@shroud-fi/mcp-server 0.1.0

package/dist/esm/bin/http.js

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+/**
+ * HTTP transport bin. Reads SHROUDFI_MCP_HTTP_PORT (default 7070) via the
+ * config module, boots the HTTP server, parks until SIGINT/SIGTERM.
+ */
+import { runHttpServer } from '../http.js';
+import { readHttpPortFromEnv } from '../config.js';
+const port = readHttpPortFromEnv();
+runHttpServer({ port })
+    .then((handle) => {
+    process.stderr.write(`shroudfi-mcp-http listening on :${port}\n`);
+    const shutdown = () => {
+        void handle.close().then(() => process.exit(0));
+    };
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
+})
+    .catch((err) => {
+    process.stderr.write(`shroudfi-mcp-http failed: ${err.code ?? 'unknown'}\n`);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=http.js.map

package/dist/esm/bin/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/bin/http.ts"],"names":[],"mappings":";AACA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;AAEnC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC;KACpB,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;IACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,IAAI,IAAI,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,GAAS,EAAE;QAC1B,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC,CAAC;KACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,6BAA8B,GAAyB,CAAC,IAAI,IAAI,SAAS,IAAI,CAC9E,CAAC;IACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/esm/bin/stdio.d.ts

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+/**
+ * Stdio bin — invoked by MCP clients via `.mcp.json` `command` field.
+ *
+ * Errors go to stderr only — stdout is reserved for the JSON-RPC framed
+ * MCP protocol stream. Any stdout pollution corrupts the client.
+ */
+export {};
+//# sourceMappingURL=stdio.d.ts.map

package/dist/esm/bin/stdio.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../../../src/bin/stdio.ts"],"names":[],"mappings":";AACA;;;;;GAKG"}

package/dist/esm/bin/stdio.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+/**
+ * Stdio bin — invoked by MCP clients via `.mcp.json` `command` field.
+ *
+ * Errors go to stderr only — stdout is reserved for the JSON-RPC framed
+ * MCP protocol stream. Any stdout pollution corrupts the client.
+ */
+import { runStdioServer } from '../stdio.js';
+runStdioServer().catch((err) => {
+    process.stderr.write(`shroudfi-mcp stdio failed: ${err.code ?? 'unknown'}\n`);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=stdio.js.map

package/dist/esm/bin/stdio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../../../src/bin/stdio.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8BAA+B,GAAyB,CAAC,IAAI,IAAI,SAAS,IAAI,CAC/E,CAAC;IACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/esm/config.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Resolve operator config from env (or explicit args) into a runtime context.
+ *
+ * Env reads concentrated here per verify-privacy R5. Allowed to use process.env.
+ */
+import type { McpServerBootstrapConfig, McpServerContext } from './types.js';
+/**
+ * Read the HTTP port the operator wants the MCP server to listen on. Defaults
+ * to 7070. Strict integer between 1 and 65535.
+ */
+export declare function readHttpPortFromEnv(defaultPort?: number): number;
+/**
+ * Resolve env into a fully-formed bootstrap config.
+ */
+export declare function loadBootstrapConfigFromEnv(): McpServerBootstrapConfig;
+/**
+ * Build a McpServerContext from a resolved bootstrap config.
+ *
+ * Throws McpConfigError if the chain is unknown to @shroud-fi/transport.
+ */
+export declare function buildContextFromConfig(config: McpServerBootstrapConfig): McpServerContext;
+//# sourceMappingURL=config.d.ts.map

package/dist/esm/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAoBH,OAAO,KAAK,EACV,wBAAwB,EACxB,gBAAgB,EACjB,MAAM,YAAY,CAAC;AA2FpB;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,SAAO,GAAG,MAAM,CAQ9D;AAED;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,wBAAwB,CAkBrE;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,wBAAwB,GAC/B,gBAAgB,CAmClB"}

package/dist/esm/config.js

@@ -0,0 +1,175 @@
+/**
+ * Resolve operator config from env (or explicit args) into a runtime context.
+ *
+ * Env reads concentrated here per verify-privacy R5. Allowed to use process.env.
+ */
+import { readFileSync } from 'node:fs';
+import { hexToBytes, isHex } from 'viem';
+import { createTransport, getShroudFiStealth } from '@shroud-fi/transport';
+import { createShroudAgent } from '@shroud-fi/agent-runtime';
+import { DEFAULT_RPC_URL_BY_CHAIN, ENV_CHAIN, ENV_HTTP_ALLOWED_WALLETS, ENV_HTTP_PORT, ENV_MASTER_SEED, ENV_MASTER_SEED_FILE, ENV_PRIVATE_KEY, ENV_PRIVATE_KEY_FILE, ENV_RPC_URL, ENV_START_BLOCK, } from './constants.js';
+import { McpConfigError } from './errors.js';
+function readChain() {
+    const v = process.env[ENV_CHAIN];
+    if (v === undefined || v === '')
+        return 8453;
+    if (v === 'base' || v === 'mainnet' || v === '8453')
+        return 8453;
+    if (v === 'sepolia' || v === 'base-sepolia' || v === '84532')
+        return 84532;
+    throw new McpConfigError('Unknown chain — set SHROUDFI_CHAIN to base|sepolia');
+}
+function readPrivateKey() {
+    const inline = process.env[ENV_PRIVATE_KEY];
+    if (typeof inline === 'string' && inline.length > 0) {
+        if (!isHex(inline) || inline.length !== 66) {
+            throw new McpConfigError('SHROUDFI_PRIVATE_KEY is not a 0x… 32-byte hex');
+        }
+        return inline;
+    }
+    const file = process.env[ENV_PRIVATE_KEY_FILE];
+    if (typeof file === 'string' && file.length > 0) {
+        let raw;
+        try {
+            raw = readFileSync(file, 'utf-8').trim();
+        }
+        catch {
+            throw new McpConfigError('SHROUDFI_PRIVATE_KEY_FILE could not be read');
+        }
+        if (!isHex(raw) || raw.length !== 66) {
+            throw new McpConfigError('Private key file contents are not a 0x… 32-byte hex');
+        }
+        return raw;
+    }
+    return undefined;
+}
+/**
+ * Resolve the optional 32-byte master seed from env. Accepts either an inline
+ * 0x… hex string or a path to a file containing one (same shape as the
+ * private-key resolution). Returns `undefined` when neither is set so callers
+ * can fall back to per-process random seeds.
+ */
+function readMasterSeed() {
+    const inline = process.env[ENV_MASTER_SEED];
+    if (typeof inline === 'string' && inline.length > 0) {
+        if (!isHex(inline) || inline.length !== 66) {
+            throw new McpConfigError('SHROUDFI_MASTER_SEED is not a 0x… 32-byte hex');
+        }
+        return hexToBytes(inline);
+    }
+    const file = process.env[ENV_MASTER_SEED_FILE];
+    if (typeof file === 'string' && file.length > 0) {
+        let raw;
+        try {
+            raw = readFileSync(file, 'utf-8').trim();
+        }
+        catch {
+            throw new McpConfigError('SHROUDFI_MASTER_SEED_FILE could not be read');
+        }
+        if (!isHex(raw) || raw.length !== 66) {
+            throw new McpConfigError('Master seed file contents are not a 0x… 32-byte hex');
+        }
+        return hexToBytes(raw);
+    }
+    return undefined;
+}
+function readStartBlock() {
+    const v = process.env[ENV_START_BLOCK];
+    if (v === undefined || v === '')
+        return 0n;
+    try {
+        return BigInt(v);
+    }
+    catch {
+        throw new McpConfigError('SHROUDFI_START_BLOCK must be a non-negative integer');
+    }
+}
+function readHttpAllowedWallets() {
+    const v = process.env[ENV_HTTP_ALLOWED_WALLETS];
+    if (v === undefined || v === '')
+        return new Set();
+    const out = new Set();
+    for (const piece of v.split(',')) {
+        const trimmed = piece.trim().toLowerCase();
+        if (trimmed.length === 0)
+            continue;
+        if (!isHex(trimmed) || trimmed.length !== 42) {
+            throw new McpConfigError('SHROUDFI_MCP_HTTP_ALLOWED_WALLETS contains a non-address entry');
+        }
+        out.add(trimmed);
+    }
+    return out;
+}
+/**
+ * Read the HTTP port the operator wants the MCP server to listen on. Defaults
+ * to 7070. Strict integer between 1 and 65535.
+ */
+export function readHttpPortFromEnv(defaultPort = 7070) {
+    const raw = process.env[ENV_HTTP_PORT];
+    if (raw === undefined || raw.length === 0)
+        return defaultPort;
+    const port = Number(raw);
+    if (!Number.isInteger(port) || port < 1 || port > 65_535) {
+        throw new McpConfigError('SHROUDFI_MCP_HTTP_PORT must be 1..65535');
+    }
+    return port;
+}
+/**
+ * Resolve env into a fully-formed bootstrap config.
+ */
+export function loadBootstrapConfigFromEnv() {
+    const chainId = readChain();
+    const rpcOverride = process.env[ENV_RPC_URL];
+    const rpcUrl = rpcOverride !== undefined && rpcOverride.length > 0
+        ? rpcOverride
+        : DEFAULT_RPC_URL_BY_CHAIN[chainId];
+    if (rpcUrl === undefined) {
+        throw new McpConfigError('No RPC URL resolved for the requested chain');
+    }
+    return {
+        chainId,
+        rpcUrl,
+        privateKey: readPrivateKey(),
+        startBlock: readStartBlock(),
+        masterSeed: readMasterSeed(),
+        httpAllowedWallets: readHttpAllowedWallets(),
+    };
+}
+/**
+ * Build a McpServerContext from a resolved bootstrap config.
+ *
+ * Throws McpConfigError if the chain is unknown to @shroud-fi/transport.
+ */
+export function buildContextFromConfig(config) {
+    const chainName = config.chainId === 8453 ? 'base' : 'baseSepolia';
+    const transport = createTransport({
+        chain: chainName,
+        rpcUrl: config.rpcUrl,
+        ...(config.privateKey !== undefined
+            ? { privateKey: config.privateKey }
+            : {}),
+    });
+    // Will throw UnknownChainError if no manifest entry — surface as config error.
+    let stealthContract;
+    try {
+        stealthContract = getShroudFiStealth(config.chainId);
+    }
+    catch {
+        throw new McpConfigError('No ShroudFiStealth deployment for the chain');
+    }
+    const agent = createShroudAgent({
+        transport,
+        startBlock: config.startBlock,
+        stealthContract,
+        autoRegister: true,
+        ...(config.masterSeed !== undefined ? { masterSeed: config.masterSeed } : {}),
+    });
+    const walletAddress = transport.walletClient?.account?.address;
+    return {
+        agent,
+        transport,
+        chainId: config.chainId,
+        walletAddress,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/esm/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EACL,wBAAwB,EACxB,SAAS,EACT,wBAAwB,EACxB,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,WAAW,EACX,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAM7C,SAAS,SAAS;IAChB,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,cAAc,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3E,MAAM,IAAI,cAAc,CAAC,oDAAoD,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,cAAc,CAAC,+CAA+C,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,MAAa,CAAC;IACvB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,cAAc,CAAC,6CAA6C,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,cAAc,CAAC,qDAAqD,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,GAAU,CAAC;IACpB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc;IACrB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,cAAc,CAAC,+CAA+C,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,UAAU,CAAC,MAAa,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,cAAc,CAAC,6CAA6C,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,cAAc,CAAC,qDAAqD,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,UAAU,CAAC,GAAU,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,cAAc,CAAC,qDAAqD,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB;IAC7B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAiB,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,cAAc,CACtB,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,OAAwB,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAW,GAAG,IAAI;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,cAAc,CAAC,yCAAyC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B;IACxC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC;IAC5B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,MAAM,GACV,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QACjD,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,cAAc,CAAC,6CAA6C,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO;QACL,OAAO;QACP,MAAM;QACN,UAAU,EAAE,cAAc,EAAE;QAC5B,UAAU,EAAE,cAAc,EAAE;QAC5B,UAAU,EAAE,cAAc,EAAE;QAC5B,kBAAkB,EAAE,sBAAsB,EAAE;KAC7C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAgC;IAEhC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;IAEnE,MAAM,SAAS,GAAG,eAAe,CAAC;QAChC,KAAK,EAAE,SAAmC;QAC1C,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;YACnC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,+EAA+E;IAC/E,IAAI,eAA8B,CAAC;IACnC,IAAI,CAAC;QACH,eAAe,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,cAAc,CAAC,6CAA6C,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,CAAC;QAC9B,SAAS;QACT,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,eAAe;QACf,YAAY,EAAE,IAAI;QAClB,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,SAAS,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC;IAE/D,OAAO;QACL,KAAK;QACL,SAAS;QACT,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,aAAa;KACd,CAAC;AACJ,CAAC"}

package/dist/esm/constants.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Static constants. All env reads live here per verify-privacy R5.
+ */
+export declare const SHROUDFI_MCP_SERVER_NAME: "shroudfi-mcp";
+export declare const SHROUDFI_MCP_SERVER_VERSION: "0.0.1";
+/** EIP-191 challenge TTL — short window so a replayed challenge dies fast. */
+export declare const EIP191_CHALLENGE_TTL_MS: number;
+/** Default RPC URLs by chain id. Operator override via SHROUDFI_RPC_URL. */
+export declare const DEFAULT_RPC_URL_BY_CHAIN: Record<number, string>;
+/** Env knobs the bootstrap surface reads. */
+export declare const ENV_PRIVATE_KEY: "SHROUDFI_PRIVATE_KEY";
+export declare const ENV_PRIVATE_KEY_FILE: "SHROUDFI_PRIVATE_KEY_FILE";
+export declare const ENV_RPC_URL: "SHROUDFI_RPC_URL";
+export declare const ENV_CHAIN: "SHROUDFI_CHAIN";
+export declare const ENV_START_BLOCK: "SHROUDFI_START_BLOCK";
+export declare const ENV_HTTP_PORT: "SHROUDFI_MCP_HTTP_PORT";
+export declare const ENV_HTTP_ALLOWED_WALLETS: "SHROUDFI_MCP_HTTP_ALLOWED_WALLETS";
+/**
+ * Deterministic 32-byte master seed (0x… 64 hex chars). When set, every
+ * boot of the MCP server, REST API, or any other surface using
+ * `loadBootstrapConfigFromEnv` resolves the SAME stealth meta-address for
+ * the same operator EOA. When unset, a fresh random seed is generated per
+ * process — fine for local testing, BAD for production multi-surface
+ * deployments (caller's main wallet ↔ stealth meta-address binding would
+ * desync between MCP, REST, and UI processes).
+ */
+export declare const ENV_MASTER_SEED: "SHROUDFI_MASTER_SEED";
+export declare const ENV_MASTER_SEED_FILE: "SHROUDFI_MASTER_SEED_FILE";
+//# sourceMappingURL=constants.d.ts.map

package/dist/esm/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,eAAO,MAAM,wBAAwB,EAAG,cAAuB,CAAC;AAChE,eAAO,MAAM,2BAA2B,EAAG,OAAgB,CAAC;AAE5D,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB,QAAgB,CAAC;AAErD,4EAA4E;AAC5E,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAG3D,CAAC;AAEF,6CAA6C;AAC7C,eAAO,MAAM,eAAe,EAAG,sBAA+B,CAAC;AAC/D,eAAO,MAAM,oBAAoB,EAAG,2BAAoC,CAAC;AACzE,eAAO,MAAM,WAAW,EAAG,kBAA2B,CAAC;AACvD,eAAO,MAAM,SAAS,EAAG,gBAAyB,CAAC;AACnD,eAAO,MAAM,eAAe,EAAG,sBAA+B,CAAC;AAC/D,eAAO,MAAM,aAAa,EAAG,wBAAiC,CAAC;AAC/D,eAAO,MAAM,wBAAwB,EAAG,mCAA4C,CAAC;AACrF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,EAAG,sBAA+B,CAAC;AAC/D,eAAO,MAAM,oBAAoB,EAAG,2BAAoC,CAAC"}

package/dist/esm/constants.js

@@ -0,0 +1,32 @@
+/**
+ * Static constants. All env reads live here per verify-privacy R5.
+ */
+export const SHROUDFI_MCP_SERVER_NAME = 'shroudfi-mcp';
+export const SHROUDFI_MCP_SERVER_VERSION = '0.0.1';
+/** EIP-191 challenge TTL — short window so a replayed challenge dies fast. */
+export const EIP191_CHALLENGE_TTL_MS = 5 * 60 * 1000;
+/** Default RPC URLs by chain id. Operator override via SHROUDFI_RPC_URL. */
+export const DEFAULT_RPC_URL_BY_CHAIN = {
+    8453: 'https://mainnet.base.org',
+    84532: 'https://sepolia.base.org',
+};
+/** Env knobs the bootstrap surface reads. */
+export const ENV_PRIVATE_KEY = 'SHROUDFI_PRIVATE_KEY';
+export const ENV_PRIVATE_KEY_FILE = 'SHROUDFI_PRIVATE_KEY_FILE';
+export const ENV_RPC_URL = 'SHROUDFI_RPC_URL';
+export const ENV_CHAIN = 'SHROUDFI_CHAIN';
+export const ENV_START_BLOCK = 'SHROUDFI_START_BLOCK';
+export const ENV_HTTP_PORT = 'SHROUDFI_MCP_HTTP_PORT';
+export const ENV_HTTP_ALLOWED_WALLETS = 'SHROUDFI_MCP_HTTP_ALLOWED_WALLETS';
+/**
+ * Deterministic 32-byte master seed (0x… 64 hex chars). When set, every
+ * boot of the MCP server, REST API, or any other surface using
+ * `loadBootstrapConfigFromEnv` resolves the SAME stealth meta-address for
+ * the same operator EOA. When unset, a fresh random seed is generated per
+ * process — fine for local testing, BAD for production multi-surface
+ * deployments (caller's main wallet ↔ stealth meta-address binding would
+ * desync between MCP, REST, and UI processes).
+ */
+export const ENV_MASTER_SEED = 'SHROUDFI_MASTER_SEED';
+export const ENV_MASTER_SEED_FILE = 'SHROUDFI_MASTER_SEED_FILE';
+//# sourceMappingURL=constants.js.map

package/dist/esm/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,cAAuB,CAAC;AAChE,MAAM,CAAC,MAAM,2BAA2B,GAAG,OAAgB,CAAC;AAE5D,8EAA8E;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAErD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,wBAAwB,GAA2B;IAC9D,IAAI,EAAE,0BAA0B;IAChC,KAAK,EAAE,0BAA0B;CAClC,CAAC;AAEF,6CAA6C;AAC7C,MAAM,CAAC,MAAM,eAAe,GAAG,sBAA+B,CAAC;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,2BAAoC,CAAC;AACzE,MAAM,CAAC,MAAM,WAAW,GAAG,kBAA2B,CAAC;AACvD,MAAM,CAAC,MAAM,SAAS,GAAG,gBAAyB,CAAC;AACnD,MAAM,CAAC,MAAM,eAAe,GAAG,sBAA+B,CAAC;AAC/D,MAAM,CAAC,MAAM,aAAa,GAAG,wBAAiC,CAAC;AAC/D,MAAM,CAAC,MAAM,wBAAwB,GAAG,mCAA4C,CAAC;AACrF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,sBAA+B,CAAC;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,2BAAoC,CAAC"}

package/dist/esm/errors.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Errors for @shroud-fi/mcp-server.
+ *
+ * Privacy invariants:
+ *   - No private keys, signatures, or amounts in error messages.
+ *   - No wallet addresses concatenated into `.message` strings — addresses
+ *     are exposed on dedicated structured fields when needed.
+ */
+export declare class McpServerError extends Error {
+    readonly name: string;
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+export declare class McpConfigError extends McpServerError {
+    readonly name = "McpConfigError";
+    constructor(message: string);
+}
+export declare class McpUnauthorizedError extends McpServerError {
+    readonly name = "McpUnauthorizedError";
+    constructor();
+}
+export declare class McpToolNotFoundError extends McpServerError {
+    readonly name = "McpToolNotFoundError";
+    constructor();
+}
+export declare class McpInvalidArgsError extends McpServerError {
+    readonly name = "McpInvalidArgsError";
+    constructor();
+}
+export declare class McpExecutionError extends McpServerError {
+    readonly name = "McpExecutionError";
+    readonly cause: unknown;
+    constructor(cause: unknown);
+}
+export declare class McpEip191ChallengeExpiredError extends McpServerError {
+    readonly name = "McpEip191ChallengeExpiredError";
+    constructor();
+}
+export declare class McpEip191SignatureInvalidError extends McpServerError {
+    readonly name = "McpEip191SignatureInvalidError";
+    constructor();
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/esm/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,qBAAa,cAAe,SAAQ,KAAK;IACvC,SAAkB,IAAI,EAAE,MAAM,CAAoB;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAI1C;AAED,qBAAa,cAAe,SAAQ,cAAc;IAChD,SAAkB,IAAI,oBAAoB;gBAC9B,OAAO,EAAE,MAAM;CAG5B;AAED,qBAAa,oBAAqB,SAAQ,cAAc;IACtD,SAAkB,IAAI,0BAA0B;;CAIjD;AAED,qBAAa,oBAAqB,SAAQ,cAAc;IACtD,SAAkB,IAAI,0BAA0B;;CAIjD;AAED,qBAAa,mBAAoB,SAAQ,cAAc;IACrD,SAAkB,IAAI,yBAAyB;;CAIhD;AAED,qBAAa,iBAAkB,SAAQ,cAAc;IACnD,SAAkB,IAAI,uBAAuB;IAC7C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;gBACZ,KAAK,EAAE,OAAO;CAI3B;AAED,qBAAa,8BAA+B,SAAQ,cAAc;IAChE,SAAkB,IAAI,oCAAoC;;CAI3D;AAED,qBAAa,8BAA+B,SAAQ,cAAc;IAChE,SAAkB,IAAI,oCAAoC;;CAI3D"}

package/dist/esm/errors.js

@@ -0,0 +1,61 @@
+/**
+ * Errors for @shroud-fi/mcp-server.
+ *
+ * Privacy invariants:
+ *   - No private keys, signatures, or amounts in error messages.
+ *   - No wallet addresses concatenated into `.message` strings — addresses
+ *     are exposed on dedicated structured fields when needed.
+ */
+export class McpServerError extends Error {
+    name = 'McpServerError';
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+    }
+}
+export class McpConfigError extends McpServerError {
+    name = 'McpConfigError';
+    constructor(message) {
+        super(message, 'config_invalid');
+    }
+}
+export class McpUnauthorizedError extends McpServerError {
+    name = 'McpUnauthorizedError';
+    constructor() {
+        super('Unauthorized', 'unauthorized');
+    }
+}
+export class McpToolNotFoundError extends McpServerError {
+    name = 'McpToolNotFoundError';
+    constructor() {
+        super('Tool not found', 'tool_not_found');
+    }
+}
+export class McpInvalidArgsError extends McpServerError {
+    name = 'McpInvalidArgsError';
+    constructor() {
+        super('Invalid tool arguments', 'invalid_args');
+    }
+}
+export class McpExecutionError extends McpServerError {
+    name = 'McpExecutionError';
+    cause;
+    constructor(cause) {
+        super('Tool execution failed', 'execution_failed');
+        this.cause = cause;
+    }
+}
+export class McpEip191ChallengeExpiredError extends McpServerError {
+    name = 'McpEip191ChallengeExpiredError';
+    constructor() {
+        super('EIP-191 challenge expired', 'auth_challenge_expired');
+    }
+}
+export class McpEip191SignatureInvalidError extends McpServerError {
+    name = 'McpEip191SignatureInvalidError';
+    constructor() {
+        super('EIP-191 signature invalid', 'auth_signature_invalid');
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/esm/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,OAAO,cAAe,SAAQ,KAAK;IACrB,IAAI,GAAW,gBAAgB,CAAC;IACzC,IAAI,CAAS;IACtB,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,cAAc;IAC9B,IAAI,GAAG,gBAAgB,CAAC;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,cAAc;IACpC,IAAI,GAAG,sBAAsB,CAAC;IAChD;QACE,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,cAAc;IACpC,IAAI,GAAG,sBAAsB,CAAC;IAChD;QACE,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,cAAc;IACnC,IAAI,GAAG,qBAAqB,CAAC;IAC/C;QACE,KAAK,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAC;IAClD,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,cAAc;IACjC,IAAI,GAAG,mBAAmB,CAAC;IACpC,KAAK,CAAU;IACxB,YAAY,KAAc;QACxB,KAAK,CAAC,uBAAuB,EAAE,kBAAkB,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED,MAAM,OAAO,8BAA+B,SAAQ,cAAc;IAC9C,IAAI,GAAG,gCAAgC,CAAC;IAC1D;QACE,KAAK,CAAC,2BAA2B,EAAE,wBAAwB,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,MAAM,OAAO,8BAA+B,SAAQ,cAAc;IAC9C,IAAI,GAAG,gCAAgC,CAAC;IAC1D;QACE,KAAK,CAAC,2BAA2B,EAAE,wBAAwB,CAAC,CAAC;IAC/D,CAAC;CACF"}

package/dist/esm/http.d.ts

@@ -0,0 +1,32 @@
+/**
+ * HTTP transport for the MCP server.
+ *
+ * Uses node:http to stay zero-dep. Exposes three endpoints:
+ *   POST /auth/challenge   → mint EIP-191 challenge
+ *   POST /mcp              → JSON-RPC framed MCP body (auth-gated)
+ *   GET  /healthz          → public liveness ping
+ *
+ * Auth rules:
+ *   - /auth/challenge      public (clients need a way to get a challenge)
+ *   - /mcp                 requires X-Shroudfi-Wallet + X-Shroudfi-Nonce +
+ *                          X-Shroudfi-Signature headers. Signature is verified,
+ *                          consumed (single-use), allow-list checked.
+ *   - /healthz             public
+ *
+ * Privacy invariants:
+ *   - Signatures never logged or echoed.
+ *   - Errors are short tag strings; no body bytes, no key bytes.
+ *   - Allow-list is enforced when SHROUDFI_MCP_HTTP_ALLOWED_WALLETS is set;
+ *     when empty, ANY EIP-191 wallet may authenticate. Operators MUST set
+ *     the allow-list in production.
+ */
+import type { McpServerBootstrapConfig } from './types.js';
+interface RunHttpServerOptions {
+    readonly port: number;
+    readonly bootstrap?: McpServerBootstrapConfig;
+}
+export declare function runHttpServer(opts: RunHttpServerOptions): Promise<{
+    readonly close: () => Promise<void>;
+}>;
+export {};
+//# sourceMappingURL=http.d.ts.map

package/dist/esm/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH,OAAO,KAAK,EAAE,wBAAwB,EAAoB,MAAM,YAAY,CAAC;AAS7E,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,wBAAwB,CAAC;CAC/C;AAoGD,wBAAsB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC,CAAC,CA0BD"}