@shroud-fi/mcp-server 0.1.0

package/dist/cjs/constants.js

@@ -0,0 +1,35 @@
+"use strict";
+/**
+ * Static constants. All env reads live here per verify-privacy R5.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENV_MASTER_SEED_FILE = exports.ENV_MASTER_SEED = exports.ENV_HTTP_ALLOWED_WALLETS = exports.ENV_HTTP_PORT = exports.ENV_START_BLOCK = exports.ENV_CHAIN = exports.ENV_RPC_URL = exports.ENV_PRIVATE_KEY_FILE = exports.ENV_PRIVATE_KEY = exports.DEFAULT_RPC_URL_BY_CHAIN = exports.EIP191_CHALLENGE_TTL_MS = exports.SHROUDFI_MCP_SERVER_VERSION = exports.SHROUDFI_MCP_SERVER_NAME = void 0;
+exports.SHROUDFI_MCP_SERVER_NAME = 'shroudfi-mcp';
+exports.SHROUDFI_MCP_SERVER_VERSION = '0.0.1';
+/** EIP-191 challenge TTL — short window so a replayed challenge dies fast. */
+exports.EIP191_CHALLENGE_TTL_MS = 5 * 60 * 1000;
+/** Default RPC URLs by chain id. Operator override via SHROUDFI_RPC_URL. */
+exports.DEFAULT_RPC_URL_BY_CHAIN = {
+    8453: 'https://mainnet.base.org',
+    84532: 'https://sepolia.base.org',
+};
+/** Env knobs the bootstrap surface reads. */
+exports.ENV_PRIVATE_KEY = 'SHROUDFI_PRIVATE_KEY';
+exports.ENV_PRIVATE_KEY_FILE = 'SHROUDFI_PRIVATE_KEY_FILE';
+exports.ENV_RPC_URL = 'SHROUDFI_RPC_URL';
+exports.ENV_CHAIN = 'SHROUDFI_CHAIN';
+exports.ENV_START_BLOCK = 'SHROUDFI_START_BLOCK';
+exports.ENV_HTTP_PORT = 'SHROUDFI_MCP_HTTP_PORT';
+exports.ENV_HTTP_ALLOWED_WALLETS = 'SHROUDFI_MCP_HTTP_ALLOWED_WALLETS';
+/**
+ * Deterministic 32-byte master seed (0x… 64 hex chars). When set, every
+ * boot of the MCP server, REST API, or any other surface using
+ * `loadBootstrapConfigFromEnv` resolves the SAME stealth meta-address for
+ * the same operator EOA. When unset, a fresh random seed is generated per
+ * process — fine for local testing, BAD for production multi-surface
+ * deployments (caller's main wallet ↔ stealth meta-address binding would
+ * desync between MCP, REST, and UI processes).
+ */
+exports.ENV_MASTER_SEED = 'SHROUDFI_MASTER_SEED';
+exports.ENV_MASTER_SEED_FILE = 'SHROUDFI_MASTER_SEED_FILE';
+//# sourceMappingURL=constants.js.map

package/dist/cjs/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEU,QAAA,wBAAwB,GAAG,cAAuB,CAAC;AACnD,QAAA,2BAA2B,GAAG,OAAgB,CAAC;AAE5D,8EAA8E;AACjE,QAAA,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAErD,4EAA4E;AAC/D,QAAA,wBAAwB,GAA2B;IAC9D,IAAI,EAAE,0BAA0B;IAChC,KAAK,EAAE,0BAA0B;CAClC,CAAC;AAEF,6CAA6C;AAChC,QAAA,eAAe,GAAG,sBAA+B,CAAC;AAClD,QAAA,oBAAoB,GAAG,2BAAoC,CAAC;AAC5D,QAAA,WAAW,GAAG,kBAA2B,CAAC;AAC1C,QAAA,SAAS,GAAG,gBAAyB,CAAC;AACtC,QAAA,eAAe,GAAG,sBAA+B,CAAC;AAClD,QAAA,aAAa,GAAG,wBAAiC,CAAC;AAClD,QAAA,wBAAwB,GAAG,mCAA4C,CAAC;AACrF;;;;;;;;GAQG;AACU,QAAA,eAAe,GAAG,sBAA+B,CAAC;AAClD,QAAA,oBAAoB,GAAG,2BAAoC,CAAC"}

package/dist/cjs/errors.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Errors for @shroud-fi/mcp-server.
+ *
+ * Privacy invariants:
+ *   - No private keys, signatures, or amounts in error messages.
+ *   - No wallet addresses concatenated into `.message` strings — addresses
+ *     are exposed on dedicated structured fields when needed.
+ */
+export declare class McpServerError extends Error {
+    readonly name: string;
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+export declare class McpConfigError extends McpServerError {
+    readonly name = "McpConfigError";
+    constructor(message: string);
+}
+export declare class McpUnauthorizedError extends McpServerError {
+    readonly name = "McpUnauthorizedError";
+    constructor();
+}
+export declare class McpToolNotFoundError extends McpServerError {
+    readonly name = "McpToolNotFoundError";
+    constructor();
+}
+export declare class McpInvalidArgsError extends McpServerError {
+    readonly name = "McpInvalidArgsError";
+    constructor();
+}
+export declare class McpExecutionError extends McpServerError {
+    readonly name = "McpExecutionError";
+    readonly cause: unknown;
+    constructor(cause: unknown);
+}
+export declare class McpEip191ChallengeExpiredError extends McpServerError {
+    readonly name = "McpEip191ChallengeExpiredError";
+    constructor();
+}
+export declare class McpEip191SignatureInvalidError extends McpServerError {
+    readonly name = "McpEip191SignatureInvalidError";
+    constructor();
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/cjs/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,qBAAa,cAAe,SAAQ,KAAK;IACvC,SAAkB,IAAI,EAAE,MAAM,CAAoB;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAI1C;AAED,qBAAa,cAAe,SAAQ,cAAc;IAChD,SAAkB,IAAI,oBAAoB;gBAC9B,OAAO,EAAE,MAAM;CAG5B;AAED,qBAAa,oBAAqB,SAAQ,cAAc;IACtD,SAAkB,IAAI,0BAA0B;;CAIjD;AAED,qBAAa,oBAAqB,SAAQ,cAAc;IACtD,SAAkB,IAAI,0BAA0B;;CAIjD;AAED,qBAAa,mBAAoB,SAAQ,cAAc;IACrD,SAAkB,IAAI,yBAAyB;;CAIhD;AAED,qBAAa,iBAAkB,SAAQ,cAAc;IACnD,SAAkB,IAAI,uBAAuB;IAC7C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;gBACZ,KAAK,EAAE,OAAO;CAI3B;AAED,qBAAa,8BAA+B,SAAQ,cAAc;IAChE,SAAkB,IAAI,oCAAoC;;CAI3D;AAED,qBAAa,8BAA+B,SAAQ,cAAc;IAChE,SAAkB,IAAI,oCAAoC;;CAI3D"}

package/dist/cjs/errors.js

@@ -0,0 +1,72 @@
+"use strict";
+/**
+ * Errors for @shroud-fi/mcp-server.
+ *
+ * Privacy invariants:
+ *   - No private keys, signatures, or amounts in error messages.
+ *   - No wallet addresses concatenated into `.message` strings — addresses
+ *     are exposed on dedicated structured fields when needed.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpEip191SignatureInvalidError = exports.McpEip191ChallengeExpiredError = exports.McpExecutionError = exports.McpInvalidArgsError = exports.McpToolNotFoundError = exports.McpUnauthorizedError = exports.McpConfigError = exports.McpServerError = void 0;
+class McpServerError extends Error {
+    name = 'McpServerError';
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+    }
+}
+exports.McpServerError = McpServerError;
+class McpConfigError extends McpServerError {
+    name = 'McpConfigError';
+    constructor(message) {
+        super(message, 'config_invalid');
+    }
+}
+exports.McpConfigError = McpConfigError;
+class McpUnauthorizedError extends McpServerError {
+    name = 'McpUnauthorizedError';
+    constructor() {
+        super('Unauthorized', 'unauthorized');
+    }
+}
+exports.McpUnauthorizedError = McpUnauthorizedError;
+class McpToolNotFoundError extends McpServerError {
+    name = 'McpToolNotFoundError';
+    constructor() {
+        super('Tool not found', 'tool_not_found');
+    }
+}
+exports.McpToolNotFoundError = McpToolNotFoundError;
+class McpInvalidArgsError extends McpServerError {
+    name = 'McpInvalidArgsError';
+    constructor() {
+        super('Invalid tool arguments', 'invalid_args');
+    }
+}
+exports.McpInvalidArgsError = McpInvalidArgsError;
+class McpExecutionError extends McpServerError {
+    name = 'McpExecutionError';
+    cause;
+    constructor(cause) {
+        super('Tool execution failed', 'execution_failed');
+        this.cause = cause;
+    }
+}
+exports.McpExecutionError = McpExecutionError;
+class McpEip191ChallengeExpiredError extends McpServerError {
+    name = 'McpEip191ChallengeExpiredError';
+    constructor() {
+        super('EIP-191 challenge expired', 'auth_challenge_expired');
+    }
+}
+exports.McpEip191ChallengeExpiredError = McpEip191ChallengeExpiredError;
+class McpEip191SignatureInvalidError extends McpServerError {
+    name = 'McpEip191SignatureInvalidError';
+    constructor() {
+        super('EIP-191 signature invalid', 'auth_signature_invalid');
+    }
+}
+exports.McpEip191SignatureInvalidError = McpEip191SignatureInvalidError;
+//# sourceMappingURL=errors.js.map

package/dist/cjs/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,MAAa,cAAe,SAAQ,KAAK;IACrB,IAAI,GAAW,gBAAgB,CAAC;IACzC,IAAI,CAAS;IACtB,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAPD,wCAOC;AAED,MAAa,cAAe,SAAQ,cAAc;IAC9B,IAAI,GAAG,gBAAgB,CAAC;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACnC,CAAC;CACF;AALD,wCAKC;AAED,MAAa,oBAAqB,SAAQ,cAAc;IACpC,IAAI,GAAG,sBAAsB,CAAC;IAChD;QACE,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IACxC,CAAC;CACF;AALD,oDAKC;AAED,MAAa,oBAAqB,SAAQ,cAAc;IACpC,IAAI,GAAG,sBAAsB,CAAC;IAChD;QACE,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IAC5C,CAAC;CACF;AALD,oDAKC;AAED,MAAa,mBAAoB,SAAQ,cAAc;IACnC,IAAI,GAAG,qBAAqB,CAAC;IAC/C;QACE,KAAK,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAC;IAClD,CAAC;CACF;AALD,kDAKC;AAED,MAAa,iBAAkB,SAAQ,cAAc;IACjC,IAAI,GAAG,mBAAmB,CAAC;IACpC,KAAK,CAAU;IACxB,YAAY,KAAc;QACxB,KAAK,CAAC,uBAAuB,EAAE,kBAAkB,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAPD,8CAOC;AAED,MAAa,8BAA+B,SAAQ,cAAc;IAC9C,IAAI,GAAG,gCAAgC,CAAC;IAC1D;QACE,KAAK,CAAC,2BAA2B,EAAE,wBAAwB,CAAC,CAAC;IAC/D,CAAC;CACF;AALD,wEAKC;AAED,MAAa,8BAA+B,SAAQ,cAAc;IAC9C,IAAI,GAAG,gCAAgC,CAAC;IAC1D;QACE,KAAK,CAAC,2BAA2B,EAAE,wBAAwB,CAAC,CAAC;IAC/D,CAAC;CACF;AALD,wEAKC"}

package/dist/cjs/http.d.ts

@@ -0,0 +1,32 @@
+/**
+ * HTTP transport for the MCP server.
+ *
+ * Uses node:http to stay zero-dep. Exposes three endpoints:
+ *   POST /auth/challenge   → mint EIP-191 challenge
+ *   POST /mcp              → JSON-RPC framed MCP body (auth-gated)
+ *   GET  /healthz          → public liveness ping
+ *
+ * Auth rules:
+ *   - /auth/challenge      public (clients need a way to get a challenge)
+ *   - /mcp                 requires X-Shroudfi-Wallet + X-Shroudfi-Nonce +
+ *                          X-Shroudfi-Signature headers. Signature is verified,
+ *                          consumed (single-use), allow-list checked.
+ *   - /healthz             public
+ *
+ * Privacy invariants:
+ *   - Signatures never logged or echoed.
+ *   - Errors are short tag strings; no body bytes, no key bytes.
+ *   - Allow-list is enforced when SHROUDFI_MCP_HTTP_ALLOWED_WALLETS is set;
+ *     when empty, ANY EIP-191 wallet may authenticate. Operators MUST set
+ *     the allow-list in production.
+ */
+import type { McpServerBootstrapConfig } from './types.js';
+interface RunHttpServerOptions {
+    readonly port: number;
+    readonly bootstrap?: McpServerBootstrapConfig;
+}
+export declare function runHttpServer(opts: RunHttpServerOptions): Promise<{
+    readonly close: () => Promise<void>;
+}>;
+export {};
+//# sourceMappingURL=http.d.ts.map

package/dist/cjs/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH,OAAO,KAAK,EAAE,wBAAwB,EAAoB,MAAM,YAAY,CAAC;AAS7E,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,wBAAwB,CAAC;CAC/C;AAoGD,wBAAsB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC,CAAC,CA0BD"}

package/dist/cjs/http.js

@@ -0,0 +1,180 @@
+"use strict";
+/**
+ * HTTP transport for the MCP server.
+ *
+ * Uses node:http to stay zero-dep. Exposes three endpoints:
+ *   POST /auth/challenge   → mint EIP-191 challenge
+ *   POST /mcp              → JSON-RPC framed MCP body (auth-gated)
+ *   GET  /healthz          → public liveness ping
+ *
+ * Auth rules:
+ *   - /auth/challenge      public (clients need a way to get a challenge)
+ *   - /mcp                 requires X-Shroudfi-Wallet + X-Shroudfi-Nonce +
+ *                          X-Shroudfi-Signature headers. Signature is verified,
+ *                          consumed (single-use), allow-list checked.
+ *   - /healthz             public
+ *
+ * Privacy invariants:
+ *   - Signatures never logged or echoed.
+ *   - Errors are short tag strings; no body bytes, no key bytes.
+ *   - Allow-list is enforced when SHROUDFI_MCP_HTTP_ALLOWED_WALLETS is set;
+ *     when empty, ANY EIP-191 wallet may authenticate. Operators MUST set
+ *     the allow-list in production.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runHttpServer = runHttpServer;
+const node_http_1 = require("node:http");
+const viem_1 = require("viem");
+const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
+const index_js_1 = require("./tools/index.js");
+const auth_js_1 = require("./auth.js");
+const config_js_1 = require("./config.js");
+const errors_js_1 = require("./errors.js");
+const HEADER_WALLET = 'x-shroudfi-wallet';
+const HEADER_NONCE = 'x-shroudfi-nonce';
+const HEADER_SIGNATURE = 'x-shroudfi-signature';
+const JSON_HEADERS = { 'content-type': 'application/json' };
+async function readJsonBody(req) {
+    const chunks = [];
+    for await (const chunk of req) {
+        chunks.push(chunk);
+        if (Buffer.concat(chunks).length > 1_048_576) {
+            throw new errors_js_1.McpInvalidArgsError();
+        }
+    }
+    const raw = Buffer.concat(chunks).toString('utf-8');
+    if (raw.length === 0)
+        return {};
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        throw new errors_js_1.McpInvalidArgsError();
+    }
+}
+function send(res, status, body) {
+    res.writeHead(status, JSON_HEADERS);
+    res.end(JSON.stringify(body));
+}
+async function authenticate(req, authCache, allowList) {
+    const wallet = req.headers[HEADER_WALLET];
+    const nonce = req.headers[HEADER_NONCE];
+    const sig = req.headers[HEADER_SIGNATURE];
+    if (typeof wallet !== 'string' ||
+        typeof nonce !== 'string' ||
+        typeof sig !== 'string') {
+        throw new errors_js_1.McpUnauthorizedError();
+    }
+    if (!(0, viem_1.isHex)(wallet) || wallet.length !== 42)
+        throw new errors_js_1.McpUnauthorizedError();
+    if (!(0, viem_1.isHex)(nonce))
+        throw new errors_js_1.McpUnauthorizedError();
+    if (!(0, viem_1.isHex)(sig))
+        throw new errors_js_1.McpUnauthorizedError();
+    const walletLc = wallet.toLowerCase();
+    if (allowList.size > 0 && !allowList.has(walletLc)) {
+        throw new errors_js_1.McpUnauthorizedError();
+    }
+    await authCache.verifyAndConsume({
+        wallet: walletLc,
+        nonce: nonce,
+        signature: sig,
+    });
+    return walletLc;
+}
+/**
+ * Direct JSON-RPC-ish dispatch — we expose the same RPC envelope MCP uses but
+ * over a synchronous request/response cycle (no SSE in v1). Clients send:
+ *   { method: 'tools/list', params: {} }
+ *   { method: 'tools/call', params: { name, arguments } }
+ */
+async function dispatch(ctx, body) {
+    if (typeof body !== 'object' ||
+        body === null ||
+        !('method' in body) ||
+        typeof body.method !== 'string') {
+        throw new errors_js_1.McpInvalidArgsError();
+    }
+    const method = body.method;
+    const params = (body.params ?? {});
+    if (method === 'tools/list') {
+        types_js_1.ListToolsRequestSchema.parse({ method, params });
+        return {
+            tools: index_js_1.ALL_TOOLS.map((t) => ({
+                name: t.name,
+                description: t.description,
+                inputSchema: t.inputSchema,
+            })),
+        };
+    }
+    if (method === 'tools/call') {
+        const parsed = types_js_1.CallToolRequestSchema.parse({ method, params });
+        const tool = (0, index_js_1.findTool)(parsed.params.name);
+        if (tool === undefined) {
+            throw new errors_js_1.McpInvalidArgsError();
+        }
+        const args = parsed.params.arguments ?? {};
+        const result = await tool.handler(ctx, args);
+        return {
+            content: [{ type: 'text', text: JSON.stringify(result) }],
+        };
+    }
+    throw new errors_js_1.McpInvalidArgsError();
+}
+async function runHttpServer(opts) {
+    const bootstrap = opts.bootstrap ?? (0, config_js_1.loadBootstrapConfigFromEnv)();
+    const ctx = (0, config_js_1.buildContextFromConfig)(bootstrap);
+    const authCache = (0, auth_js_1.createAuthCache)();
+    const allowList = bootstrap.httpAllowedWallets;
+    const server = (0, node_http_1.createServer)((req, res) => {
+        void handleRequest(req, res, ctx, authCache, allowList).catch((err) => {
+            if (err instanceof errors_js_1.McpServerError) {
+                send(res, 400, { ok: false, code: err.code });
+                return;
+            }
+            send(res, 500, { ok: false, code: 'internal_error' });
+        });
+    });
+    await new Promise((resolve) => {
+        server.listen(opts.port, () => resolve());
+    });
+    return {
+        close: () => new Promise((resolve, reject) => {
+            server.close((err) => (err ? reject(err) : resolve()));
+        }),
+    };
+}
+async function handleRequest(req, res, ctx, authCache, allowList) {
+    const url = req.url ?? '/';
+    const method = req.method ?? 'GET';
+    if (url === '/healthz' && method === 'GET') {
+        send(res, 200, { ok: true });
+        return;
+    }
+    if (url === '/auth/challenge' && method === 'POST') {
+        const body = (await readJsonBody(req));
+        if (typeof body.wallet !== 'string' ||
+            !(0, viem_1.isHex)(body.wallet) ||
+            body.wallet.length !== 42) {
+            throw new errors_js_1.McpInvalidArgsError();
+        }
+        const challenge = authCache.issue(body.wallet.toLowerCase());
+        send(res, 200, {
+            ok: true,
+            wallet: challenge.wallet,
+            nonce: challenge.nonce,
+            message: challenge.message,
+            expiresAtMs: challenge.expiresAtMs,
+        });
+        return;
+    }
+    if (url === '/mcp' && method === 'POST') {
+        await authenticate(req, authCache, allowList);
+        const body = await readJsonBody(req);
+        const result = await dispatch(ctx, body);
+        send(res, 200, { ok: true, result });
+        return;
+    }
+    send(res, 404, { ok: false, code: 'not_found' });
+}
+//# sourceMappingURL=http.js.map

package/dist/cjs/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/http.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;AAyHH,sCA4BC;AAnJD,yCAAoF;AAEpF,+BAA6B;AAC7B,iEAAmG;AACnG,+CAAuD;AACvD,uCAA4D;AAC5D,2CAAiF;AAEjF,2CAAwF;AAExF,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAC1C,MAAM,YAAY,GAAG,kBAAkB,CAAC;AACxC,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAEhD,MAAM,YAAY,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAW,CAAC;AAOrE,KAAK,UAAU,YAAY,CAAC,GAAoB;IAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,+BAAmB,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,+BAAmB,EAAE,CAAC;IAClC,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,GAAoB,EACpB,SAAoB,EACpB,SAAqC;IAErC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1C,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,GAAG,KAAK,QAAQ,EACvB,CAAC;QACD,MAAM,IAAI,gCAAoB,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,IAAA,YAAK,EAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,gCAAoB,EAAE,CAAC;IAC7E,IAAI,CAAC,IAAA,YAAK,EAAC,KAAK,CAAC;QAAE,MAAM,IAAI,gCAAoB,EAAE,CAAC;IACpD,IAAI,CAAC,IAAA,YAAK,EAAC,GAAG,CAAC;QAAE,MAAM,IAAI,gCAAoB,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,EAAmB,CAAC;IACvD,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,gCAAoB,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,SAAS,CAAC,gBAAgB,CAAC;QAC/B,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,KAAY;QACnB,SAAS,EAAE,GAAU;KACtB,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,QAAQ,CACrB,GAAqB,EACrB,IAAa;IAEb,IACE,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACb,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC;QACnB,OAAQ,IAA4B,CAAC,MAAM,KAAK,QAAQ,EACxD,CAAC;QACD,MAAM,IAAI,+BAAmB,EAAE,CAAC;IAClC,CAAC;IACD,MAAM,MAAM,GAAI,IAA2B,CAAC,MAAM,CAAC;IACnD,MAAM,MAAM,GAAG,CAAE,IAA6B,CAAC,MAAM,IAAI,EAAE,CAAY,CAAC;IAExE,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,iCAAsB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO;YACL,KAAK,EAAE,oBAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;aAC3B,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,gCAAqB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAA,mBAAQ,EAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,+BAAmB,EAAE,CAAC;QAClC,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7C,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;SAC1D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,+BAAmB,EAAE,CAAC;AAClC,CAAC;AAEM,KAAK,UAAU,aAAa,CAAC,IAA0B;IAG5D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAA,sCAA0B,GAAE,CAAC;IACjE,MAAM,GAAG,GAAG,IAAA,kCAAsB,EAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAA,yBAAe,GAAE,CAAC;IACpC,MAAM,SAAS,GAAG,SAAS,CAAC,kBAAkB,CAAC;IAE/C,MAAM,MAAM,GAAG,IAAA,wBAAY,EAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,KAAK,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACpE,IAAI,GAAG,YAAY,0BAAc,EAAE,CAAC;gBAClC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YACD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAoB,EACpB,GAAmB,EACnB,GAAqB,EACrB,SAAoB,EACpB,SAAqC;IAErC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;IAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IAEnC,IAAI,GAAG,KAAK,UAAU,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QAC3C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7B,OAAO;IACT,CAAC;IAED,IAAI,GAAG,KAAK,iBAAiB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,CAAwB,CAAC;QAC9D,IACE,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;YAC/B,CAAC,IAAA,YAAK,EAAC,IAAI,CAAC,MAAM,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,EAAE,EACzB,CAAC;YACD,MAAM,IAAI,+BAAmB,EAAE,CAAC;QAClC,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAmB,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;YACb,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,WAAW,EAAE,SAAS,CAAC,WAAW;SACnC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,GAAG,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACxC,MAAM,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;AACnD,CAAC"}

package/dist/cjs/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Public barrel — @shroud-fi/mcp-server.
+ *
+ * Two consumption paths:
+ *   - `import { runStdioServer } from '@shroud-fi/mcp-server'` for stdio bin.
+ *   - `import { runHttpServer } from '@shroud-fi/mcp-server/http'` for HTTP.
+ *   - `import { ALL_TOOLS } from '@shroud-fi/mcp-server/tools'` to embed the
+ *     tool registry into a host MCP server you already own.
+ */
+export { runStdioServer } from './stdio.js';
+export { runHttpServer } from './http.js';
+export { buildMcpServer } from './server.js';
+export { buildContextFromConfig, loadBootstrapConfigFromEnv, readHttpPortFromEnv, } from './config.js';
+export { createAuthCache } from './auth.js';
+export { ALL_TOOLS, findTool } from './tools/index.js';
+export type { McpTool, McpToolResult, McpServerContext, McpServerBootstrapConfig, Eip191Challenge, } from './types.js';
+export { McpServerError, McpConfigError, McpUnauthorizedError, McpToolNotFoundError, McpInvalidArgsError, McpExecutionError, McpEip191ChallengeExpiredError, McpEip191SignatureInvalidError, } from './errors.js';
+export { SHROUDFI_MCP_SERVER_NAME, SHROUDFI_MCP_SERVER_VERSION, } from './constants.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACvD,YAAY,EACV,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,wBAAwB,EACxB,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC"}

package/dist/cjs/index.js

@@ -0,0 +1,40 @@
+"use strict";
+/**
+ * Public barrel — @shroud-fi/mcp-server.
+ *
+ * Two consumption paths:
+ *   - `import { runStdioServer } from '@shroud-fi/mcp-server'` for stdio bin.
+ *   - `import { runHttpServer } from '@shroud-fi/mcp-server/http'` for HTTP.
+ *   - `import { ALL_TOOLS } from '@shroud-fi/mcp-server/tools'` to embed the
+ *     tool registry into a host MCP server you already own.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SHROUDFI_MCP_SERVER_VERSION = exports.SHROUDFI_MCP_SERVER_NAME = exports.McpEip191SignatureInvalidError = exports.McpEip191ChallengeExpiredError = exports.McpExecutionError = exports.McpInvalidArgsError = exports.McpToolNotFoundError = exports.McpUnauthorizedError = exports.McpConfigError = exports.McpServerError = exports.findTool = exports.ALL_TOOLS = exports.createAuthCache = exports.readHttpPortFromEnv = exports.loadBootstrapConfigFromEnv = exports.buildContextFromConfig = exports.buildMcpServer = exports.runHttpServer = exports.runStdioServer = void 0;
+var stdio_js_1 = require("./stdio.js");
+Object.defineProperty(exports, "runStdioServer", { enumerable: true, get: function () { return stdio_js_1.runStdioServer; } });
+var http_js_1 = require("./http.js");
+Object.defineProperty(exports, "runHttpServer", { enumerable: true, get: function () { return http_js_1.runHttpServer; } });
+var server_js_1 = require("./server.js");
+Object.defineProperty(exports, "buildMcpServer", { enumerable: true, get: function () { return server_js_1.buildMcpServer; } });
+var config_js_1 = require("./config.js");
+Object.defineProperty(exports, "buildContextFromConfig", { enumerable: true, get: function () { return config_js_1.buildContextFromConfig; } });
+Object.defineProperty(exports, "loadBootstrapConfigFromEnv", { enumerable: true, get: function () { return config_js_1.loadBootstrapConfigFromEnv; } });
+Object.defineProperty(exports, "readHttpPortFromEnv", { enumerable: true, get: function () { return config_js_1.readHttpPortFromEnv; } });
+var auth_js_1 = require("./auth.js");
+Object.defineProperty(exports, "createAuthCache", { enumerable: true, get: function () { return auth_js_1.createAuthCache; } });
+var index_js_1 = require("./tools/index.js");
+Object.defineProperty(exports, "ALL_TOOLS", { enumerable: true, get: function () { return index_js_1.ALL_TOOLS; } });
+Object.defineProperty(exports, "findTool", { enumerable: true, get: function () { return index_js_1.findTool; } });
+var errors_js_1 = require("./errors.js");
+Object.defineProperty(exports, "McpServerError", { enumerable: true, get: function () { return errors_js_1.McpServerError; } });
+Object.defineProperty(exports, "McpConfigError", { enumerable: true, get: function () { return errors_js_1.McpConfigError; } });
+Object.defineProperty(exports, "McpUnauthorizedError", { enumerable: true, get: function () { return errors_js_1.McpUnauthorizedError; } });
+Object.defineProperty(exports, "McpToolNotFoundError", { enumerable: true, get: function () { return errors_js_1.McpToolNotFoundError; } });
+Object.defineProperty(exports, "McpInvalidArgsError", { enumerable: true, get: function () { return errors_js_1.McpInvalidArgsError; } });
+Object.defineProperty(exports, "McpExecutionError", { enumerable: true, get: function () { return errors_js_1.McpExecutionError; } });
+Object.defineProperty(exports, "McpEip191ChallengeExpiredError", { enumerable: true, get: function () { return errors_js_1.McpEip191ChallengeExpiredError; } });
+Object.defineProperty(exports, "McpEip191SignatureInvalidError", { enumerable: true, get: function () { return errors_js_1.McpEip191SignatureInvalidError; } });
+var constants_js_1 = require("./constants.js");
+Object.defineProperty(exports, "SHROUDFI_MCP_SERVER_NAME", { enumerable: true, get: function () { return constants_js_1.SHROUDFI_MCP_SERVER_NAME; } });
+Object.defineProperty(exports, "SHROUDFI_MCP_SERVER_VERSION", { enumerable: true, get: function () { return constants_js_1.SHROUDFI_MCP_SERVER_VERSION; } });
+//# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAEH,uCAA4C;AAAnC,0GAAA,cAAc,OAAA;AACvB,qCAA0C;AAAjC,wGAAA,aAAa,OAAA;AACtB,yCAA6C;AAApC,2GAAA,cAAc,OAAA;AACvB,yCAIqB;AAHnB,mHAAA,sBAAsB,OAAA;AACtB,uHAAA,0BAA0B,OAAA;AAC1B,gHAAA,mBAAmB,OAAA;AAErB,qCAA4C;AAAnC,0GAAA,eAAe,OAAA;AACxB,6CAAuD;AAA9C,qGAAA,SAAS,OAAA;AAAE,oGAAA,QAAQ,OAAA;AAQ5B,yCASqB;AARnB,2GAAA,cAAc,OAAA;AACd,2GAAA,cAAc,OAAA;AACd,iHAAA,oBAAoB,OAAA;AACpB,iHAAA,oBAAoB,OAAA;AACpB,gHAAA,mBAAmB,OAAA;AACnB,8GAAA,iBAAiB,OAAA;AACjB,2HAAA,8BAA8B,OAAA;AAC9B,2HAAA,8BAA8B,OAAA;AAEhC,+CAGwB;AAFtB,wHAAA,wBAAwB,OAAA;AACxB,2HAAA,2BAA2B,OAAA"}

package/dist/cjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}

package/dist/cjs/server.d.ts

@@ -0,0 +1,14 @@
+/**
+ * MCP server core — wires our tool registry into the official MCP SDK.
+ *
+ * Transport-agnostic: this function builds the configured Server instance.
+ * stdio.ts and http.ts each connect it to their respective transport.
+ */
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import type { McpServerContext } from './types.js';
+/**
+ * Build a configured MCP Server. The caller plugs in a transport via
+ * `server.connect(transport)` once this returns.
+ */
+export declare function buildMcpServer(ctx: McpServerContext): Server;
+//# sourceMappingURL=server.d.ts.map

package/dist/cjs/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAYnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CA6E5D"}

package/dist/cjs/server.js

@@ -0,0 +1,92 @@
+"use strict";
+/**
+ * MCP server core — wires our tool registry into the official MCP SDK.
+ *
+ * Transport-agnostic: this function builds the configured Server instance.
+ * stdio.ts and http.ts each connect it to their respective transport.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildMcpServer = buildMcpServer;
+const index_js_1 = require("@modelcontextprotocol/sdk/server/index.js");
+const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
+const index_js_2 = require("./tools/index.js");
+const constants_js_1 = require("./constants.js");
+const errors_js_1 = require("./errors.js");
+/**
+ * Build a configured MCP Server. The caller plugs in a transport via
+ * `server.connect(transport)` once this returns.
+ */
+function buildMcpServer(ctx) {
+    const server = new index_js_1.Server({
+        name: constants_js_1.SHROUDFI_MCP_SERVER_NAME,
+        version: constants_js_1.SHROUDFI_MCP_SERVER_VERSION,
+    }, {
+        capabilities: {
+            tools: {},
+        },
+    });
+    server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => {
+        const tools = index_js_2.ALL_TOOLS.map((t) => ({
+            name: t.name,
+            description: t.description,
+            inputSchema: t.inputSchema,
+        }));
+        return { tools };
+    });
+    server.setRequestHandler(types_js_1.CallToolRequestSchema, async (req) => {
+        const name = req.params.name;
+        const tool = (0, index_js_2.findTool)(name);
+        if (tool === undefined) {
+            throw new errors_js_1.McpToolNotFoundError();
+        }
+        try {
+            const args = (req.params.arguments ?? {});
+            const result = await tool.handler(ctx, args);
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: JSON.stringify(result),
+                    },
+                ],
+            };
+        }
+        catch (err) {
+            if (err instanceof errors_js_1.McpInvalidArgsError || err instanceof errors_js_1.McpToolNotFoundError) {
+                return {
+                    isError: true,
+                    content: [
+                        {
+                            type: 'text',
+                            text: JSON.stringify({ ok: false, code: err.code, message: err.message }),
+                        },
+                    ],
+                };
+            }
+            if (err instanceof errors_js_1.McpServerError) {
+                return {
+                    isError: true,
+                    content: [
+                        {
+                            type: 'text',
+                            text: JSON.stringify({ ok: false, code: err.code, message: err.message }),
+                        },
+                    ],
+                };
+            }
+            // Wrap unexpected error — short tag only, never the raw .message.
+            const code = err?.name ?? 'execution_failed';
+            return {
+                isError: true,
+                content: [
+                    {
+                        type: 'text',
+                        text: JSON.stringify({ ok: false, code, message: 'Tool execution failed' }),
+                    },
+                ],
+            };
+        }
+    });
+    return server;
+}
+//# sourceMappingURL=server.js.map

package/dist/cjs/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/server.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAoBH,wCA6EC;AA/FD,wEAAmE;AACnE,iEAI4C;AAC5C,+CAAuD;AACvD,iDAGwB;AACxB,2CAAwF;AAGxF;;;GAGG;AACH,SAAgB,cAAc,CAAC,GAAqB;IAClD,MAAM,MAAM,GAAG,IAAI,iBAAM,CACvB;QACE,IAAI,EAAE,uCAAwB;QAC9B,OAAO,EAAE,0CAA2B;KACrC,EACD;QACE,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE;SACV;KACF,CACF,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,iCAAsB,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,KAAK,GAAc,oBAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7C,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAqC;SACrD,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,iBAAiB,CAAC,gCAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAA,mBAAQ,EAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,gCAAoB,EAAE,CAAC;QACnC,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAY,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC7C,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;qBAC7B;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,+BAAmB,IAAI,GAAG,YAAY,gCAAoB,EAAE,CAAC;gBAC9E,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;yBAC1E;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,YAAY,0BAAc,EAAE,CAAC;gBAClC,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;yBAC1E;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,kEAAkE;YAClE,MAAM,IAAI,GAAI,GAAyB,EAAE,IAAI,IAAI,kBAAkB,CAAC;YACpE,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;qBAC5E;iBACF;aACF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/cjs/stdio.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Stdio transport entry point.
+ *
+ * Reads operator config from env, builds the agent context, attaches the
+ * MCP server to stdin/stdout. Used by `.mcp.json` config in Claude Code,
+ * Cursor, Windsurf, Zed AI, etc.
+ */
+export declare function runStdioServer(): Promise<void>;
+//# sourceMappingURL=stdio.d.ts.map

package/dist/cjs/stdio.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../../src/stdio.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAMpD"}

package/dist/cjs/stdio.js

@@ -0,0 +1,21 @@
+"use strict";
+/**
+ * Stdio transport entry point.
+ *
+ * Reads operator config from env, builds the agent context, attaches the
+ * MCP server to stdin/stdout. Used by `.mcp.json` config in Claude Code,
+ * Cursor, Windsurf, Zed AI, etc.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runStdioServer = runStdioServer;
+const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
+const config_js_1 = require("./config.js");
+const server_js_1 = require("./server.js");
+async function runStdioServer() {
+    const bootstrap = (0, config_js_1.loadBootstrapConfigFromEnv)();
+    const ctx = (0, config_js_1.buildContextFromConfig)(bootstrap);
+    const server = (0, server_js_1.buildMcpServer)(ctx);
+    const transport = new stdio_js_1.StdioServerTransport();
+    await server.connect(transport);
+}
+//# sourceMappingURL=stdio.js.map

package/dist/cjs/stdio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../../src/stdio.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAMH,wCAMC;AAVD,wEAAiF;AACjF,2CAAiF;AACjF,2CAA6C;AAEtC,KAAK,UAAU,cAAc;IAClC,MAAM,SAAS,GAAG,IAAA,sCAA0B,GAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAA,kCAAsB,EAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAA,0BAAc,EAAC,GAAG,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,+BAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC"}

package/dist/cjs/tools/balance.d.ts

@@ -0,0 +1,9 @@
+/**
+ * shroud_balance — read ETH and (optionally) ERC-20 balance for a wallet.
+ *
+ * Defaults to the agent's operator wallet. Pass `address` to query a different
+ * one (e.g. a stealth address whose private key was just recovered).
+ */
+import type { McpTool } from '../types.js';
+export declare const shroudBalanceTool: McpTool;
+//# sourceMappingURL=balance.d.ts.map

package/dist/cjs/tools/balance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"balance.d.ts","sourceRoot":"","sources":["../../../src/tools/balance.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAiB,MAAM,aAAa,CAAC;AAW1D,eAAO,MAAM,iBAAiB,EAAE,OA6C/B,CAAC"}