@venlyfinance/settlement-mcp 0.5.0 → 0.7.0

package/dist/index.js

@@ -27,7 +27,35 @@ async function main() {
             : "writes DISARMED: mutations return dry-run previews (arming needs confirm:true + VENLY_MCP_LIVE=1 + credentials)";
     process.stderr.write(`venly-finance-mcp started in ${client.environment}. ${writeState}.\n`);
 }
-main().catch((err) => {
-    process.stderr.write(`Fatal: ${err.message}\n`);
-    process.exit(1);
-});
+const argv = process.argv.slice(2);
+if (argv[0] === "review") {
+    // Design-audit CLI mode: `... review "src/**/*.tsx"`. Dynamic import so the
+    // MCP/SDK path is never touched; MCP hosts launch with zero args, so plain
+    // startup is unchanged.
+    import("./review-cli.js")
+        .then(({ runReviewCli }) => runReviewCli(argv.slice(1)))
+        .then((code) => {
+        process.exitCode = code;
+    })
+        .catch((err) => {
+        process.stderr.write(`Fatal: ${err.message}\n`);
+        process.exit(2);
+    });
+}
+else if (argv[0] === "verify") {
+    import("./verify-cli.js")
+        .then(({ runVerifyCli }) => runVerifyCli(argv.slice(1)))
+        .then((code) => {
+        process.exitCode = code;
+    })
+        .catch((err) => {
+        process.stderr.write(`Fatal: ${err.message}\n`);
+        process.exit(2);
+    });
+}
+else {
+    main().catch((err) => {
+        process.stderr.write(`Fatal: ${err.message}\n`);
+        process.exit(1);
+    });
+}

package/dist/review-cli.d.ts

@@ -0,0 +1,4 @@
+/** Expand one glob pattern (posix-style separators) relative to cwd. */
+export declare function expandPattern(pattern: string, cwd: string): string[];
+export declare function expandPatterns(patterns: string[], cwd: string): string[];
+export declare function runReviewCli(args: string[], out?: NodeJS.WritableStream, err?: NodeJS.WritableStream): Promise<0 | 1 | 2>;

package/dist/review-cli.js

@@ -0,0 +1,131 @@
+// `review` subcommand: the review_screen design audit as a CI gate.
+//
+//   npx @venlyfinance/settlement-mcp review "src/**/*.tsx"
+//
+// Exit codes: 0 clean (warnings allowed, printed either way) · 1 at least one
+// error-severity finding · 2 usage error or a pattern that matched nothing
+// (a typo'd path must never pass CI silently).
+//
+// Patterns are self-expanded (**, *, {a,b}) so the quoted form works on any
+// shell; unquoted shell-expanded literal paths work too. No dependencies.
+// (Line comments on purpose: a glob's **/ would terminate a block comment.)
+import { readdirSync, readFileSync, statSync, existsSync } from "node:fs";
+import { join, relative } from "node:path";
+import { reviewScreenSource } from "./frontend.js";
+const SKIP_DIRS = new Set(["node_modules", ".git", "dist"]);
+function braceExpand(pattern) {
+    const m = /\{([^{}]*)\}/.exec(pattern);
+    if (!m)
+        return [pattern];
+    const before = pattern.slice(0, m.index);
+    const after = pattern.slice(m.index + m[0].length);
+    const out = [];
+    for (const option of m[1].split(",")) {
+        out.push(...braceExpand(before + option + after));
+    }
+    return out;
+}
+function patternToRegExp(pattern) {
+    // Escape everything regex-special except the glob characters we translate.
+    const escaped = pattern.replace(/[.+^$()|[\]\\?]/g, "\\$&");
+    const translated = escaped
+        .replace(/\*\*\//g, "\u0000") // **/ may match zero segments
+        .replace(/\*\*/g, "\u0001") // a bare ** matches anything
+        .replace(/\*/g, "[^/]*")
+        .replace(/\u0000/g, "(?:.*/)?")
+        .replace(/\u0001/g, ".*");
+    return new RegExp(`^${translated}$`);
+}
+function walk(dir, into) {
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (entry.isDirectory()) {
+            if (!SKIP_DIRS.has(entry.name))
+                walk(join(dir, entry.name), into);
+        }
+        else if (entry.isFile()) {
+            into.push(join(dir, entry.name));
+        }
+    }
+}
+/** Expand one glob pattern (posix-style separators) relative to cwd. */
+export function expandPattern(pattern, cwd) {
+    const results = [];
+    for (const variant of braceExpand(pattern)) {
+        const segments = variant.split("/");
+        const firstWild = segments.findIndex((s) => s.includes("*"));
+        if (firstWild === -1) {
+            if (existsSync(join(cwd, variant)) && statSync(join(cwd, variant)).isFile()) {
+                results.push(variant);
+            }
+            continue;
+        }
+        const staticPrefix = segments.slice(0, firstWild).join("/");
+        const root = staticPrefix ? join(cwd, staticPrefix) : cwd;
+        const files = [];
+        walk(root, files);
+        const matcher = patternToRegExp(variant);
+        for (const file of files) {
+            // relative(), not string slicing: a pattern like "../ui/**/*.tsx"
+            // walks outside cwd, where prefix slicing produces garbage.
+            const rel = relative(cwd, file).split("\\").join("/");
+            if (matcher.test(rel))
+                results.push(rel);
+        }
+    }
+    return [...new Set(results)].sort();
+}
+export function expandPatterns(patterns, cwd) {
+    const out = [];
+    for (const pattern of patterns) {
+        if (/[*{]/.test(pattern)) {
+            out.push(...expandPattern(pattern.split("\\").join("/"), cwd));
+        }
+        else {
+            out.push(pattern); // shell-expanded or literal; existence checked by caller
+        }
+    }
+    return [...new Set(out)];
+}
+export async function runReviewCli(args, out = process.stdout, err = process.stderr) {
+    const patterns = args.filter((a) => !a.startsWith("-"));
+    if (patterns.length === 0) {
+        err.write('Usage: review "<glob>" [more globs or files]\n' +
+            '  e.g. review "src/**/*.tsx"\n' +
+            "Exits 1 on any error-severity finding, 2 when nothing matched.\n");
+        return 2;
+    }
+    const cwd = process.cwd();
+    const files = expandPatterns(patterns, cwd);
+    const missing = files.filter((f) => !existsSync(f));
+    if (missing.length > 0) {
+        err.write(`No such file: ${missing.join(", ")}\n`);
+        return 2;
+    }
+    if (files.length === 0) {
+        err.write(`Nothing matched: ${patterns.join(" ")}\n`);
+        return 2;
+    }
+    let errors = 0;
+    let warnings = 0;
+    for (const file of files) {
+        const findings = reviewScreenSource(readFileSync(file, "utf8"));
+        for (const finding of findings) {
+            if (finding.severity === "error")
+                errors++;
+            else
+                warnings++;
+            const line = finding.line === undefined ? "" : `:${finding.line}`;
+            out.write(`${file}${line}  ${finding.severity}  ${finding.rule}  ${finding.evidence}\n`);
+            out.write(`  fix: ${finding.fix}\n`);
+        }
+    }
+    out.write(`${errors} error(s), ${warnings} warning(s) across ${files.length} file(s)\n`);
+    return errors > 0 ? 1 : 0;
+}

package/dist/server.js

@@ -4,7 +4,7 @@
  * mock client and no network.
  */
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { ENVIRONMENT_FLAG, SERVER_NAME, SERVER_VERSION, resolveVenlyEnvironment, } from "./constants.js";
+import { ENVIRONMENT_FLAG, INSTRUCTIONS, SERVER_NAME, SERVER_VERSION, resolveVenlyEnvironment, } from "./constants.js";
 import { registerReadTools } from "./tools/read-tools.js";
 import { registerWriteTools } from "./tools/write-tools.js";
 import { registerX402Tools } from "./tools/x402-tools.js";
@@ -26,6 +26,8 @@ export function createServer(options) {
     const server = new McpServer({
         name: SERVER_NAME,
         version: SERVER_VERSION,
+    }, {
+        instructions: INSTRUCTIONS,
     });
     registerReadTools(server, options.client);
     registerWriteTools(server, options.client, env);

package/dist/staging-smoke.d.ts

@@ -1,4 +1,4 @@
-export declare const EXPECTED_TOOLS: readonly ["list_ramp_requests", "get_ramp_request", "list_accounts", "get_account", "list_wallets", "list_virtual_bank_accounts", "get_virtual_bank_account", "reconcile_by_reference_code", "list_transfers", "get_transfer", "list_parties", "get_party", "get_reference_data", "create_party", "create_account", "create_virtual_bank_account", "create_fiat_transfer", "create_crypto_transfer", "approve_ramp_request", "reject_ramp_request", "create_payment_session", "list_payouts", "get_payout", "list_payout_routes", "list_payout_bank_accounts", "register_payout_bank_account", "create_payout_route", "prepare_payout_ownership_proof", "complete_payout_ownership_proof", "request_payout", "quote_x402_payment", "get_journey_blueprint", "review_screen"];
+export declare const EXPECTED_TOOLS: readonly ["list_ramp_requests", "get_ramp_request", "list_accounts", "get_account", "list_wallets", "list_virtual_bank_accounts", "get_virtual_bank_account", "reconcile_by_reference_code", "list_transfers", "get_transfer", "list_parties", "get_party", "get_reference_data", "create_party", "create_account", "create_virtual_bank_account", "create_fiat_transfer", "create_crypto_transfer", "approve_ramp_request", "reject_ramp_request", "create_payment_session", "list_payouts", "get_payout", "list_payout_routes", "list_payout_bank_accounts", "register_payout_bank_account", "create_payout_route", "prepare_payout_ownership_proof", "complete_payout_ownership_proof", "request_payout", "quote_x402_payment", "get_journey_blueprint", "verify_runtime_contract", "review_screen"];
 export declare const EXPECTED_RESOURCE_URIS: readonly ["venly://capabilities", "venly://safety", "venly://workflows/international-account", "venly://workflows/mock-to-staging", "venly://frontend/agents"];
 export declare const EXPECTED_PROMPTS: readonly ["build_international_account"];
 export interface DiscoveryNames {

package/dist/staging-smoke.js

@@ -36,6 +36,7 @@ export const EXPECTED_TOOLS = [
     "request_payout",
     "quote_x402_payment",
     "get_journey_blueprint",
+    "verify_runtime_contract",
     "review_screen",
 ];
 export const EXPECTED_RESOURCE_URIS = [

package/dist/verify-cli.d.ts

@@ -0,0 +1,24 @@
+export type VerifyProfile = "direct-sdk" | "backend-proxy";
+export interface VerifySourceFile {
+    path: string;
+    source: string;
+}
+export interface VerifyFinding {
+    rule: string;
+    severity: "error" | "warn";
+    path: string;
+    evidence: string;
+    fix: string;
+    line?: number;
+}
+export interface VerifyResult {
+    profile: VerifyProfile;
+    findings: VerifyFinding[];
+    summary: string;
+}
+export declare function verifyRuntimeContract(options: {
+    files: VerifySourceFile[];
+    packageJson: Record<string, unknown>;
+    profile?: VerifyProfile;
+}): VerifyResult;
+export declare function runVerifyCli(args: string[], out?: NodeJS.WritableStream, err?: NodeJS.WritableStream): Promise<0 | 1 | 2>;

package/dist/verify-cli.js

@@ -0,0 +1,371 @@
+// `verify` subcommand: deterministic runtime-contract checks for generated apps.
+//
+// Exit codes: 0 clean (warnings allowed) · 1 at least one error · 2 usage or
+// no-match. The three unresolved false-positive boundaries intentionally warn:
+// missing React in direct-sdk, app-owned money routes, and in-memory stores.
+import { existsSync, readFileSync, readdirSync, statSync, } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+const BLUEPRINT_HOOKS = new Set([
+    "useAccount",
+    "useAccounts",
+    "useBankAccountConfig",
+    "useCompanyBankAccounts",
+    "useCreateAccount",
+    "useCreateCompanyBankAccount",
+    "useCreateParty",
+    "useCreateRampRequest",
+    "useFeeQuote",
+    "useFourEyesApproval",
+    "useInitiateRamp",
+    "useParty",
+    "useRampLifecycle",
+    "useRampPairs",
+    "useRampRequest",
+    "useRampRequests",
+    "useReferenceData",
+    "useStagedTransfer",
+    "useTransfers",
+    "useVirtualBankAccounts",
+    "useWallets",
+]);
+function lineFor(source, index) {
+    return source.slice(0, index).split("\n").length;
+}
+function suppressed(source, rule, line) {
+    const token = `venly-allow:${rule}`;
+    if (line === undefined)
+        return source.includes(token);
+    const lines = source.split("\n");
+    return Boolean(lines[line - 1]?.includes(token) || lines[line - 2]?.includes(token));
+}
+function dependencies(packageJson) {
+    return Object.assign({}, packageJson.dependencies ?? {}, packageJson.devDependencies ?? {}, packageJson.peerDependencies ?? {});
+}
+function importsFrom(source, packageName) {
+    const names = [];
+    const expression = new RegExp(`import\\s*\\{([^}]*)\\}\\s*from\\s*["']${packageName.replaceAll("/", "\\/")}["']`, "g");
+    for (const match of source.matchAll(expression)) {
+        for (const item of (match[1] ?? "").split(",")) {
+            const name = item.trim().split(/\s+as\s+/)[0]?.trim();
+            if (name)
+                names.push(name);
+        }
+    }
+    return names;
+}
+function isServerFile(file) {
+    return (/(?:^|\/)(?:server|backend|api)(?:\/|\.)/i.test(file.path) ||
+        /(?:^|\/)route\.[cm]?[jt]sx?$/i.test(file.path) ||
+        /[.]server\.[cm]?[jt]sx?$/i.test(file.path) ||
+        /^\s*["']use server["'];?/m.test(file.source));
+}
+function isMoneyRoute(file) {
+    const routeHandler = /(?:^|\/)route\.[cm]?[jt]sx?$/i.test(file.path) ||
+        /export\s+(?:async\s+)?function\s+(?:GET|POST|PUT|PATCH|DELETE)\b/.test(file.source);
+    const moneySignal = /(?:transfers?|payouts?|balances?|ramps?|rampRequests|virtual[-_/ ]bank)/i.test(`${file.path}\n${file.source}`);
+    return routeHandler && moneySignal;
+}
+function autoDetectProfile(files) {
+    return files.some((file) => file.source.includes("proxyClientOptions") || isMoneyRoute(file))
+        ? "backend-proxy"
+        : "direct-sdk";
+}
+export function verifyRuntimeContract(options) {
+    const { files, packageJson } = options;
+    const profile = options.profile ?? autoDetectProfile(files);
+    const deps = dependencies(packageJson);
+    const findings = [];
+    function addProjectFinding(finding) {
+        const source = files.map((file) => file.source).join("\n");
+        if (!suppressed(source, finding.rule)) {
+            findings.push({ ...finding, path: "package.json" });
+        }
+    }
+    function addSourceFinding(file, finding) {
+        if (!suppressed(file.source, finding.rule, finding.line)) {
+            findings.push({ ...finding, path: file.path });
+        }
+    }
+    if (!("@venlyfinance/react" in deps) && !("@venlyfinance/sdk" in deps)) {
+        addProjectFinding({
+            rule: "venly-package-missing",
+            severity: "error",
+            evidence: "package.json declares zero @venlyfinance runtime packages",
+            fix: "Install the registry block for the journey or add the required @venlyfinance package.",
+        });
+    }
+    if (profile === "direct-sdk") {
+        if (!("@venlyfinance/react" in deps)) {
+            addProjectFinding({
+                rule: "react-package-missing",
+                severity: "warn",
+                evidence: "direct-sdk profile has no @venlyfinance/react dependency",
+                fix: "Install the journey's registry block, or suppress this warning for an intentionally headless integration.",
+            });
+        }
+        const providerImported = files.some((file) => importsFrom(file.source, "@venlyfinance/react").includes("VenlyProvider"));
+        const mockProviderRendered = files.some((file) => /<VenlyProvider\b[^>]*\benvironment\s*=\s*(?:["']mock["']|\{[^}]+\})/s.test(file.source));
+        if (!providerImported || !mockProviderRendered) {
+            addProjectFinding({
+                rule: "provider-missing",
+                severity: "error",
+                evidence: "no VenlyProvider import and mock/environment expression wrapper were found",
+                fix: 'Import VenlyProvider from @venlyfinance/react and wrap the tree with environment="mock".',
+            });
+        }
+        const importedHooks = files.flatMap((file) => importsFrom(file.source, "@venlyfinance/react").filter((name) => BLUEPRINT_HOOKS.has(name)));
+        if (importedHooks.length === 0) {
+            addProjectFinding({
+                rule: "blueprint-hook-missing",
+                severity: "error",
+                evidence: "no journey-blueprint hook is imported from @venlyfinance/react",
+                fix: "Use the qualified hooks named by get_journey_blueprint instead of rebuilding the data layer.",
+            });
+        }
+        for (const file of files) {
+            if (!/(?:@venlyfinance\/react|["']react["']|["']use client["'])/.test(file.source))
+                continue;
+            for (const match of file.source.matchAll(/\bclientSecret\b/g)) {
+                addSourceFinding(file, {
+                    rule: "browser-client-secret",
+                    severity: "error",
+                    line: lineFor(file.source, match.index ?? 0),
+                    evidence: "clientSecret appears in browser/React source",
+                    fix: "Keep secrets server-side; use proxyClientOptions() for browser traffic.",
+                });
+            }
+        }
+    }
+    else {
+        if (!("@venlyfinance/sdk" in deps)) {
+            addProjectFinding({
+                rule: "sdk-package-missing",
+                severity: "error",
+                evidence: "backend-proxy profile has no @venlyfinance/sdk dependency",
+                fix: "Add @venlyfinance/sdk and make money routes wrap the official client.",
+            });
+        }
+        for (const file of files) {
+            if (isMoneyRoute(file) && !/from\s*["']@venlyfinance\/sdk["']/.test(file.source)) {
+                addSourceFinding(file, {
+                    rule: "money-route-without-sdk",
+                    severity: "warn",
+                    line: 1,
+                    evidence: "money-route heuristic matched but no @venlyfinance/sdk import was found",
+                    fix: "Wrap this route with @venlyfinance/sdk, or suppress if it is an unrelated consumer-owned ledger.",
+                });
+            }
+            if (!isServerFile(file)) {
+                for (const match of file.source.matchAll(/\bclientSecret\b/g)) {
+                    addSourceFinding(file, {
+                        rule: "client-secret-outside-server",
+                        severity: "error",
+                        line: lineFor(file.source, match.index ?? 0),
+                        evidence: "clientSecret appears outside a server-only file",
+                        fix: "Move the secret into a server route or server-only module.",
+                    });
+                }
+            }
+        }
+        const proxyImported = files.some((file) => importsFrom(file.source, "@venlyfinance/react").includes("proxyClientOptions"));
+        if (!proxyImported) {
+            addProjectFinding({
+                rule: "proxy-client-options-missing",
+                severity: "warn",
+                evidence: "backend-proxy profile has no browser-side proxyClientOptions import",
+                fix: "Use proxyClientOptions() in the browser provider, or suppress for a server-only consumer.",
+            });
+        }
+    }
+    for (const file of files) {
+        if (/\buseEffect\b/.test(file.source) &&
+            /\bset(?:Interval|Timeout)\b/.test(file.source) &&
+            /(?:status|state)/i.test(file.source) &&
+            /\b(?:transfer|ramp)/i.test(file.source)) {
+            const match = /\buseEffect\b/.exec(file.source);
+            addSourceFinding(file, {
+                rule: "status-polling",
+                severity: "warn",
+                line: lineFor(file.source, match?.index ?? 0),
+                evidence: "useEffect timer polling appears beside transfer/ramp state",
+                fix: "Use useStagedTransfer or useRampLifecycle for lifecycle polling.",
+            });
+        }
+        const store = /(?:^|\n)\s*export\s+(?:const|let)\s+(transfers|balances|payouts|rampRequests)\s*=\s*(?:\[|new\s+(?:Map|Set)\b)/g;
+        for (const match of file.source.matchAll(store)) {
+            addSourceFinding(file, {
+                rule: "in-memory-money-store",
+                severity: "warn",
+                line: lineFor(file.source, match.index ?? 0),
+                evidence: `module exports mutable in-memory money state named ${match[1]}`,
+                fix: "Use @venlyfinance/react hooks/flows or the SDK; suppress only for a deliberate fixture.",
+            });
+        }
+    }
+    findings.sort((a, b) => a.path.localeCompare(b.path) ||
+        (a.line ?? 0) - (b.line ?? 0) ||
+        a.rule.localeCompare(b.rule));
+    const errors = findings.filter((finding) => finding.severity === "error").length;
+    const warnings = findings.length - errors;
+    return {
+        profile,
+        findings,
+        summary: `${errors} error(s), ${warnings} warning(s) across ${files.length} file(s)`,
+    };
+}
+const SKIP_DIRS = new Set(["node_modules", ".git", "dist"]);
+function braceExpand(pattern) {
+    const match = /\{([^{}]*)\}/.exec(pattern);
+    if (!match)
+        return [pattern];
+    const before = pattern.slice(0, match.index);
+    const after = pattern.slice(match.index + match[0].length);
+    return (match[1] ?? "").split(",").flatMap((option) => braceExpand(before + option + after));
+}
+function patternToRegExp(pattern) {
+    const escaped = pattern.replace(/[.+^$()|[\]\\?]/g, "\\$&");
+    const translated = escaped
+        .replace(/\*\*\//g, "\u0000")
+        .replace(/\*\*/g, "\u0001")
+        .replace(/\*/g, "[^/]*")
+        .replace(/\u0000/g, "(?:.*/)?")
+        .replace(/\u0001/g, ".*");
+    return new RegExp(`^${translated}$`);
+}
+function walk(dir, into) {
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (entry.isDirectory()) {
+            if (!SKIP_DIRS.has(entry.name))
+                walk(join(dir, entry.name), into);
+        }
+        else if (entry.isFile()) {
+            into.push(join(dir, entry.name));
+        }
+    }
+}
+function expandPattern(pattern, cwd) {
+    const results = [];
+    for (const variant of braceExpand(pattern)) {
+        const segments = variant.split("/");
+        const firstWild = segments.findIndex((segment) => segment.includes("*"));
+        if (firstWild === -1) {
+            if (existsSync(join(cwd, variant)) && statSync(join(cwd, variant)).isFile())
+                results.push(variant);
+            continue;
+        }
+        const staticPrefix = segments.slice(0, firstWild).join("/");
+        const root = staticPrefix ? join(cwd, staticPrefix) : cwd;
+        const files = [];
+        walk(root, files);
+        const matcher = patternToRegExp(variant);
+        for (const file of files) {
+            const rel = relative(cwd, file).split("\\").join("/");
+            if (matcher.test(rel))
+                results.push(rel);
+        }
+    }
+    return [...new Set(results)].sort();
+}
+function expandPatterns(patterns, cwd) {
+    return [...new Set(patterns.flatMap((pattern) => expandPattern(pattern, cwd)))];
+}
+function findPackageJson(file, cwd) {
+    let dir = dirname(resolve(cwd, file));
+    while (true) {
+        const candidate = join(dir, "package.json");
+        if (existsSync(candidate))
+            return candidate;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+}
+function parseArgs(args) {
+    const patterns = [];
+    let profile;
+    for (let index = 0; index < args.length; index++) {
+        const arg = args[index] ?? "";
+        if (arg === "--profile") {
+            const value = args[++index];
+            if (value !== "direct-sdk" && value !== "backend-proxy") {
+                return { patterns, error: "--profile must be direct-sdk or backend-proxy" };
+            }
+            profile = value;
+        }
+        else if (arg.startsWith("--profile=")) {
+            const value = arg.slice("--profile=".length);
+            if (value !== "direct-sdk" && value !== "backend-proxy") {
+                return { patterns, error: "--profile must be direct-sdk or backend-proxy" };
+            }
+            profile = value;
+        }
+        else if (arg.startsWith("-")) {
+            return { patterns, error: `Unknown option: ${arg}` };
+        }
+        else {
+            patterns.push(arg);
+        }
+    }
+    return { patterns, profile };
+}
+export async function runVerifyCli(args, out = process.stdout, err = process.stderr) {
+    const parsed = parseArgs(args);
+    if (parsed.error || parsed.patterns.length === 0) {
+        if (parsed.error)
+            err.write(`${parsed.error}\n`);
+        err.write('Usage: verify [--profile direct-sdk|backend-proxy] "<glob>" [more globs or files]\n' +
+            '  e.g. verify "src/**/*.{ts,tsx}"\n' +
+            "Exits 1 on any error-severity finding, 2 when nothing matched.\n");
+        return 2;
+    }
+    const cwd = process.cwd();
+    const files = expandPatterns(parsed.patterns, cwd);
+    if (files.length === 0) {
+        err.write(`Nothing matched: ${parsed.patterns.join(" ")}\n`);
+        return 2;
+    }
+    const groups = new Map();
+    for (const file of files) {
+        const packagePath = findPackageJson(file, cwd) ?? join(cwd, "package.json");
+        groups.set(packagePath, [...(groups.get(packagePath) ?? []), file]);
+    }
+    let errors = 0;
+    let warnings = 0;
+    for (const [packagePath, groupFiles] of [...groups.entries()].sort()) {
+        let packageJson = {};
+        if (existsSync(packagePath)) {
+            try {
+                packageJson = JSON.parse(readFileSync(packagePath, "utf8"));
+            }
+            catch (error) {
+                err.write(`Invalid package.json at ${relative(cwd, packagePath)}: ${error.message}\n`);
+                return 2;
+            }
+        }
+        const result = verifyRuntimeContract({
+            files: groupFiles.map((path) => ({ path, source: readFileSync(path, "utf8") })),
+            packageJson,
+            profile: parsed.profile,
+        });
+        out.write(`profile: ${result.profile}\n`);
+        for (const finding of result.findings) {
+            if (finding.severity === "error")
+                errors++;
+            else
+                warnings++;
+            const line = finding.line === undefined ? "" : `:${finding.line}`;
+            out.write(`${finding.path}${line}  ${finding.severity}  ${finding.rule}  ${finding.evidence}\n`);
+            out.write(`  fix: ${finding.fix}\n`);
+        }
+    }
+    out.write(`${errors} error(s), ${warnings} warning(s) across ${files.length} file(s)\n`);
+    return errors > 0 ? 1 : 0;
+}

package/package.json

@@ -1,17 +1,19 @@
 {
   "name": "@venlyfinance/settlement-mcp",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Venly Finance MCP: SDK-backed tools, resources and prompts for building international money products safely.",
   "type": "module",
   "bin": {
     "venly-finance-mcp": "dist/index.js",
-    "venly-settlement-mcp": "dist/index.js"
+    "venly-settlement-mcp": "dist/index.js",
+    "settlement-mcp": "dist/index.js"
   },
   "main": "dist/index.js",
   "files": [
     "dist",
     "scripts",
     "skills",
+    "AGENTS.md",
     "README.md",
     "CHANGELOG.md"
   ],
@@ -27,7 +29,7 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@venlyfinance/sdk": "^0.4.0",
+    "@venlyfinance/sdk": "^0.5.0",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "zod": "^3.23.8"
   },
@@ -60,4 +62,4 @@
     "eur",
     "viban"
   ]
-}
+}