@temporalabs/treasury 0.1.0

package/dist/client.js

@@ -0,0 +1,248 @@
+import { createPublicClient, http } from "viem";
+import { base } from "viem/chains";
+export const chains = { 8453: base };
+export function isSupportedChainId(id) {
+    return id in chains;
+}
+/** The public endpoint used when nothing is configured, and the fallback for event scans. */
+export const PUBLIC_RPC = { 8453: "https://mainnet.base.org" };
+/**
+ * A `fetch` that waits out HTTP 429 instead of failing the tool. Measured 2026-09-14: a free-tier
+ * keyed Base RPC answered an `earn_quote` read with 429 and the tool failed outright, because viem's
+ * own retries (3, from 150 ms) are spent in under a second. Only a 429 is retried here, up to 5 times,
+ * honouring `Retry-After` when present and otherwise backing off from 500 ms, with the sleeps capped at
+ * `RATE_LIMIT_WAIT_MS` in total whatever the headers say.
+ *
+ * The transport's deadline (`RPC_TIMEOUT_MS`, viem's own 10 s) wraps this whole loop and is enforced by
+ * ABORT: viem only reports its `TimeoutError` when the fetch throws an abort error, and resolves a value
+ * returned after the abort as-is. So the sleep races the abort signal, and on abort the LAST 429 is
+ * handed back — the caller then sees the provider's 429, never "The request took too long to respond".
+ * Measured 2026-09-17 before this: a keyed provider at its monthly cap answered 429 in 77 ms, the loop
+ * slept through the deadline, and a whole live tier read as "the RPC is slow" when the key was out of
+ * quota. The deadline itself is NOT raised: a host that accepts and never answers must still fail at
+ * 10 s (measured in review: 25.5 s made `earn_status` 2.5× slower on exactly that case).
+ *
+ * A 429 whose body carries the one measured exhausted-plan sentence is returned at once — it resets
+ * next period, not in seconds. ONLY that sentence: a bare /capacity/ also matched Alchemy's per-second
+ * throttle body ("exceeded its compute units per second capacity") and a "temporarily at capacity"
+ * message, and would have disabled the wait on the exact case it exists for (measured in review).
+ * An unrecognised body is waited out and then reported plainly — the safe direction.
+ * An unreachable host is deliberately NOT stretched out: that is a fault to report, not a limit to
+ * wait for, and `earn_status` must answer quickly when the RPC is down.
+ */
+export const RATE_LIMIT_WAIT_MS = 15_500;
+/** The transport's whole-call deadline — viem's default, set explicitly because the wrapper's design depends on it. */
+export const RPC_TIMEOUT_MS = 10_000;
+/** Measured 2026-09-17 on a keyed provider at its cap: `Monthly capacity limit exceeded. … billing …`. */
+const QUOTA_EXHAUSTED = /\b(monthly|daily) capacity limit exceeded\b/i;
+export function makeRateLimitedFetch(base = fetch, sleep = (ms) => new Promise((r) => setTimeout(r, ms).unref?.())) {
+    return async (input, init) => {
+        const signal = init?.signal ?? null;
+        const aborted = new Promise((r) => {
+            if (!signal)
+                return;
+            if (signal.aborted)
+                r();
+            else
+                signal.addEventListener("abort", () => r(), { once: true });
+        });
+        let waited = 0;
+        for (let attempt = 0;; attempt++) {
+            const res = await base(input, init);
+            if (res.status !== 429 || attempt >= 5 || waited >= RATE_LIMIT_WAIT_MS)
+                return res;
+            // Read a COPY of the body: the caller (viem) still needs the original to report the provider's message.
+            if (QUOTA_EXHAUSTED.test(await res.clone().text().catch(() => "")))
+                return res;
+            const after = Number(res.headers.get("retry-after"));
+            const want = Number.isFinite(after) && after > 0 ? Math.min(after, 10) * 1000 : 500 * 2 ** attempt;
+            const ms = Math.min(want, RATE_LIMIT_WAIT_MS - waited);
+            waited += ms;
+            await Promise.race([sleep(ms), aborted]);
+            if (signal?.aborted)
+                return res; // the deadline passed while waiting: report the 429, not a timeout
+        }
+    };
+}
+export function makePublicClient(chainId, rpcUrl) {
+    // `retryCount: 0` because THIS wrapper owns the retry policy. viem's own retry sits OUTSIDE the
+    // transport's fetchFn and also retries 429, so the two multiply — measured in review: one
+    // persistently rate-limited request made 24 underlying fetch calls, not 6, and took ~62 s instead of
+    // the ~15 s this file claimed.
+    // `timeout` is viem's default, named so the wrapper's abort-race above is pinned to it (see above).
+    //
+    // 🔴 `ccipRead: false` closes the one path by which this client could contact a host the operator
+    // never configured. viem enables CCIP-read by default: a contract that reverts with
+    // `OffchainLookup` hands back a URL and viem fetches it — an arbitrary host, chosen by the
+    // contract, outside the RPC. Treasury reads only registry vaults and needs no off-chain
+    // resolution, so the capability is pure exposure here, and "the RPC you configure and nothing
+    // else" is only true with it off. A test pins it.
+    return createPublicClient({ chain: chains[chainId], ccipRead: false, transport: http(rpcUrl, { fetchFn: makeRateLimitedFetch(), retryCount: 0, timeout: RPC_TIMEOUT_MS }) });
+}
+/**
+ * An env value counts as an RPC URL only if it parses as one with an http(s) scheme. Anything else —
+ * empty, whitespace, a non-URL, and in particular an UNEXPANDED placeholder like `${TREASURY_RPC_BASE}` —
+ * is treated as unset. Measured 2026-09-12: Claude Code forwards the plugin's `.mcp.json` value
+ * `${TREASURY_RPC_BASE}` verbatim when the host variable is unset, and with the old `if (v)` test every
+ * RPC-touching tool died on "Failed to parse URL from ${TREASURY_RPC_BASE}". `.mcp.json` now also uses
+ * `${VAR:-}`, but this guard is what makes the server independent of any host's expansion rules.
+ */
+export function rpcUrlFromEnvValue(v) {
+    if (!v)
+        return undefined;
+    const t = v.trim();
+    if (t.length === 0 || t.includes("${"))
+        return undefined;
+    try {
+        const u = new URL(t);
+        return u.protocol === "http:" || u.protocol === "https:" ? t : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Resolves the RPC URL for a chain from the environment. ⚠️ A keyed provider URL IS a secret: it must
+ * never appear in tool output — every error crossing the tool boundary goes through `describeError`
+ * (`src/redact.ts`), which strips endpoints. Fallback names after `TREASURY_RPC_BASE`:
+ * `BASE_RPC_URL`; the plugin's `.mcp.json` passes only the `TREASURY_*` pair through, so under the
+ * packaged path the fallback is unreachable.
+ * `TREASURY_LOGS_RPC_BASE`, if set, is preferred for log scans (providers cap eth_getLogs ranges very
+ * differently: Alchemy free 10 blocks, Base public 2,000) — see `position.ts`.
+ */
+export function rpcUrlFromEnv(chainId) {
+    const candidates = chainId === 8453 ? ["TREASURY_RPC_BASE", "BASE_RPC_URL"] : [];
+    for (const k of candidates) {
+        const v = rpcUrlFromEnvValue(process.env[k]);
+        if (v)
+            return v;
+    }
+    return PUBLIC_RPC[chainId];
+}
+/**
+ * The endpoint an event scan falls back to when the configured logs RPC cannot cover the range — and
+ * the operator's opt-out from it. `TREASURY_LOGS_FALLBACK` unset ⇒ Base's public endpoint; an http(s)
+ * URL ⇒ that endpoint; ANY other value — `off`, `none`, `disabled`, a typo — ⇒ no fallback at all, and
+ * the scan degrades to a cut-short window as it did before the fallback existed. It exists because the fallback
+ * otherwise sends a query to a third party the operator never named, which some
+ * deployments cannot accept — and it fails CLOSED for the same reason.
+ */
+export function logsFallbackUrlFromEnv(chainId, logsUrl) {
+    const raw = (process.env["TREASURY_LOGS_FALLBACK"] ?? "").trim();
+    // Unset, empty, or an unexpanded `${VAR}` placeholder: the default fallback.
+    // ⚠️ The placeholder is THE ONE DELIBERATE EXCEPTION to fail-closed below.
+    // An MCP host forwards `${TREASURY_LOGS_FALLBACK}` verbatim when the host variable is unset, so a
+    // placeholder means the operator never set it — and unset must behave exactly as absent, or every
+    // plugin install without the variable silently loses its fallback. The function cannot tell "the
+    // host did not expand it" from "someone typed it"; the second reading is treated as implausible on
+    // purpose, and this comment is the record of that choice.
+    if (raw.length === 0 || raw.includes("${"))
+        return sameOrUndefined(PUBLIC_RPC[chainId], logsUrl);
+    // 🔴 An operator who set this variable at all was constraining where this process talks. Reading an
+    // unrecognised value as "use the default third party" is the one outcome they cannot have meant
+    // (measured in review: `disabled` silently kept the public fallback until this failed closed).
+    const url = rpcUrlFromEnvValue(raw);
+    return url === undefined ? undefined : sameOrUndefined(url, logsUrl);
+}
+/** A fallback that is the same endpoint as the primary is not a fallback. */
+function sameOrUndefined(url, logsUrl) {
+    return url === logsUrl ? undefined : url;
+}
+/** RPC to use for eth_getLogs scans: a dedicated one if configured, else the general one. */
+export function logsRpcUrlFromEnv(chainId) {
+    return rpcUrlFromEnvValue(process.env["TREASURY_LOGS_RPC_BASE"]) ?? rpcUrlFromEnv(chainId);
+}
+/**
+ * Which environment variable supplied the RPC URL — the NAME only, never the value. A keyed provider
+ * URL is a secret, so `earn_status` reports provenance and nothing else. `configured: false` means
+ * no variable resolved and the public endpoint is in use (rate-limited, never a failure).
+ */
+export function rpcSourceForEnv(chainId) {
+    const candidates = chainId === 8453 ? ["TREASURY_RPC_BASE", "BASE_RPC_URL"] : [];
+    for (const k of candidates) {
+        if (rpcUrlFromEnvValue(process.env[k]))
+            return { source: k, configured: true };
+    }
+    return { source: "public default", configured: false };
+}
+/**
+ * Every RPC secret VALUE this process could be holding — the resolved URLs plus the parts of them
+ * that carry the credential (path segments, query values, and a subdomain-keyed provider's first
+ * label). Fed to `registerSecretSource` so the redactor masks the literal wherever it appears,
+ * including inside a provider's own error body, where no shape rule can reach it.
+ *
+ * ⚠️ Returns VALUES, and is used only to mask them. It must never be logged or returned by a tool.
+ */
+export function resolvedRpcSecrets() {
+    const out = new Set();
+    // 🔴 BOTH FORMS. A credential sits in the URL percent-ENCODED; a provider echoes the DECODED one.
+    // Measured by review: for `sk-Live_a+b/c=d9f8e7` the URL carries
+    // `sk-Live_a%2Bb%2Fc%3Dd9f8e7`, only that was registered, and the plain key leaked. The earlier
+    // test missed it because `SECRETKEY123` percent-encodes to ITSELF — the transformation was the
+    // identity function, so the test could not tell the two forms apart.
+    const add = (v) => {
+        if (!v || v.length < 8)
+            return;
+        out.add(v);
+        try {
+            const decoded = decodeURIComponent(v);
+            if (decoded !== v && decoded.length >= 8)
+                out.add(decoded);
+        }
+        catch {
+            /* a malformed percent-sequence is not a second form */
+        }
+    };
+    const urls = new Set();
+    // Every variable that can name a URL the package will CALL — the logs fallback included: it builds a
+    // real client, and a provider's error body can echo its key exactly as the primary's (measured in
+    // review; dormant until describeError began reporting the body).
+    for (const k of ["TREASURY_RPC_BASE", "TREASURY_LOGS_RPC_BASE", "BASE_RPC_URL", "TREASURY_LOGS_FALLBACK"]) {
+        const v = rpcUrlFromEnvValue(process.env[k]);
+        if (v)
+            urls.add(v);
+    }
+    for (const u of urls) {
+        add(u);
+        try {
+            const p = new URL(u);
+            for (const seg of p.pathname.split("/"))
+                add(seg); // raw: the usual place a key sits
+            // ⚠️ Query values need BOTH readings. `searchParams` decodes `+` as a SPACE (form-encoding),
+            // so for `?apikey=sk+Live_abcdefgh` it yields `sk Live_abcdefgh` while the provider echoes
+            // the literal `sk+Live_abcdefgh` — the same defect as the path form, on the other branch
+            // (review). Register the raw token as well as what searchParams parsed.
+            for (const [, val] of p.searchParams)
+                add(val);
+            for (const pair of p.search.replace(/^\?/, "").split("&")) {
+                const eq = pair.indexOf("=");
+                if (eq >= 0)
+                    add(pair.slice(eq + 1));
+            }
+            add(p.hostname.split(".")[0]); // QuickNode-style subdomain keys
+        }
+        catch {
+            /* rpcUrlFromEnvValue already parsed it; unreachable */
+        }
+    }
+    return [...out];
+}
+/**
+ * The one sentence a caller needs when the public endpoint is what broke them.
+ *
+ * 🔴 Measured 2026-09-12 through the installed plugin with no configuration: the deposit pre-flight
+ * returns UNRESOLVED 3/3 on `mainnet.base.org` ("RPC Request failed") and NEEDS_APPROVAL 3/3 on a
+ * keyed URL. So zero-config can browse vaults and read terms but CANNOT complete a deposit — and the
+ * message it fails with reads as "this product is broken" rather than "you need a key". Returns
+ * undefined when a keyed RPC resolved, so a real chain fault is never mislabelled as a setup problem.
+ */
+export function publicRpcHint(chainId) {
+    if (rpcSourceForEnv(chainId).configured)
+        return undefined;
+    return ("No RPC was configured, so this used the public endpoint (mainnet.base.org), which rate-limits " +
+        "after a handful of calls — that is the most likely cause of the failure above, not the vault. " +
+        "Set TREASURY_RPC_BASE to a keyed Base RPC URL (Alchemy, Infura, QuickNode or your own node) and " +
+        "retry. Reads like the vault list and the disclosures work without one; quotes, pre-flight and " +
+        "position history generally do not.");
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAyC,MAAM,MAAM,CAAC;AACvF,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC,MAAM,CAAC,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,IAAI,EAAW,CAAC;AAG9C,MAAM,UAAU,kBAAkB,CAAC,EAAU;IAC3C,OAAO,EAAE,IAAI,MAAM,CAAC;AACtB,CAAC;AASD,6FAA6F;AAC7F,MAAM,CAAC,MAAM,UAAU,GAAqC,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;AAEjG;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AACzC,uHAAuH;AACvH,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AACrC,0GAA0G;AAC1G,MAAM,eAAe,GAAG,8CAA8C,CAAC;AAEvE,MAAM,UAAU,oBAAoB,CAClC,OAAqB,KAAK,EAC1B,QAAuC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IAE9F,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE;YACtC,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,IAAI,MAAM,CAAC,OAAO;gBAAE,CAAC,EAAE,CAAC;;gBACnB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACpC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,IAAI,CAAC,IAAI,MAAM,IAAI,kBAAkB;gBAAE,OAAO,GAAG,CAAC;YACnF,wGAAwG;YACxG,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBAAE,OAAO,GAAG,CAAC;YAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC;YACnG,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAAC,CAAC;YACvD,MAAM,IAAI,EAAE,CAAC;YACb,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YACzC,IAAI,MAAM,EAAE,OAAO;gBAAE,OAAO,GAAG,CAAC,CAAC,mEAAmE;QACtG,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAyB,EAAE,MAAc;IACxE,gGAAgG;IAChG,0FAA0F;IAC1F,qGAAqG;IACrG,+BAA+B;IAC/B,oGAAoG;IACpG,EAAE;IACF,kGAAkG;IAClG,oFAAoF;IACpF,2FAA2F;IAC3F,wFAAwF;IACxF,8FAA8F;IAC9F,kDAAkD;IAClD,OAAO,kBAAkB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;AAC/K,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAqB;IACtD,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,OAAyB;IACrD,MAAM,UAAU,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAyB,EAAE,OAAe;IAC/E,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjE,6EAA6E;IAC7E,2EAA2E;IAC3E,kGAAkG;IAClG,kGAAkG;IAClG,iGAAiG;IACjG,mGAAmG;IACnG,0DAA0D;IAC1D,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IACjG,oGAAoG;IACpG,gGAAgG;IAChG,+FAA+F;IAC/F,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACvE,CAAC;AAED,6EAA6E;AAC7E,SAAS,eAAe,CAAC,GAAW,EAAE,OAAe;IACnD,OAAO,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;AAC3C,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,iBAAiB,CAAC,OAAyB;IACzD,OAAO,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,MAAM,UAAU,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,kGAAkG;IAClG,iEAAiE;IACjE,gGAAgG;IAChG,+FAA+F;IAC/F,qEAAqE;IACrE,MAAM,GAAG,GAAG,CAAC,CAAqB,EAAE,EAAE;QACpC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO;QAC/B,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACX,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,OAAO,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;QACzD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,qGAAqG;IACrG,kGAAkG;IAClG,iEAAiE;IACjE,KAAK,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,wBAAwB,EAAE,cAAc,EAAE,wBAAwB,CAAC,EAAE,CAAC;QAC1G,MAAM,CAAC,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,GAAG,CAAC,CAAC,CAAC,CAAC;QACP,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;YACrB,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,kCAAkC;YACrF,6FAA6F;YAC7F,2FAA2F;YAC3F,yFAAyF;YACzF,wEAAwE;YACxE,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,YAAY;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/C,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC7B,IAAI,EAAE,IAAI,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC;YACD,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iCAAiC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;QACzD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,OAAyB;IACrD,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAC1D,OAAO,CACL,gGAAgG;QAChG,gGAAgG;QAChG,kGAAkG;QAClG,gGAAgG;QAChG,oCAAoC,CACrC,CAAC;AACJ,CAAC"}

package/dist/config/earn.d.ts

@@ -0,0 +1,47 @@
+/**
+ * The earn wiring — THE place to point the skill at a vault. Shipped code names no vault ticker
+ * as a literal; `scripts/roundtrip.ts` and the tiers read the default and the round-trip target
+ * from here (the fork and live tiers also name the gated sibling directly, for the access pair).
+ *
+ * Two knobs, deliberately separate, because they can legitimately differ:
+ *
+ *   `defaultVault`   what the tools use when the caller names none. The registry row must also be
+ *                    `isDefault` — `defaultVault()` refuses a config/registry disagreement — and the
+ *                    schema allows a WHITELIST_GATED default, because the pre-flight re-measures
+ *                    access live on every call and refuses a non-member before anything is built.
+ *   `roundTripVault` what the deposit → redeem tiers exercise. The same vault today.
+ *
+ * Addresses live in the registry (`registry/vaults.json`, schema-validated, block-stamped) — a
+ * ticker here resolves through it.
+ *
+ * 🔴 NO DEPOSITOR ADDRESS IS CONFIGURED HERE, and that is a rule rather than an omission. A gated
+ * vault's whitelist is the fund's to hold, and its members are readable from the chain: the fork
+ * tier discovers one from the vault's own AccessManager (`tests/access.ts`) and impersonates it.
+ * Writing a member's address into this file would publish who the fund has onboarded, and would go
+ * stale the moment the whitelist changes. An address is never a key either way (CONTRIBUTING.md, the first rule).
+ */
+/** A vault's ERC-20 ticker — resolved via `getVault`, so a typo fails at load, not at a call site. */
+export type VaultSymbol = string;
+export declare const EARN: {
+    /**
+     * Tempora Labs Cash Plus USDC (Test 2), Base — a Morpho Vault V2, the Tempora vault this client
+     * offers by default. Deposits are OPEN to any account (measured by a simulated stranger deposit;
+     * `earn_vaults` reports `defaultAccess: "open"`). The whitelist-gated sibling, Cash Plus USDC
+     * (Test 2A), stays listed as `tlCashPlusUSDC2A` and is refused per account by the pre-flight.
+     */
+    readonly defaultVault: "tlCashPlusUSDC2";
+    /** The round-trip target. The same vault as the default; open, so the fork tier deposits from the whale directly. */
+    readonly roundTripVault: "tlCashPlusUSDC2";
+    /** USDC, as a decimal string — the amount `scripts/roundtrip.ts` prepares by default. Never a float. */
+    readonly roundTripAmountUsdc: "0.05";
+    /** Fixtures the fork and live tiers share. */
+    readonly fixtures: {
+        /** An address that has never touched any vault — the negative control for access checks. */
+        readonly stranger: "0x000000000000000000000000000000000000dEaD";
+        /** Morpho Blue on Base — held ~2.1e14 USDC base units when probed 2026-09-11. Impersonated on the fork, never keyed. */
+        readonly usdcWhale: "0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb";
+        /** USDC the fork round trip deposits, and what it seeds a discovered depositor with beforehand. */
+        readonly forkDepositUsdc: "100";
+        readonly forkSeedUsdc: "1000";
+    };
+};

package/dist/config/earn.js

@@ -0,0 +1,46 @@
+/**
+ * The earn wiring — THE place to point the skill at a vault. Shipped code names no vault ticker
+ * as a literal; `scripts/roundtrip.ts` and the tiers read the default and the round-trip target
+ * from here (the fork and live tiers also name the gated sibling directly, for the access pair).
+ *
+ * Two knobs, deliberately separate, because they can legitimately differ:
+ *
+ *   `defaultVault`   what the tools use when the caller names none. The registry row must also be
+ *                    `isDefault` — `defaultVault()` refuses a config/registry disagreement — and the
+ *                    schema allows a WHITELIST_GATED default, because the pre-flight re-measures
+ *                    access live on every call and refuses a non-member before anything is built.
+ *   `roundTripVault` what the deposit → redeem tiers exercise. The same vault today.
+ *
+ * Addresses live in the registry (`registry/vaults.json`, schema-validated, block-stamped) — a
+ * ticker here resolves through it.
+ *
+ * 🔴 NO DEPOSITOR ADDRESS IS CONFIGURED HERE, and that is a rule rather than an omission. A gated
+ * vault's whitelist is the fund's to hold, and its members are readable from the chain: the fork
+ * tier discovers one from the vault's own AccessManager (`tests/access.ts`) and impersonates it.
+ * Writing a member's address into this file would publish who the fund has onboarded, and would go
+ * stale the moment the whitelist changes. An address is never a key either way (CONTRIBUTING.md, the first rule).
+ */
+export const EARN = {
+    /**
+     * Tempora Labs Cash Plus USDC (Test 2), Base — a Morpho Vault V2, the Tempora vault this client
+     * offers by default. Deposits are OPEN to any account (measured by a simulated stranger deposit;
+     * `earn_vaults` reports `defaultAccess: "open"`). The whitelist-gated sibling, Cash Plus USDC
+     * (Test 2A), stays listed as `tlCashPlusUSDC2A` and is refused per account by the pre-flight.
+     */
+    defaultVault: "tlCashPlusUSDC2",
+    /** The round-trip target. The same vault as the default; open, so the fork tier deposits from the whale directly. */
+    roundTripVault: "tlCashPlusUSDC2",
+    /** USDC, as a decimal string — the amount `scripts/roundtrip.ts` prepares by default. Never a float. */
+    roundTripAmountUsdc: "0.05",
+    /** Fixtures the fork and live tiers share. */
+    fixtures: {
+        /** An address that has never touched any vault — the negative control for access checks. */
+        stranger: "0x000000000000000000000000000000000000dEaD",
+        /** Morpho Blue on Base — held ~2.1e14 USDC base units when probed 2026-09-11. Impersonated on the fork, never keyed. */
+        usdcWhale: "0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb",
+        /** USDC the fork round trip deposits, and what it seeds a discovered depositor with beforehand. */
+        forkDepositUsdc: "100",
+        forkSeedUsdc: "1000",
+    },
+};
+//# sourceMappingURL=earn.js.map

package/dist/config/earn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"earn.js","sourceRoot":"","sources":["../../src/config/earn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB;;;;;OAKG;IACH,YAAY,EAAE,iBAAuC;IAErD,qHAAqH;IACrH,cAAc,EAAE,iBAAuC;IAEvD,wGAAwG;IACxG,mBAAmB,EAAE,MAAM;IAE3B,8CAA8C;IAC9C,QAAQ,EAAE;QACR,4FAA4F;QAC5F,QAAQ,EAAE,4CAAqD;QAC/D,wHAAwH;QACxH,SAAS,EAAE,4CAAqD;QAChE,mGAAmG;QACnG,eAAe,EAAE,KAAK;QACtB,YAAY,EAAE,MAAM;KACrB;CACO,CAAC"}

package/dist/disclosures.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The disclosures a distribution surface presents before a depositor's first deposit.
+ * An agent skill IS a distribution surface, so `earn_terms` returns these verbatim and the
+ * skill instructs the agent to show them and get an explicit acknowledgement before building a
+ * first deposit. They are written for the vaults this registry actually offers — Tempora test
+ * vaults on ERC-4626 chassis on Base — and say what is true of those, not of a fund that has not
+ * launched. Change them when the offering changes, and nowhere else.
+ */
+export declare const DISCLOSURES: {
+    readonly source: "Agent Treasury — pre-deposit disclosures, 2026-09-15";
+    readonly presentBefore: "the depositor's first deposit, on every distribution surface";
+    readonly items: readonly ["EVERY VAULT THIS CLIENT OFFERS TODAY IS A TEST VAULT — unproven, and named as such on-chain. They exist to exercise the product, not to hold savings. Deposit only an amount you are fully prepared to lose entirely, and do not move significant funds into one.", "This is a smart-contract vault, not a bank deposit. No deposit insurance of any kind applies.", "The share token's value is a function of the vault's underlying holdings and is not guaranteed. It can go down.", "The vault holds positions in third-party protocols, each of which carries smart-contract, custody, and mechanism risk that Tempora does not control.", "Any yield figure is a measurement over a past window, not a promise. Historical performance is not indicative of future results.", "A withdrawal is served from the vault's liquid balance and then by unwinding its positions. In stressed conditions part of a position may not be withdrawable immediately; earn_balance reports what is exitable now, simulated at the current block.", "Deposits into a whitelist-gated vault are accepted only from accounts the fund has admitted. Withdrawals are public: an account that holds shares can always leave.", "The vault's current holdings, weights and fees are on-chain and publicly readable at the vault's address.", "The default vault is a Tempora-curated destination. Tempora can set fees on it as curator (a management fee and a performance fee, both readable on-chain; check them before depositing). This client offers it because it is Tempora's, not because it is the best-yielding vault available."];
+    readonly clientNotes: readonly ["This client prepares unsigned calls only. It cannot sign, send, or move funds; the operator's own signer does that, and the operator is responsible for what it signs.", "Geography: the operator is responsible for the depositor's eligibility in its own jurisdiction. This client has no geographic signal and makes no representation about eligibility."];
+};

package/dist/disclosures.js

@@ -0,0 +1,28 @@
+/**
+ * The disclosures a distribution surface presents before a depositor's first deposit.
+ * An agent skill IS a distribution surface, so `earn_terms` returns these verbatim and the
+ * skill instructs the agent to show them and get an explicit acknowledgement before building a
+ * first deposit. They are written for the vaults this registry actually offers — Tempora test
+ * vaults on ERC-4626 chassis on Base — and say what is true of those, not of a fund that has not
+ * launched. Change them when the offering changes, and nowhere else.
+ */
+export const DISCLOSURES = {
+    source: "Agent Treasury — pre-deposit disclosures, 2026-09-15",
+    presentBefore: "the depositor's first deposit, on every distribution surface",
+    items: [
+        "EVERY VAULT THIS CLIENT OFFERS TODAY IS A TEST VAULT — unproven, and named as such on-chain. They exist to exercise the product, not to hold savings. Deposit only an amount you are fully prepared to lose entirely, and do not move significant funds into one.",
+        "This is a smart-contract vault, not a bank deposit. No deposit insurance of any kind applies.",
+        "The share token's value is a function of the vault's underlying holdings and is not guaranteed. It can go down.",
+        "The vault holds positions in third-party protocols, each of which carries smart-contract, custody, and mechanism risk that Tempora does not control.",
+        "Any yield figure is a measurement over a past window, not a promise. Historical performance is not indicative of future results.",
+        "A withdrawal is served from the vault's liquid balance and then by unwinding its positions. In stressed conditions part of a position may not be withdrawable immediately; earn_balance reports what is exitable now, simulated at the current block.",
+        "Deposits into a whitelist-gated vault are accepted only from accounts the fund has admitted. Withdrawals are public: an account that holds shares can always leave.",
+        "The vault's current holdings, weights and fees are on-chain and publicly readable at the vault's address.",
+        "The default vault is a Tempora-curated destination. Tempora can set fees on it as curator (a management fee and a performance fee, both readable on-chain; check them before depositing). This client offers it because it is Tempora's, not because it is the best-yielding vault available.",
+    ],
+    clientNotes: [
+        "This client prepares unsigned calls only. It cannot sign, send, or move funds; the operator's own signer does that, and the operator is responsible for what it signs.",
+        "Geography: the operator is responsible for the depositor's eligibility in its own jurisdiction. This client has no geographic signal and makes no representation about eligibility.",
+    ],
+};
+//# sourceMappingURL=disclosures.js.map

package/dist/disclosures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"disclosures.js","sourceRoot":"","sources":["../src/disclosures.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM,EAAE,sDAAsD;IAC9D,aAAa,EAAE,8DAA8D;IAC7E,KAAK,EAAE;QACL,mQAAmQ;QACnQ,+FAA+F;QAC/F,iHAAiH;QACjH,sJAAsJ;QACtJ,kIAAkI;QAClI,uPAAuP;QACvP,qKAAqK;QACrK,2GAA2G;QAC3G,+RAA+R;KAChS;IACD,WAAW,EAAE;QACX,wKAAwK;QACxK,qLAAqL;KACtL;CACO,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,14 @@
+export { loadRegistry, listVaults, getVault, depositableVaults, defaultVault, resolveVault } from "./registry.js";
+export { makePublicClient, rpcUrlFromEnv, logsRpcUrlFromEnv, isSupportedChainId, chains } from "./client.js";
+export type { ReadClient } from "./client.js";
+export { preflightDeposit, classifyRevert, extractRevert } from "./preflight.js";
+export type { PreflightResult, PreflightStatus, RevertObservation } from "./preflight.js";
+export { getPosition } from "./position.js";
+export type { Position } from "./position.js";
+export { quoteDeposit, quoteWithdraw } from "./quote.js";
+export type { DepositQuote, WithdrawQuote } from "./quote.js";
+export { buildDeposit, buildWithdraw } from "./build.js";
+export type { UnsignedCall } from "./build.js";
+export { parseAmount, formatAmount } from "./units.js";
+export { DISCLOSURES } from "./disclosures.js";
+export { UNKNOWN_AFTER_SCAN_FAILURE } from "./position.js";

package/dist/index.js

@@ -0,0 +1,10 @@
+export { loadRegistry, listVaults, getVault, depositableVaults, defaultVault, resolveVault } from "./registry.js";
+export { makePublicClient, rpcUrlFromEnv, logsRpcUrlFromEnv, isSupportedChainId, chains } from "./client.js";
+export { preflightDeposit, classifyRevert, extractRevert } from "./preflight.js";
+export { getPosition } from "./position.js";
+export { quoteDeposit, quoteWithdraw } from "./quote.js";
+export { buildDeposit, buildWithdraw } from "./build.js";
+export { parseAmount, formatAmount } from "./units.js";
+export { DISCLOSURES } from "./disclosures.js";
+export { UNKNOWN_AFTER_SCAN_FAILURE } from "./position.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClH,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE7G,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEjF,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC"}

package/dist/links.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Public, human-checkable links for a vault — the verification path that costs the operator
+ * nothing to follow and this client nothing to serve.
+ *
+ * These are derived from `chainId`, `chassis` and `address`, never stored in the registry: a stored
+ * URL is another field that can drift from the address it claims to describe, and the whole point
+ * of a verification link is that it resolves to the same contract the tools are about to build a
+ * call for. Derive it and the two cannot disagree.
+ *
+ * No RPC is involved. An operator who has not configured an endpoint can still open every one of
+ * these, which is why they are the answer to "how do I check this is real" rather than a live
+ * `symbol()` call the client would have to make on their behalf.
+ */
+import type { VaultEntry } from "./registry-schema.js";
+export interface VaultLinks {
+    /** The contract on a block explorer: source, holdings, every transaction. Always present. */
+    explorer: string;
+    /** The protocol's own UI for this vault, when the chassis has a known one. */
+    app?: string;
+}
+export declare function linksFor(vault: Pick<VaultEntry, "chainId" | "address" | "chassis">): VaultLinks;

package/dist/links.js

@@ -0,0 +1,32 @@
+/**
+ * Block explorers, by chain.
+ *
+ * 🔴 THIS MAP MAY NOT BE MISSED A CHAIN. An unknown `chainId` interpolates `undefined` into the
+ * URL — `undefined0x040f…` — which is a well-formed string, so nothing throws and the caller
+ * receives a link that goes nowhere. Today that is unreachable, but only because the registry
+ * schema pins `chainId: z.literal(8453)`: a wrong value is a compile-time error wherever a
+ * `VaultEntry` is built, and `loadRegistry()` rejects the whole file on any parse failure.
+ *
+ * So the safety here is the LITERAL, not this map. **Widening the schema to a second chain
+ * without adding its row below reintroduces the broken link**, silently. Add the row in the same
+ * change, or make the lookup fail loudly instead.
+ */
+const EXPLORER = {
+    8453: "https://basescan.org/address/",
+};
+/**
+ * The protocol's own front end, where one exists and the URL shape is known. A chassis with no
+ * entry gets no link rather than a guessed one — a wrong app URL sends an operator to someone
+ * else's vault, which is worse than sending them nowhere.
+ */
+const APP = {
+    "morpho-v2": (chainId, address) => (chainId === 8453 ? `https://app.morpho.org/base/vault/${address}` : undefined),
+};
+export function linksFor(vault) {
+    const links = { explorer: `${EXPLORER[vault.chainId]}${vault.address}` };
+    const app = APP[vault.chassis]?.(vault.chainId, vault.address);
+    if (app)
+        links.app = app;
+    return links;
+}
+//# sourceMappingURL=links.js.map

package/dist/links.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"links.js","sourceRoot":"","sources":["../src/links.ts"],"names":[],"mappings":"AAeA;;;;;;;;;;;;GAYG;AACH,MAAM,QAAQ,GAA2B;IACvC,IAAI,EAAE,+BAA+B;CACtC,CAAC;AAEF;;;;GAIG;AACH,MAAM,GAAG,GAA6E;IACpF,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,qCAAqC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CACnH,CAAC;AASF,MAAM,UAAU,QAAQ,CAAC,KAA0D;IACjF,MAAM,KAAK,GAAe,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IACrF,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/D,IAAI,GAAG;QAAE,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;IACzB,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/mcp/server.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Agent Treasury — MCP server (earn skill).
+ *
+ * Read tools, quotes, and UNSIGNED call builders only. There is no `sign` and no `send` tool, and
+ * there will not be one here: the skill supplies intent, the consumer supplies the signer. Anything
+ * that holds a key lives outside this process and receives the calls this server emits.
+ *
+ * Eight tools, all `earn_`-prefixed so later skills can sit beside them
+ * in one namespace:
+ *
+ *   earn_vaults    earn_terms     earn_quote (direction)   earn_status (no args = health)
+ *   earn_balance   earn_claim     earn_prepare_deposit     earn_prepare_withdraw
+ *
+ * Two contracts worth stating here because they are easy to erode:
+ *
+ * 1. `earn_prepare_*` return an ENVELOPE, `{ requires_signature, status: "unsigned", calls }`,
+ *    not a bare array. This cannot stop a model reporting "deposited" — nothing at this boundary
+ *    can — but it makes an unsigned build structurally distinguishable from a completed one, so a
+ *    consumer or a test can assert on it. Wrapped HERE only: `buildDeposit`/`buildWithdraw` still
+ *    return arrays, so a direct library consumer (see docs/runbooks/sign_and_send.md) gets the
+ *    naked calls exactly as before.
+ * 2. The address argument is `account` everywhere. It was `depositor`, `owner` and `principal` in
+ *    three different tools. `receiver` stays distinct because it genuinely is: `account` owns the
+ *    shares, `receiver` is where the money lands.
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/**
+ * What a signer must do for these calls to land exactly once. Each rule is a failure measured on a
+ * real Base round trip, not a precaution (2026-09-13, two runs through these tools).
+ * The server cannot enforce any of them — it never signs — so it states them with every build.
+ */
+export declare const SIGNER_RULES: readonly ["Before signing, check every call's destination against the addresses the operator gave: `to`, and the receiver/owner named in `description`. Do not sign a call whose destination you did not confirm.", "Set the nonce explicitly from eth_getTransactionCount(account, \"pending\") immediately before each send. A load-balanced RPC can hand a signing library a stale nonce, and the send is then rejected as \"nonce too low\" (measured 2026-09-14, mainnet.base.org).", "Set the gas limit to the call's gasAdvice (estimate × 1.5).", "Wait for each receipt before sending the next call, and poll for it on a provider that serves receipts: a public endpoint may refuse eth_getTransactionReceipt (measured 2026-09-14, publicnode). A failed receipt poll does not mean the transaction failed.", "If a send or receipt poll fails for any reason other than an on-chain revert, read the account's nonce on a DIFFERENT provider before re-sending. A nonce that moved means the transaction was accepted; re-sending it would repeat the deposit or withdrawal."];
+export declare function buildServer(): McpServer;