@varnir/agent-server 0.1.0

package/dist/index.js

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+import { VarnirClient, onWirePublicKey } from '@varnir/chain-client';
+import { loadConfig, ConfigError } from './config.js';
+import { log, registerSecret } from './log.js';
+import { classifyKey } from './guard.js';
+import { buildTools } from './tools.js';
+import { serveStdio } from './mcp-stdio.js';
+import { serveMcpHttp } from './mcp-http.js';
+import { createRestApp } from './rest.js';
+async function main() {
+    const config = loadConfig(process.env);
+    registerSecret(config.privateKeyHex);
+    const client = new VarnirClient({
+        privateKeyHex: config.privateKeyHex,
+        identity: config.identity,
+        network: config.network,
+    });
+    // The UNTAGGED on-wire form, which is what meta.authorities[].public holds
+    // and therefore what listLedgerKeys() reports. publicKeyForPrivateKey()
+    // would tag a PQ key as 'falcon-512:<pk>' and never match. See key-match.ts.
+    const publicKeyHex = onWirePublicKey(config.privateKeyHex).publicKey;
+    // The unscoped-key guard. See guard.ts for why this exists.
+    let mode;
+    try {
+        mode = classifyKey(await client.listLedgerKeys(), publicKeyHex, config.allowUnscopedKey);
+    }
+    catch (e) {
+        log.error(`Could not read this identity's keys from the ledger, so the key behind VARNIR_PRIVATE_KEY could not be checked: ${e.message}`);
+        process.exit(1);
+    }
+    if (mode.mode === 'refuse') {
+        log.error(mode.reason);
+        process.exit(1);
+    }
+    if (mode.mode === 'read-only')
+        log.warn(mode.reason);
+    else
+        log.info(mode.reason);
+    const tools = buildTools({ client, identity: config.identity, publicKeyHex, mode: mode.mode, reason: mode.reason });
+    log.info(`Varnir agent server ready: identity ${config.identity} on ${config.network}, ${tools.length} tools, mode ${mode.mode}.`);
+    if (config.restApi.enabled) {
+        const { host, port, remote, writes } = config.restApi;
+        if (remote) {
+            log.warn(`The REST API is bound to ${host}:${port}, which is REACHABLE FROM THE NETWORK. Anyone who can reach it and holds the token can move funds within this key's policy.`);
+        }
+        const restServer = createRestApp({ client, config, mode: mode.mode }).listen(port, host, () => {
+            log.info(`REST SecureAPI listening on ${host}:${port} (writes ${writes ? 'ENABLED' : 'disabled'}).`);
+        });
+        restServer.once('error', (err) => {
+            if (err.code === 'EADDRINUSE') {
+                log.error(`REST API bind failed on ${host}:${port}: address already in use (another process may be listening on that port).`);
+            }
+            else {
+                log.error(`REST API bind failed on ${host}:${port}: ${err.message}`);
+            }
+            process.exit(1);
+        });
+    }
+    if (config.mcpHttp.enabled) {
+        const { host, port, remote } = config.mcpHttp;
+        if (remote) {
+            log.warn(`The MCP HTTP server is bound to ${host}:${port}, which is REACHABLE FROM THE NETWORK. Anyone who can reach it and holds the token can move funds within this key's policy.`);
+        }
+        await serveMcpHttp(tools, { port, host, token: config.mcpHttp.token });
+    }
+    // stdio last and never awaited alongside a log line: from here stdout is the
+    // protocol channel.
+    if (config.mcpStdio)
+        await serveStdio(tools);
+}
+main().catch((e) => {
+    if (e instanceof ConfigError) {
+        log.error(e.message);
+        process.exit(1);
+    }
+    log.error(`Fatal: ${e.message}`);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,YAAY,EAAE,eAAe,EAAC,MAAM,sBAAsB,CAAC;AAEnE,OAAO,EAAC,UAAU,EAAE,WAAW,EAAC,MAAM,aAAa,CAAC;AACpD,OAAO,EAAC,GAAG,EAAE,cAAc,EAAC,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAC,WAAW,EAAC,MAAM,YAAY,CAAC;AACvC,OAAO,EAAC,UAAU,EAAC,MAAM,YAAY,CAAC;AACtC,OAAO,EAAC,UAAU,EAAC,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAC,YAAY,EAAC,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAC,aAAa,EAAC,MAAM,WAAW,CAAC;AAExC,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAErC,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;QAC9B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAwB;KACzC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,wEAAwE;IACxE,6EAA6E;IAC7E,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC;IAErE,4DAA4D;IAC5D,IAAI,IAAoC,CAAC;IACzC,IAAI,CAAC;QACH,IAAI,GAAG,WAAW,CAAC,MAAM,MAAM,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC3F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,mHAAoH,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACrJ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;;QAChD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAE3B,MAAM,KAAK,GAAG,UAAU,CAAC,EAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAC,CAAC,CAAC;IAClH,GAAG,CAAC,IAAI,CAAC,uCAAuC,MAAM,CAAC,QAAQ,OAAO,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,gBAAgB,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;IAEnI,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,EAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAC,GAAG,MAAM,CAAC,OAAO,CAAC;QACpD,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,4BAA4B,IAAI,IAAI,IAAI,6HAA6H,CAAC,CAAC;QAClL,CAAC;QACD,MAAM,UAAU,GAAG,aAAa,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YAC1F,GAAG,CAAC,IAAI,CAAC,+BAA+B,IAAI,IAAI,IAAI,YAAY,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC;QACvG,CAAC,CAAC,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YACtD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC9B,GAAG,CAAC,KAAK,CAAC,2BAA2B,IAAI,IAAI,IAAI,2EAA2E,CAAC,CAAC;YAChI,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,2BAA2B,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,EAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAC,GAAG,MAAM,CAAC,OAAO,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,mCAAmC,IAAI,IAAI,IAAI,6HAA6H,CAAC,CAAC;QACzL,CAAC;QACD,MAAM,YAAY,CAAC,KAAK,EAAE,EAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAC,CAAC,CAAC;IACvE,CAAC;IAED,6EAA6E;IAC7E,oBAAoB;IACpB,IAAI,MAAM,CAAC,QAAQ;QAAE,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;IAC1B,IAAI,CAAC,YAAY,WAAW,EAAE,CAAC;QAC7B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,UAAW,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/key-match.d.ts

@@ -0,0 +1,2 @@
+export declare function samePublicKey(a: string, b: string): boolean;
+//# sourceMappingURL=key-match.d.ts.map

package/dist/key-match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-match.d.ts","sourceRoot":"","sources":["../src/key-match.ts"],"names":[],"mappings":"AAqBA,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAS3D"}

package/dist/key-match.js

@@ -0,0 +1,33 @@
+/**
+ * Compare two public keys as the ledger stores them.
+ *
+ * This is fiddly for one reason: Varnir carries two key types with two
+ * encodings. A secp256k1 public key is hex - case-insensitive, sometimes
+ * 0x-prefixed. A post-quantum (Falcon) public key is base64, which is
+ * CASE-SENSITIVE and whose alphabet includes '+', '/' and '='. Case-folding a
+ * base64 key to "normalise" it corrupts it, and Falcon is the default key type
+ * for new keys, so a naive comparison fails on exactly the keys this server is
+ * meant to run behind.
+ *
+ * So: compare exactly first, which is always correct; only fall back to a
+ * case-insensitive compare when BOTH sides are unambiguously hex.
+ */
+const HEX = /^[0-9a-fA-F]+$/;
+function stripPrefix(s) {
+    const t = s.trim();
+    return t.startsWith('0x') || t.startsWith('0X') ? t.slice(2) : t;
+}
+export function samePublicKey(a, b) {
+    const x = a.trim();
+    const y = b.trim();
+    if (!x || !y)
+        return false;
+    if (x === y)
+        return true;
+    const hx = stripPrefix(x);
+    const hy = stripPrefix(y);
+    if (!HEX.test(hx) || !HEX.test(hy))
+        return false;
+    return hx.toLowerCase() === hy.toLowerCase();
+}
+//# sourceMappingURL=key-match.js.map

package/dist/key-match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-match.js","sourceRoot":"","sources":["../src/key-match.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,GAAG,GAAG,gBAAgB,CAAC;AAE7B,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;AAC/C,CAAC"}

package/dist/log.d.ts

@@ -0,0 +1,8 @@
+export declare function registerSecret(value: string): void;
+export declare function redact(input: string, against?: string[]): string;
+export declare const log: {
+    info: (m: string) => void;
+    warn: (m: string) => void;
+    error: (m: string) => void;
+};
+//# sourceMappingURL=log.d.ts.map

package/dist/log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AASA,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAElD;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,EAAY,GAAG,MAAM,CAOzE;AAMD,eAAO,MAAM,GAAG;cACJ,MAAM;cACN,MAAM;eACL,MAAM;CAClB,CAAC"}

package/dist/log.js

@@ -0,0 +1,30 @@
+/**
+ * Logging that cannot leak the signing key. Every message passes through
+ * `redact` against the process's registered secrets before it is written.
+ *
+ * Everything goes to STDERR, never stdout: when this server speaks MCP over
+ * stdio, stdout IS the protocol channel and a stray log line corrupts it.
+ */
+const secrets = [];
+export function registerSecret(value) {
+    if (value)
+        secrets.push(value);
+}
+export function redact(input, against = secrets) {
+    let out = input;
+    for (const s of against) {
+        if (!s)
+            continue;
+        out = out.split(s).join('[redacted]');
+    }
+    return out;
+}
+function write(level, message) {
+    process.stderr.write(`${new Date().toISOString()} ${level} ${redact(message)}\n`);
+}
+export const log = {
+    info: (m) => write('INFO', m),
+    warn: (m) => write('WARN', m),
+    error: (m) => write('ERROR', m),
+};
+//# sourceMappingURL=log.js.map

package/dist/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,OAAO,GAAa,EAAE,CAAC;AAE7B,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,KAAK;QAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAa,EAAE,UAAoB,OAAO;IAC/D,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,KAAK,CAAC,KAAa,EAAE,OAAe;IAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,KAAK,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;CACxC,CAAC"}

package/dist/mcp-http.d.ts

@@ -0,0 +1,58 @@
+import express from 'express';
+import type { ToolDef } from './tools.js';
+/**
+ * Streamable HTTP, for clients that cannot launch a local process - notably
+ * ChatGPT, which requires a publicly reachable HTTPS endpoint. Stateless
+ * (`sessionIdGenerator: undefined`): a fresh server and transport per request,
+ * so there is no session state to leak between callers.
+ *
+ * `opts.token` is mandatory here (see config.ts's I4 fix): VARNIR_MCP_HTTP=on
+ * alone used to put the full write set on loopback with no authentication at
+ * all - any other local user or process on a shared host could move funds.
+ *
+ * There is deliberately no `enableDnsRebindingProtection`/`allowedHosts`
+ * here. That option was tried and removed - not patched - for a specific
+ * reason:
+ *
+ * The SDK's `allowedHosts` check is an exact `includes(hostHeader)` match
+ * against the literal `Host` header a client sends
+ * (@modelcontextprotocol/sdk/dist/esm/server/webStandardStreamableHttp.js).
+ * Such a list can only ever be built from what THIS PROCESS is bound to
+ * (`opts.host`/`opts.port`) - and for the loopback deployments this was
+ * meant to guard, that is provably not what every legitimate client sends:
+ *
+ *   - `::1` needs the bracketed form `[::1]:port` in the list - fixable,
+ *     and was simply missing.
+ *   - a client talking to port 80/443 omits the default port in its Host
+ *     header - also fixable, and also simply missing.
+ *   - a client reaching this process through a remapped or tunnelled port
+ *     (`docker -p 9000:8787`, `ssh -L 9000:localhost:8787`) sends
+ *     `Host: localhost:9000`. This process is bound to 8787 and has no
+ *     channel to learn that "9000" exists anywhere - Docker's port mapping
+ *     and a raw ssh -L tunnel both happen entirely outside this process.
+ *     No `allowedHosts` list built from `opts.host`/`opts.port` can ever
+ *     contain the port such a client will present; this is not a derivation
+ *     bug to fix, it is information the server does not have and cannot
+ *     obtain.
+ *
+ * Since that third case can never be fixed by any allowlist derived this
+ * way, and a bare 403 with nothing beyond "Invalid Host header" in the
+ * JSON-RPC response is a worse failure mode than no DNS-rebinding guard at
+ * all (silent, undiagnosable breakage of an otherwise fully-supported
+ * deployment), the option is removed rather than patched. What actually
+ * gates this endpoint is the mandatory bearer token (config.ts's I4 fix:
+ * timing-safe, >=32 characters, required even on loopback) - and unlike the
+ * ambient/cookie authority DNS-rebinding protection exists to defend, a
+ * bearer token is never attached automatically by a browser. A rebinding
+ * attacker's page has no way to obtain it, so the token already denies the
+ * attack this option existed to guard against.
+ */
+export declare function createMcpHttpApp(tools: ToolDef[], opts: {
+    token: string;
+}): express.Express;
+export declare function serveMcpHttp(tools: ToolDef[], opts: {
+    port: number;
+    host: string;
+    token: string;
+}): Promise<void>;
+//# sourceMappingURL=mcp-http.d.ts.map

package/dist/mcp-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-http.d.ts","sourceRoot":"","sources":["../src/mcp-http.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAO9B,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,YAAY,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,OAAO,CAiDzF;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBrH"}

package/dist/mcp-http.js

@@ -0,0 +1,121 @@
+import express from 'express';
+import { randomUUID } from 'node:crypto';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { createMcpServer } from './mcp.js';
+import { tokenMatches } from './bearer.js';
+import { classifyBodyError } from './tool-error.js';
+import { log } from './log.js';
+/**
+ * Streamable HTTP, for clients that cannot launch a local process - notably
+ * ChatGPT, which requires a publicly reachable HTTPS endpoint. Stateless
+ * (`sessionIdGenerator: undefined`): a fresh server and transport per request,
+ * so there is no session state to leak between callers.
+ *
+ * `opts.token` is mandatory here (see config.ts's I4 fix): VARNIR_MCP_HTTP=on
+ * alone used to put the full write set on loopback with no authentication at
+ * all - any other local user or process on a shared host could move funds.
+ *
+ * There is deliberately no `enableDnsRebindingProtection`/`allowedHosts`
+ * here. That option was tried and removed - not patched - for a specific
+ * reason:
+ *
+ * The SDK's `allowedHosts` check is an exact `includes(hostHeader)` match
+ * against the literal `Host` header a client sends
+ * (@modelcontextprotocol/sdk/dist/esm/server/webStandardStreamableHttp.js).
+ * Such a list can only ever be built from what THIS PROCESS is bound to
+ * (`opts.host`/`opts.port`) - and for the loopback deployments this was
+ * meant to guard, that is provably not what every legitimate client sends:
+ *
+ *   - `::1` needs the bracketed form `[::1]:port` in the list - fixable,
+ *     and was simply missing.
+ *   - a client talking to port 80/443 omits the default port in its Host
+ *     header - also fixable, and also simply missing.
+ *   - a client reaching this process through a remapped or tunnelled port
+ *     (`docker -p 9000:8787`, `ssh -L 9000:localhost:8787`) sends
+ *     `Host: localhost:9000`. This process is bound to 8787 and has no
+ *     channel to learn that "9000" exists anywhere - Docker's port mapping
+ *     and a raw ssh -L tunnel both happen entirely outside this process.
+ *     No `allowedHosts` list built from `opts.host`/`opts.port` can ever
+ *     contain the port such a client will present; this is not a derivation
+ *     bug to fix, it is information the server does not have and cannot
+ *     obtain.
+ *
+ * Since that third case can never be fixed by any allowlist derived this
+ * way, and a bare 403 with nothing beyond "Invalid Host header" in the
+ * JSON-RPC response is a worse failure mode than no DNS-rebinding guard at
+ * all (silent, undiagnosable breakage of an otherwise fully-supported
+ * deployment), the option is removed rather than patched. What actually
+ * gates this endpoint is the mandatory bearer token (config.ts's I4 fix:
+ * timing-safe, >=32 characters, required even on loopback) - and unlike the
+ * ambient/cookie authority DNS-rebinding protection exists to defend, a
+ * bearer token is never attached automatically by a browser. A rebinding
+ * attacker's page has no way to obtain it, so the token already denies the
+ * attack this option existed to guard against.
+ */
+export function createMcpHttpApp(tools, opts) {
+    const app = express();
+    // Auth before the body parser: an unauthenticated caller must not be able
+    // to reach express.json() at all, and a malformed body from an
+    // unauthenticated caller must never reach express's default error handler
+    // (which echoes err.stack whenever NODE_ENV isn't 'production' - nothing
+    // here sets it). See rest.ts for the same ordering.
+    const authorise = (req, res, next) => {
+        const header = req.header('authorization') ?? '';
+        const presented = header.startsWith('Bearer ') ? header.slice(7) : '';
+        if (!presented || !tokenMatches(presented, opts.token)) {
+            res.status(401).json({ error: 'unauthorized' });
+            return;
+        }
+        next();
+    };
+    app.post('/mcp', authorise, express.json({ limit: '1mb' }), async (req, res, next) => {
+        try {
+            // Stateless: a fresh server+transport per request, so there is no
+            // session state to leak between callers.
+            const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+            res.on('close', () => { void transport.close(); });
+            await createMcpServer(tools).connect(transport);
+            await transport.handleRequest(req, res, req.body);
+        }
+        catch (e) {
+            // Express 4 does not forward a rejection from an async handler to
+            // error middleware on its own - an uncaught one here becomes an
+            // unhandled rejection and kills the process (e.g. the SDK's own
+            // "Stateless transport cannot be reused across requests").
+            next(e);
+        }
+    });
+    app.get('/health', (_req, res) => { res.json({ ok: true, id: randomUUID() }); });
+    // Structured JSON errors, never express's default HTML/stack-trace handler.
+    // Must be declared after the routes/middleware it protects.
+    app.use((err, _req, res, next) => {
+        // Once a response has started, express's contract is to delegate to the
+        // default handler rather than write again - calling res.status() after
+        // headers are sent throws and drops the socket opaquely.
+        if (res.headersSent) {
+            next(err);
+            return;
+        }
+        const { status, code, message } = classifyBodyError(err);
+        res.status(status).json({ error: { code, message } });
+    });
+    return app;
+}
+export async function serveMcpHttp(tools, opts) {
+    const app = createMcpHttpApp(tools, { token: opts.token });
+    await new Promise((resolve, reject) => {
+        const server = app.listen(opts.port, opts.host, () => {
+            log.info(`MCP Streamable HTTP listening on ${opts.host}:${opts.port}/mcp (bearer required)`);
+            resolve();
+        });
+        server.once('error', (err) => {
+            if (err.code === 'EADDRINUSE') {
+                reject(new Error(`MCP HTTP bind failed on ${opts.host}:${opts.port}: address already in use (another process may be listening on that port).`));
+            }
+            else {
+                reject(new Error(`MCP HTTP bind failed on ${opts.host}:${opts.port}: ${err.message}`));
+            }
+        });
+    });
+}
+//# sourceMappingURL=mcp-http.js.map

package/dist/mcp-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-http.js","sourceRoot":"","sources":["../src/mcp-http.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AACvC,OAAO,EAAC,6BAA6B,EAAC,MAAM,oDAAoD,CAAC;AACjG,OAAO,EAAC,eAAe,EAAC,MAAM,UAAU,CAAC;AACzC,OAAO,EAAC,YAAY,EAAC,MAAM,aAAa,CAAC;AACzC,OAAO,EAAC,iBAAiB,EAAC,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAC,GAAG,EAAC,MAAM,UAAU,CAAC;AAG7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAgB,EAAE,IAAqB;IACtE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,0EAA0E;IAC1E,+DAA+D;IAC/D,0EAA0E;IAC1E,yEAAyE;IACzE,oDAAoD;IACpD,MAAM,SAAS,GAA2B,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,SAAS,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,cAAc,EAAC,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,KAAK,EAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACjF,IAAI,CAAC;YACH,kEAAkE;YAClE,yCAAyC;YACzC,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,EAAC,kBAAkB,EAAE,SAAS,EAAC,CAAC,CAAC;YACrF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChD,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,kEAAkE;YAClE,gEAAgE;YAChE,gEAAgE;YAChE,2DAA2D;YAC3D,IAAI,CAAC,CAAC,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,EAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/E,4EAA4E;IAC5E,4DAA4D;IAC5D,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,IAAqB,EAAE,GAAqB,EAAE,IAA0B,EAAE,EAAE;QACjG,wEAAwE;QACxE,uEAAuE;QACvE,yDAAyD;QACzD,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC3C,MAAM,EAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,EAAC,IAAI,EAAE,OAAO,EAAC,EAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAgB,EAAE,IAAiD;IACpG,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,EAAE,EAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAC,CAAC,CAAC;IAEzD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;YACnD,GAAG,CAAC,IAAI,CAAC,oCAAoC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,wBAAwB,CAAC,CAAC;YAC7F,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAClD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,2EAA2E,CAAC,CAAC,CAAC;YAClJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACzF,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/mcp-stdio.d.ts

@@ -0,0 +1,11 @@
+import type { ToolDef } from './tools.js';
+/**
+ * stdio needs no authentication: the client is a local process the operator
+ * launched, and the credential is the environment it was given. The MCP spec
+ * says as much - stdio servers take credentials from the environment rather
+ * than implementing the OAuth framework.
+ *
+ * Nothing may write to stdout while this is running; stdout IS the protocol.
+ */
+export declare function serveStdio(tools: ToolDef[]): Promise<void>;
+//# sourceMappingURL=mcp-stdio.d.ts.map

package/dist/mcp-stdio.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-stdio.d.ts","sourceRoot":"","sources":["../src/mcp-stdio.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,YAAY,CAAC;AAExC;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhE"}

package/dist/mcp-stdio.js

@@ -0,0 +1,14 @@
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { createMcpServer } from './mcp.js';
+/**
+ * stdio needs no authentication: the client is a local process the operator
+ * launched, and the credential is the environment it was given. The MCP spec
+ * says as much - stdio servers take credentials from the environment rather
+ * than implementing the OAuth framework.
+ *
+ * Nothing may write to stdout while this is running; stdout IS the protocol.
+ */
+export async function serveStdio(tools) {
+    await createMcpServer(tools).connect(new StdioServerTransport());
+}
+//# sourceMappingURL=mcp-stdio.js.map

package/dist/mcp-stdio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-stdio.js","sourceRoot":"","sources":["../src/mcp-stdio.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,oBAAoB,EAAC,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EAAC,eAAe,EAAC,MAAM,UAAU,CAAC;AAGzC;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAgB;IAC/C,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;AACnE,CAAC"}

package/dist/mcp.d.ts

@@ -0,0 +1,10 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { ToolDef } from './tools.js';
+/**
+ * Adapt the tool layer to MCP. Every handler already returns a structured
+ * result or a structured failure, so this only has to serialise: a tool never
+ * throws past here, which is what keeps a policy rejection legible to the
+ * assistant instead of surfacing as a transport error.
+ */
+export declare function createMcpServer(tools: ToolDef[]): McpServer;
+//# sourceMappingURL=mcp.d.ts.map

package/dist/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,SAAS,EAAC,MAAM,yCAAyC,CAAC;AAClE,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,YAAY,CAAC;AAExC;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,SAAS,CAa3D"}

package/dist/mcp.js

@@ -0,0 +1,18 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+/**
+ * Adapt the tool layer to MCP. Every handler already returns a structured
+ * result or a structured failure, so this only has to serialise: a tool never
+ * throws past here, which is what keeps a policy rejection legible to the
+ * assistant instead of surfacing as a transport error.
+ */
+export function createMcpServer(tools) {
+    const server = new McpServer({ name: 'varnir', version: '0.1.0' });
+    for (const t of tools) {
+        server.registerTool(t.name, { title: t.title, description: t.description, inputSchema: t.inputSchema }, async (args) => {
+            const result = await t.handler(args ?? {});
+            return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+        });
+    }
+    return server;
+}
+//# sourceMappingURL=mcp.js.map

package/dist/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,SAAS,EAAC,MAAM,yCAAyC,CAAC;AAGlE;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAgB;IAC9C,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAC,CAAC,CAAC;IACjE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,YAAY,CACjB,CAAC,CAAC,IAAI,EACN,EAAC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAC,EACxE,KAAK,EAAE,IAA6B,EAAE,EAAE;YACtC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAC3C,OAAO,EAAC,OAAO,EAAE,CAAC,EAAC,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAC,CAAC,EAAC,CAAC;QACrF,CAAC,CACF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/rest-methods.d.ts

@@ -0,0 +1,31 @@
+import type { VarnirClient } from '@varnir/chain-client';
+/**
+ * The REST surface, as an explicit table rather than reflection over the
+ * client. Reflection plus a denylist would auto-expose anything added to the
+ * SDK later - including future key-management methods - so the denylist would
+ * silently stop being complete. This is broad but closed by default: a new SDK
+ * method appears here only when someone adds it deliberately.
+ *
+ * addKey, removeKey, setApprovalThreshold, registerApiKey and revokeApiKey are
+ * absent on purpose and must stay absent. Nothing reachable from an assistant
+ * may widen that assistant's own authority.
+ *
+ * confirmTransfer and listPendingApprovals are ALSO absent on purpose, for the
+ * same reason even though they don't look like key management: a `verifier`
+ * or `dual` key (both stake 80) can hit the co-sign band on a proposal it did
+ * not itself raise, which the contract (Varnir.CryptoTransfer.ts) treats as a
+ * genuine co-sign confirmation and releases WITHOUT re-checking that key's own
+ * spend policy - policy checking happens only when the proposal is raised.
+ * Exposing listPendingApprovals to enumerate held proposals plus
+ * confirmTransfer to release any one of them lets an agent key escape its own
+ * per-tx ceiling, period cap and allowlist: exactly the authority a co-sign
+ * threshold exists to withhold. Neither has an MCP tool sibling, so removing
+ * both from REST regresses nothing. Must stay absent.
+ */
+export interface RestMethod {
+    name: string;
+    write: boolean;
+    call(client: VarnirClient, body: Record<string, unknown>): Promise<unknown>;
+}
+export declare const REST_METHODS: RestMethod[];
+//# sourceMappingURL=rest-methods.d.ts.map

package/dist/rest-methods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rest-methods.d.ts","sourceRoot":"","sources":["../src/rest-methods.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,sBAAsB,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7E;AAID,eAAO,MAAM,YAAY,EAAE,UAAU,EAwEpC,CAAC"}

package/dist/rest-methods.js

@@ -0,0 +1,66 @@
+const b = (v) => v;
+export const REST_METHODS = [
+    // ---- identity / registry (read) ----
+    { name: 'getIdentityStream', write: false, call: c => c.getIdentityStream() },
+    { name: 'identityExists', write: false, call: (c, o) => c.identityExists(b(o.identity)) },
+    { name: 'listTokens', write: false, call: c => c.listTokens() },
+    { name: 'getToken', write: false, call: (c, o) => c.getToken(b(o.network), b(o.address)) },
+    // ---- wallets / balances (read) ----
+    // listWallets is the non-mutating way to enumerate wallets; getWallet is
+    // NOT here - see the money-movement section below for why.
+    { name: 'listWallets', write: false, call: c => c.listWallets() },
+    { name: 'getBalances', write: false, call: c => c.getBalances() },
+    { name: 'getWalletL1Balances', write: false, call: (c, o) => c.getWalletL1Balances(b(o.chain)) },
+    { name: 'getDeposit', write: false, call: (c, o) => c.getDeposit(b(o.chain), b(o.txHash)) },
+    // ---- transactions (read) ----
+    { name: 'listTransactions', write: false, call: (c, o) => c.listTransactions(b(o)) },
+    { name: 'getTransfer', write: false, call: (c, o) => c.getTransfer(b(o.umid)) },
+    { name: 'getTransferProposal', write: false, call: (c, o) => c.getTransferProposal(b(o.id)) },
+    // listPendingApprovals is deliberately absent - see the file preamble.
+    // ---- exchange (read) ----
+    { name: 'getOrderBook', write: false, call: c => c.getOrderBook() },
+    // ---- invoices (read) ----
+    { name: 'listInvoices', write: false, call: c => c.listInvoices() },
+    { name: 'getInvoice', write: false, call: (c, o) => c.getInvoice(b(o.id)) },
+    // ---- keys: READ ONLY. Mutation is deliberately absent. ----
+    { name: 'listLedgerKeys', write: false, call: c => c.listLedgerKeys() },
+    { name: 'listApiKeys', write: false, call: c => c.listApiKeys() },
+    // ---- webhooks ----
+    { name: 'getWebhookSettings', write: false, call: c => c.getWebhookSettings() },
+    { name: 'setWebhookUrl', write: true, call: (c, o) => c.setWebhookUrl(b(o.callbackUrl)) },
+    { name: 'deleteWebhookUrl', write: true, call: c => c.deleteWebhookUrl() },
+    // ---- money movement (write) ----
+    { name: 'createWallet', write: true, call: (c, o) => c.createWallet(b(o.chain), b(o.options)) },
+    // getWallet LOOKS like a read - it is not. When this identity has no
+    // wallet yet on the chain, it falls through to createWallet: claims a
+    // pregenerated L1 wallet from the pool and signs a Varnir.AssignOwner
+    // transaction to establish ownership. That is a ledger-mutating write on
+    // its first call for a chain, regardless of what the name suggests - do
+    // not reclassify this back to write: false.
+    { name: 'getWallet', write: true, call: (c, o) => c.getWallet(b(o.chain), b(o.options)) },
+    {
+        name: 'send',
+        write: true,
+        call: async (c, o) => {
+            const wallet = o.wallet ?? (await c.getWallet(b(o.chain)));
+            return c.send({
+                wallet: b(wallet), to: b(o.to),
+                amount: b(o.amount), token: b(o.token),
+            });
+        },
+    },
+    { name: 'transferOnLedger', write: true, call: (c, o) => c.transferOnLedger(b(o)) },
+    { name: 'consolidate', write: true, call: (c, o) => c.consolidate(b(o)) },
+    // confirmTransfer is deliberately absent - see the file preamble. It also
+    // has no `approve`/reject parameter on the SDK; a caller trying to decline
+    // a held transfer over this method would have released it instead.
+    // ---- exchange (write) ----
+    { name: 'createOrder', write: true, call: (c, o) => c.createOrder(b(o)) },
+    { name: 'postOrder', write: true, call: (c, o) => c.postOrder(b(o.signed)) },
+    { name: 'fillOrder', write: true, call: (c, o) => c.fillOrder(b(o.signed), b(o.opts)) },
+    { name: 'marketOrder', write: true, call: (c, o) => c.marketOrder(b(o)) },
+    { name: 'cancelOrder', write: true, call: (c, o) => c.cancelOrder(b(o.orderHash)) },
+    // ---- invoices (write) ----
+    { name: 'createInvoice', write: true, call: (c, o) => c.createInvoice(b(o)) },
+];
+//# sourceMappingURL=rest-methods.js.map

package/dist/rest-methods.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rest-methods.js","sourceRoot":"","sources":["../src/rest-methods.ts"],"names":[],"mappings":"AA+BA,MAAM,CAAC,GAAG,CAAI,CAAU,EAAE,EAAE,CAAC,CAAM,CAAC;AAEpC,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC,uCAAuC;IACvC,EAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,EAAE,EAAC;IAC3E,EAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAC;IAC/F,EAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,EAAC;IAC7D,EAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAS,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAS,CAAC,CAAC,OAAO,CAAC,CAAC,EAAC;IAExG,sCAAsC;IACtC,yEAAyE;IACzE,2DAA2D;IAC3D,EAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,EAAC;IAC/D,EAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,EAAC;IAC/D,EAAC,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC;IACrG,EAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAS,CAAC,CAAC,MAAM,CAAC,CAAC,EAAC;IAExG,gCAAgC;IAChC,EAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAQ,CAAC,CAAC,CAAC,EAAC;IACzF,EAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAS,CAAC,CAAC,IAAI,CAAC,CAAC,EAAC;IACrF,EAAC,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAC;IACnG,uEAAuE;IAEvE,4BAA4B;IAC5B,EAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,EAAC;IAEjE,4BAA4B;IAC5B,EAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,EAAC;IACjE,EAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAC;IAEjF,8DAA8D;IAC9D,EAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,EAAC;IACrE,EAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,EAAC;IAE/D,qBAAqB;IACrB,EAAC,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,EAAE,EAAC;IAC7E,EAAC,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAS,CAAC,CAAC,WAAW,CAAC,CAAC,EAAC;IAC/F,EAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,EAAE,EAAC;IAExE,mCAAmC;IACnC,EAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,EAAC;IAC3G,qEAAqE;IACrE,sEAAsE;IACtE,sEAAsE;IACtE,yEAAyE;IACzE,wEAAwE;IACxE,4CAA4C;IAC5C,EAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,EAAC;IACrG;QACE,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;YACnB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,CAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAClE,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,CAAC,CAAQ,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAS,CAAC,CAAC,EAAE,CAAC;gBAC7C,MAAM,EAAE,CAAC,CAAS,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAqB,CAAC,CAAC,KAAK,CAAC;aACnE,CAAC,CAAC;QACL,CAAC;KACF;IACD,EAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAQ,CAAC,CAAC,CAAC,EAAC;IACxF,EAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAQ,CAAC,CAAC,CAAC,EAAC;IAC9E,0EAA0E;IAC1E,2EAA2E;IAC3E,mEAAmE;IAEnE,6BAA6B;IAC7B,EAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAQ,CAAC,CAAC,CAAC,EAAC;IAC9E,EAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,EAAC;IACjF,EAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,EAAC;IACnG,EAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAQ,CAAC,CAAC,CAAC,EAAC;IAC9E,EAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAS,CAAC,CAAC,SAAS,CAAC,CAAC,EAAC;IAEzF,6BAA6B;IAC7B,EAAC,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAQ,CAAC,CAAC,CAAC,EAAC;CACnF,CAAC"}

package/dist/rest.d.ts

@@ -0,0 +1,17 @@
+import express from 'express';
+import type { VarnirClient } from '@varnir/chain-client';
+import type { ServerConfig } from './config.js';
+import type { GuardMode } from './guard.js';
+/**
+ * The SecureAPI: the TypeScript SDK's methods mapped to HTTP, for integrating
+ * software that can only call HTTP endpoints. This is the surface that can move
+ * money, so its gates are all here and all tested: off unless enabled, a
+ * mandatory bearer token, and writes behind their own flag on top of the
+ * boot-time key guard.
+ */
+export declare function createRestApp(deps: {
+    client: VarnirClient;
+    config: ServerConfig;
+    mode: GuardMode;
+}): express.Express;
+//# sourceMappingURL=rest.d.ts.map

package/dist/rest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rest.d.ts","sourceRoot":"","sources":["../src/rest.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,YAAY,CAAC;AAM1C;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAC,GAAG,OAAO,CAAC,OAAO,CAyElH"}