = obj.expiresAtSec;
+      const expiresValid = expiresAtSec === void 0 || typeof expiresAtSec === "number" && Number.isFinite(expiresAtSec) && expiresAtSec > 0;
+      if (!expiresValid) {
+        return {
+          type: "error",
+          code: "invalid_request",
+          message: "store_jwt.expiresAtSec must be a positive number when provided"
+        };
+      }
+      return {
+        type: "store_jwt",
+        jwt,
+        ...expiresAtSec === void 0 ? {} : { expiresAtSec }
+      };
+    }
+    case "get_jwt":
+      return { type: "get_jwt" };
+    case "clear_jwt":
+      return { type: "clear_jwt" };
+    default:
+      return {
+        type: "error",
+        code: "unsupported_type",
+        message: `unsupported request type: ${String(obj.type)}`
+      };
+  }
+}
+function serializeResponse(res) {
+  return JSON.stringify(res) + "\n";
+}
+var ViemSigner = class {
+  account;
+  constructor(privateKey) {
+    this.account = privateKeyToAccount(privateKey);
+  }
+  get address() {
+    return this.account.address;
+  }
+  async signHash(hash) {
+    return this.account.sign({ hash });
+  }
+};
+var KEYRING_SERVICE = "muhaven.mcp";
+var KEYRING_ACCOUNT = "jwt";
+async function loadKeyringModule() {
+  try {
+    const moduleName = "@napi-rs/keyring";
+    return await import(moduleName);
+  } catch {
+    return null;
+  }
+}
+var OsKeystore = class {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  constructor(entry) {
+    this.entry = entry;
+  }
+  entry;
+  backend = "os";
+  available = true;
+  async set(record) {
+    try {
+      this.entry.setPassword(JSON.stringify(record));
+    } catch (err2) {
+      this.available = false;
+      throw new KeystoreError(
+        "os_keystore_unavailable",
+        `OS keychain rejected write \u2014 ${asMessage(err2)}. Try MUHAVEN_KEYRING=file or run \`muhaven-broker doctor\`.`,
+        err2
+      );
+    }
+  }
+  async get() {
+    try {
+      const raw = this.entry.getPassword();
+      if (!raw) return null;
+      return parseRecord(raw);
+    } catch (err2) {
+      this.available = false;
+      throw new KeystoreError(
+        "os_keystore_unavailable",
+        `OS keychain read failed \u2014 ${asMessage(err2)}. Try MUHAVEN_KEYRING=file or run \`muhaven-broker doctor\`.`,
+        err2
+      );
+    }
+  }
+  async clear() {
+    try {
+      this.entry.deletePassword();
+    } catch (err2) {
+    }
+  }
+};
+var FileKeystore = class {
+  constructor(path) {
+    this.path = path;
+  }
+  path;
+  backend = "file";
+  available = true;
+  static defaultPath() {
+    return join(homedir(), ".muhaven", "jwt");
+  }
+  async set(record) {
+    const parent = dirname(this.path);
+    await mkdir(parent, { recursive: true, mode: 448 });
+    await chmod(parent, 448).catch(() => void 0);
+    await writeFile(this.path, JSON.stringify(record), { mode: 384 });
+    await chmod(this.path, 384).catch(() => void 0);
+  }
+  async get() {
+    try {
+      const raw = await readFile(this.path, "utf8");
+      return parseRecord(raw);
+    } catch (err2) {
+      if (err2.code === "ENOENT") return null;
+      throw new KeystoreError("file_read_failed", asMessage(err2), err2);
+    }
+  }
+  async clear() {
+    try {
+      await unlink(this.path);
+    } catch (err2) {
+      if (err2.code === "ENOENT") return;
+      throw new KeystoreError("file_clear_failed", asMessage(err2), err2);
+    }
+  }
+};
+var KeystoreError = class extends Error {
+  constructor(code, message, cause) {
+    super(message);
+    this.code = code;
+    this.cause = cause;
+    this.name = "KeystoreError";
+  }
+  code;
+  cause;
+};
+function parseRecord(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed.jwt !== "string") return null;
+    return {
+      jwt: parsed.jwt,
+      expiresAtSec: typeof parsed.expiresAtSec === "number" ? parsed.expiresAtSec : null,
+      storedAtSec: typeof parsed.storedAtSec === "number" ? parsed.storedAtSec : 0
+    };
+  } catch {
+    throw new KeystoreError("malformed_record", "keystore record is not valid JSON");
+  }
+}
+function asMessage(err2) {
+  return err2 instanceof Error ? err2.message : String(err2);
+}
+async function openKeystore(options = {}) {
+  const envPref = process.env.MUHAVEN_KEYRING?.toLowerCase();
+  const wantFile = options.preferred === "file" || envPref === "file";
+  const filePath = options.filePath ?? FileKeystore.defaultPath();
+  if (wantFile) {
+    return { keystore: new FileKeystore(filePath), fallbackReason: null };
+  }
+  const mod = await loadKeyringModule();
+  if (!mod) {
+    return {
+      keystore: new FileKeystore(filePath),
+      fallbackReason: "@napi-rs/keyring not installed for this platform"
+    };
+  }
+  const Entry = mod.Entry;
+  if (!Entry) {
+    return {
+      keystore: new FileKeystore(filePath),
+      fallbackReason: "@napi-rs/keyring loaded but Entry constructor missing"
+    };
+  }
+  let entry;
+  try {
+    entry = new Entry(KEYRING_SERVICE, KEYRING_ACCOUNT);
+    const raw = entry.getPassword();
+    if (raw && typeof raw === "string") {
+      const parsed = parseRecord(raw);
+      if (parsed === null) {
+        return {
+          keystore: new FileKeystore(filePath),
+          fallbackReason: "OS keychain held a record that did not contain a recognizable JWT \u2014 falling back to file. Run `muhaven-broker logout` if you want to clean it up."
+        };
+      }
+    }
+  } catch (err2) {
+    const isMalformed = err2 instanceof KeystoreError && err2.code === "malformed_record";
+    return {
+      keystore: new FileKeystore(filePath),
+      fallbackReason: isMalformed ? `OS keychain held a malformed JWT record \u2014 falling back to file. ${asMessage(err2)}` : `OS keychain probe failed: ${asMessage(err2)}`
+    };
+  }
+  return { keystore: new OsKeystore(entry), fallbackReason: null };
+}
+
+// src/broker/daemon.ts
+var noopLogger = (_e) => {
+};
+async function handleBrokerRequest(req, signer, keystore, nowSec = () => Math.floor(Date.now() / 1e3)) {
+  switch (req.type) {
+    case "hello": {
+      let hasJwt = false;
+      try {
+        const record = await keystore.get();
+        hasJwt = record !== null;
+      } catch {
+        hasJwt = false;
+      }
+      return {
+        type: "hello",
+        version: BROKER_PROTOCOL_VERSION,
+        sessionKeyAddress: signer.address,
+        hasJwt
+      };
+    }
+    case "sign_hash": {
+      const signature = await signer.signHash(req.hash);
+      return { type: "sign_hash", signature, signerAddress: signer.address };
+    }
+    case "store_jwt": {
+      try {
+        await keystore.set({
+          jwt: req.jwt,
+          expiresAtSec: req.expiresAtSec ?? null,
+          storedAtSec: nowSec()
+        });
+        return { type: "store_jwt", stored: true };
+      } catch (err2) {
+        return errorResponse(
+          "keystore_unavailable",
+          err2 instanceof Error ? err2.message : "keystore write failed"
+        );
+      }
+    }
+    case "get_jwt": {
+      try {
+        const record = await keystore.get();
+        return {
+          type: "get_jwt",
+          jwt: record?.jwt ?? null,
+          expiresAtSec: record?.expiresAtSec ?? null
+        };
+      } catch (err2) {
+        return errorResponse(
+          "keystore_unavailable",
+          err2 instanceof Error ? err2.message : "keystore read failed"
+        );
+      }
+    }
+    case "clear_jwt": {
+      try {
+        await keystore.clear();
+        return { type: "clear_jwt", cleared: true };
+      } catch (err2) {
+        return errorResponse(
+          "keystore_unavailable",
+          err2 instanceof Error ? err2.message : "keystore clear failed"
+        );
+      }
+    }
+  }
+}
+function errorResponse(code, message) {
+  return { type: "error", code, message };
+}
+async function prepareEndpoint(endpoint) {
+  if (platform() === "win32") return;
+  const parent = dirname(endpoint);
+  await mkdir(parent, { recursive: true, mode: 448 });
+  await chmod(parent, 448);
+  try {
+    const s = await stat(endpoint);
+    if (s.isSocket() || s.isFIFO()) {
+      await unlink(endpoint);
+    }
+  } catch (err2) {
+    if (err2.code !== "ENOENT") throw err2;
+  }
+}
+async function applySocketPermissions(endpoint) {
+  if (platform() === "win32") return;
+  await chmod(endpoint, 384);
+}
+var BrokerDaemon = class {
+  server;
+  signer;
+  log;
+  config;
+  keystore;
+  constructor(options) {
+    this.config = options.config;
+    this.signer = options.signer ?? new ViemSigner(options.config.sessionKeyHex);
+    this.keystore = options.keystore ?? null;
+    this.log = options.logger ?? noopLogger;
+    this.server = createServer((socket) => this.onConnection(socket));
+  }
+  async start() {
+    if (!this.keystore) {
+      const { keystore, fallbackReason } = await openKeystore();
+      this.keystore = keystore;
+      if (fallbackReason) {
+        this.log({
+          level: "warn",
+          msg: "OS keychain unavailable \u2014 falling back to file-backed keystore",
+          meta: { reason: fallbackReason }
+        });
+      }
+    }
+    await prepareEndpoint(this.config.endpoint);
+    await new Promise((resolve, reject) => {
+      const onError = (err2) => {
+        this.server.off("listening", onListening);
+        reject(err2);
+      };
+      const onListening = () => {
+        this.server.off("error", onError);
+        resolve();
+      };
+      this.server.once("error", onError);
+      this.server.once("listening", onListening);
+      this.server.listen(this.config.endpoint);
+    });
+    await applySocketPermissions(this.config.endpoint);
+    this.log({
+      level: "info",
+      msg: "broker daemon listening",
+      meta: {
+        endpoint: this.config.endpoint,
+        signer: this.signer.address,
+        keystore: this.keystore.backend,
+        version: BROKER_PROTOCOL_VERSION
+      }
+    });
+    return this.config.endpoint;
+  }
+  async stop() {
+    await new Promise((resolve, reject) => {
+      this.server.close((err2) => err2 ? reject(err2) : resolve());
+    });
+    if (platform() !== "win32") {
+      try {
+        await unlink(this.config.endpoint);
+      } catch (err2) {
+        if (err2.code !== "ENOENT") {
+          this.log({ level: "warn", msg: "failed to unlink socket on stop", meta: { err: err2 } });
+        }
+      }
+    }
+    this.log({ level: "info", msg: "broker daemon stopped" });
+  }
+  onConnection(socket) {
+    let buffer = "";
+    let bytesReceived = 0;
+    const timeout = setTimeout(() => {
+      this.log({ level: "warn", msg: "connection timeout \u2014 closing socket" });
+      socket.destroy();
+    }, this.config.requestTimeoutMs);
+    const cleanup = () => {
+      clearTimeout(timeout);
+      socket.removeAllListeners("data");
+      socket.removeAllListeners("end");
+      socket.removeAllListeners("error");
+    };
+    socket.on("data", (chunk) => {
+      bytesReceived += chunk.length;
+      if (bytesReceived > this.config.maxRequestBytes) {
+        const res = errorResponse("payload_too_large", "request exceeded maxRequestBytes");
+        socket.end(serializeResponse(res));
+        cleanup();
+        return;
+      }
+      buffer += chunk.toString("utf8");
+      const newlineIdx = buffer.indexOf("\n");
+      if (newlineIdx < 0) return;
+      const trailing = buffer.slice(newlineIdx + 1);
+      if (trailing.length > 0) {
+        const res = errorResponse(
+          "invalid_request",
+          "broker is single-shot \u2014 extra bytes after first newline"
+        );
+        socket.end(serializeResponse(res));
+        cleanup();
+        return;
+      }
+      const line = buffer.slice(0, newlineIdx);
+      const parsed = parseBrokerRequest(line);
+      void this.runAndRespond(parsed, socket).finally(() => {
+        cleanup();
+      });
+    });
+    socket.on("error", (err2) => {
+      this.log({ level: "warn", msg: "socket error", meta: { err: err2.message } });
+      cleanup();
+    });
+    socket.on("end", () => {
+      cleanup();
+    });
+  }
+  async runAndRespond(parsed, socket) {
+    if ("type" in parsed && parsed.type === "error") {
+      socket.end(serializeResponse(parsed));
+      return;
+    }
+    if (!this.keystore) {
+      socket.end(
+        serializeResponse(errorResponse("internal", "keystore not initialized"))
+      );
+      return;
+    }
+    try {
+      const res = await handleBrokerRequest(parsed, this.signer, this.keystore);
+      socket.end(serializeResponse(res));
+    } catch (err2) {
+      this.log({
+        level: "error",
+        msg: "handler failed",
+        meta: { err: err2 instanceof Error ? err2.message : String(err2) }
+      });
+      socket.end(
+        serializeResponse(errorResponse("internal", "broker handler failed; check broker logs"))
+      );
+    }
+  }
+};
+
+export { BROKER_PROTOCOL_VERSION, BackendClient, BackendError, BrokerClient, BrokerClientError, BrokerDaemon, DeviceFlowAbortedError, DeviceFlowClient, JwtSource, KeystoreError, NoJwtAvailableError, TOOL_DESCRIPTORS, buildMcpServer, buildToolHashTable, defaultBrokerEndpoint, fullToolRegistry, handleBrokerRequest, hashToolDescriptor, loadBrokerConfig, loadMcpConfig, openKeystore, parseBrokerRequest, registryForReadOnly, runMcpStdioCli, selectRegistry, serializeResponse, verifyDescriptorAgainstPin };