@veyanet/mcp 1.0.0

package/dist/index.js

@@ -0,0 +1,444 @@
+// src/config.ts
+var MCP_SERVICE_NAME = "@veyanet/mcp";
+var MCP_SERVICE_VERSION = "1.0.0";
+function loadConfig() {
+  const mcpApiKey = process.env.MCP_API_KEY?.trim() || null;
+  const relayer = process.env.VEYA_RELAYER_PRIVATE_KEY?.trim() || process.env.VEYA_DEPLOYER_PRIVATE_KEY?.trim() || null;
+  return {
+    port: Number(process.env.PORT || 8788),
+    host: process.env.HOST || "0.0.0.0",
+    publicMcpUrl: (process.env.PUBLIC_MCP_URL || "https://mcp.veyanet.tech/mcp").replace(/\/$/, ""),
+    chainId: Number(process.env.ROBINHOOD_CHAIN_ID || 46630),
+    rpcUrl: process.env.ROBINHOOD_RPC_URL || "https://rpc.testnet.chain.robinhood.com",
+    explorerUrl: process.env.ROBINHOOD_EXPLORER_URL || "https://explorer.testnet.chain.robinhood.com",
+    contractAddress: process.env.VEYA_CONTRACT_ADDRESS || "0x1a1Dc3c55550FCE9F70ef6cDEeF967c0b72a5d84",
+    apiUrl: (process.env.VEYA_API_URL || "https://api.veyanet.tech").replace(/\/$/, ""),
+    mcpApiKey,
+    relayerPrivateKey: relayer,
+    corsOrigins: (process.env.CORS_ORIGIN || "").split(",").map((s) => s.trim()).filter(Boolean),
+    nodeEnv: process.env.NODE_ENV || "development"
+  };
+}
+function writesEnabled(cfg) {
+  return Boolean(cfg.mcpApiKey && cfg.relayerPrivateKey);
+}
+
+// src/server.ts
+import { AsyncLocalStorage } from "async_hooks";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+
+// src/tools/public.ts
+import { z } from "zod";
+
+// src/sdk.ts
+import { VeyaClient } from "@veyanet/sdk";
+function createReadClient(cfg) {
+  return new VeyaClient({
+    rpcUrl: cfg.rpcUrl,
+    contractAddress: cfg.contractAddress,
+    chainId: cfg.chainId,
+    explorerUrl: cfg.explorerUrl
+  });
+}
+function createWriteClient(cfg) {
+  if (!cfg.relayerPrivateKey) {
+    throw new Error("VEYA_RELAYER_PRIVATE_KEY required for write tools");
+  }
+  return new VeyaClient({
+    rpcUrl: cfg.rpcUrl,
+    contractAddress: cfg.contractAddress,
+    chainId: cfg.chainId,
+    explorerUrl: cfg.explorerUrl,
+    payerPrivateKey: cfg.relayerPrivateKey
+  });
+}
+function parseHexBytes(value, expectedLen) {
+  const hex = value.trim().replace(/^0x/, "");
+  if (!/^[0-9a-fA-F]*$/.test(hex) || hex.length % 2 !== 0) {
+    throw new Error("Expected even-length hex string");
+  }
+  const buf = Buffer.from(hex, "hex");
+  if (expectedLen !== void 0 && buf.length !== expectedLen) {
+    throw new Error(`Expected ${expectedLen} bytes, got ${buf.length}`);
+  }
+  return Uint8Array.from(buf);
+}
+
+// src/tools/public.ts
+function registerPublicTools(server, cfg) {
+  server.tool(
+    "veya_describe",
+    "Honesty card: what this MCP is (AES sealed elsewhere, testnet 46630, not FHE/mainnet)",
+    {},
+    async () => ({
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify(
+            {
+              name: MCP_SERVICE_NAME,
+              version: MCP_SERVICE_VERSION,
+              publicUrl: cfg.publicMcpUrl,
+              settlement: {
+                network: "Robinhood Chain testnet",
+                chainId: cfg.chainId,
+                contract: cfg.contractAddress,
+                explorer: cfg.explorerUrl,
+                rpc: cfg.rpcUrl
+              },
+              productApi: cfg.apiUrl,
+              sealed: "AES-256-GCM sealed-node (not FHE; TFHE is Phase 4)",
+              mainnet: "Not a VEYA settlement claim (Phase 3)",
+              writes: "Require Authorization: Bearer <MCP_API_KEY> when enabled on the server",
+              stdioSibling: "Local stdio MCP remains at veya-anchor/packages/mcp (operators)"
+            },
+            null,
+            2
+          )
+        }
+      ]
+    })
+  );
+  server.tool(
+    "veya_ping_chain",
+    "Ping Robinhood Chain RPC \u2014 chain id, block, contract",
+    {},
+    async () => {
+      const client = createReadClient(cfg);
+      const ping = await client.pingChain();
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify(
+              {
+                ...ping,
+                chainId: ping.chainId.toString(),
+                expectedChainId: cfg.chainId,
+                config: client.describe()
+              },
+              null,
+              2
+            )
+          }
+        ]
+      };
+    }
+  );
+  server.tool(
+    "veya_hash_blake3",
+    "Compute BLAKE3 hex digest (commitment helper)",
+    { data: z.string().min(1) },
+    async ({ data }) => {
+      const client = createReadClient(cfg);
+      const hash = await client.hashBlake3(data);
+      return {
+        content: [{ type: "text", text: JSON.stringify({ hash }, null, 2) }]
+      };
+    }
+  );
+  server.tool(
+    "veya_verify_transaction",
+    "Verify a Veya.sol commitment from a Robinhood Chain tx hash",
+    { txHash: z.string().min(66) },
+    async ({ txHash }) => {
+      const client = createReadClient(cfg);
+      const result = await client.verifyTransaction(txHash);
+      return {
+        content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+      };
+    }
+  );
+  server.tool(
+    "veya_api_health",
+    "Probe the public VEYA API /health (api.veyanet.tech) \u2014 honest degraded when fleet down",
+    {},
+    async () => {
+      const res = await fetch(`${cfg.apiUrl}/health`, {
+        signal: AbortSignal.timeout(8e3)
+      });
+      const body = await res.json().catch(() => ({}));
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({ httpStatus: res.status, body }, null, 2)
+          }
+        ]
+      };
+    }
+  );
+}
+
+// src/tools/write.ts
+import { z as z2 } from "zod";
+
+// src/auth.ts
+function extractBearer(req) {
+  const h = req.header("authorization") || req.header("Authorization");
+  if (!h) return null;
+  const m = /^Bearer\s+(.+)$/i.exec(h.trim());
+  return m?.[1]?.trim() || null;
+}
+function assertWriteAuthorized(cfg, bearer) {
+  if (!cfg.mcpApiKey) {
+    throw new Error(
+      "Write tools disabled on this server (set MCP_API_KEY + VEYA_RELAYER_PRIVATE_KEY)"
+    );
+  }
+  if (!bearer || bearer !== cfg.mcpApiKey) {
+    throw new Error("Unauthorized: provide Authorization: Bearer <MCP_API_KEY>");
+  }
+  if (!cfg.relayerPrivateKey) {
+    throw new Error("Write tools disabled: VEYA_RELAYER_PRIVATE_KEY not configured");
+  }
+}
+
+// src/tools/write.ts
+function registerWriteTools(server, cfg, getBearer) {
+  if (!writesEnabled(cfg)) {
+    server.tool(
+      "veya_writes_status",
+      "Reports that on-chain write tools are disabled on this server",
+      {},
+      async () => ({
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              writesEnabled: false,
+              reason: "Set MCP_API_KEY and VEYA_RELAYER_PRIVATE_KEY to enable write tools"
+            })
+          }
+        ]
+      })
+    );
+    return;
+  }
+  function requireAuth() {
+    assertWriteAuthorized(cfg, getBearer());
+  }
+  server.tool(
+    "veya_store_commitment",
+    "Write a 32-byte commitment to Veya.sol (requires MCP_API_KEY). Use content Use stamps prefer product-site + API.",
+    {
+      environmentUuidHex: z2.string().min(32),
+      commitmentHex: z2.string().min(64)
+    },
+    async ({ environmentUuidHex, commitmentHex }) => {
+      requireAuth();
+      const client = createWriteClient(cfg);
+      const txHash = await client.requireEvm().storeCommitment(
+        parseHexBytes(environmentUuidHex, 16),
+        parseHexBytes(commitmentHex, 32)
+      );
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({ txHash, explorer: client.explorerFor(txHash) }, null, 2)
+          }
+        ]
+      };
+    }
+  );
+  server.tool(
+    "veya_attest_execution",
+    "attestExecution on Veya.sol with ML-DSA bytes (requires MCP_API_KEY)",
+    {
+      environmentUuidHex: z2.string().min(32),
+      blake3HashHex: z2.string().min(64),
+      mldsaSigHex: z2.string().min(8)
+    },
+    async ({ environmentUuidHex, blake3HashHex, mldsaSigHex }) => {
+      requireAuth();
+      const client = createWriteClient(cfg);
+      const txHash = await client.requireEvm().attestExecution(
+        parseHexBytes(environmentUuidHex, 16),
+        parseHexBytes(blake3HashHex, 32),
+        parseHexBytes(mldsaSigHex)
+      );
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({ txHash, explorer: client.explorerFor(txHash) }, null, 2)
+          }
+        ]
+      };
+    }
+  );
+  server.tool(
+    "veya_register_environment",
+    "registerEnvironment on Veya.sol (requires MCP_API_KEY)",
+    {
+      environmentUuidHex: z2.string().min(32),
+      pqPubkeyHashHex: z2.string().min(64),
+      envType: z2.number().int().min(0).max(10).default(0)
+    },
+    async ({ environmentUuidHex, pqPubkeyHashHex, envType }) => {
+      requireAuth();
+      const client = createWriteClient(cfg);
+      const txHash = await client.requireEvm().registerEnvironment(
+        parseHexBytes(environmentUuidHex, 16),
+        parseHexBytes(pqPubkeyHashHex, 32),
+        envType
+      );
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({ txHash, explorer: client.explorerFor(txHash) }, null, 2)
+          }
+        ]
+      };
+    }
+  );
+}
+
+// src/server.ts
+var requestAuth = new AsyncLocalStorage();
+function createMcpServer(cfg) {
+  const server = new McpServer({
+    name: MCP_SERVICE_NAME,
+    version: MCP_SERVICE_VERSION
+  });
+  registerPublicTools(server, cfg);
+  registerWriteTools(server, cfg, () => requestAuth.getStore()?.bearer ?? null);
+  return server;
+}
+
+// src/http.ts
+import express from "express";
+import cors from "cors";
+import { randomUUID } from "crypto";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+function createHttpApp(cfg = loadConfig()) {
+  const app = express();
+  app.use(express.json({ limit: "1mb" }));
+  app.use(
+    cors({
+      origin(origin, cb) {
+        if (!origin) return cb(null, true);
+        if (cfg.corsOrigins.length === 0) return cb(null, false);
+        if (cfg.corsOrigins.includes(origin)) return cb(null, true);
+        return cb(null, false);
+      },
+      credentials: true
+    })
+  );
+  app.get("/health", (_req, res) => {
+    res.json({
+      status: "ok",
+      service: MCP_SERVICE_NAME,
+      version: MCP_SERVICE_VERSION,
+      publicMcpUrl: cfg.publicMcpUrl,
+      chainId: cfg.chainId,
+      contractAddress: cfg.contractAddress,
+      writesEnabled: writesEnabled(cfg),
+      sealed: "AES-256-GCM (not FHE)",
+      settlement: "Robinhood Chain testnet 46630"
+    });
+  });
+  app.post("/mcp", async (req, res) => {
+    const bearer = extractBearer(req);
+    await requestAuth.run({ bearer }, async () => {
+      try {
+        const server = createMcpServer(cfg);
+        const transport = new StreamableHTTPServerTransport({
+          sessionIdGenerator: void 0
+        });
+        await server.connect(transport);
+        await transport.handleRequest(req, res, req.body);
+        res.on("close", () => {
+          void transport.close();
+          void server.close();
+        });
+      } catch (err) {
+        console.error("[veyanet/mcp] POST /mcp", err);
+        if (!res.headersSent) {
+          res.status(500).json({
+            jsonrpc: "2.0",
+            error: { code: -32603, message: "Internal server error" },
+            id: null
+          });
+        }
+      }
+    });
+  });
+  const sessions = /* @__PURE__ */ new Map();
+  app.post("/mcp/session", async (req, res) => {
+    const bearer = extractBearer(req);
+    await requestAuth.run({ bearer }, async () => {
+      try {
+        const sessionId = req.header("mcp-session-id") || void 0;
+        if (sessionId && sessions.has(sessionId)) {
+          await sessions.get(sessionId).handleRequest(req, res, req.body);
+          return;
+        }
+        if (!sessionId && isInitializeRequest(req.body)) {
+          const transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: () => randomUUID(),
+            onsessioninitialized: (id) => {
+              sessions.set(id, transport);
+            }
+          });
+          transport.onclose = () => {
+            if (transport.sessionId) sessions.delete(transport.sessionId);
+          };
+          const server = createMcpServer(cfg);
+          await server.connect(transport);
+          await transport.handleRequest(req, res, req.body);
+          return;
+        }
+        res.status(400).json({
+          jsonrpc: "2.0",
+          error: { code: -32e3, message: "No valid MCP session" },
+          id: null
+        });
+      } catch (err) {
+        console.error("[veyanet/mcp] POST /mcp/session", err);
+        if (!res.headersSent) {
+          res.status(500).json({
+            jsonrpc: "2.0",
+            error: { code: -32603, message: "Internal server error" },
+            id: null
+          });
+        }
+      }
+    });
+  });
+  app.get("/", (_req, res) => {
+    res.type("html").send(`<!doctype html>
+<html><head><meta charset="utf-8"/><title>VEYA MCP</title></head>
+<body style="font-family:system-ui;max-width:40rem;margin:2rem auto;line-height:1.5">
+  <h1>VEYA MCP</h1>
+  <p>Paste this URL into Claude / Cursor (Streamable HTTP):</p>
+  <pre>${cfg.publicMcpUrl}</pre>
+  <p>Local: <code>POST http://127.0.0.1:${cfg.port}/mcp</code></p>
+  <p>Health: <a href="/health">/health</a></p>
+  <p>Settlement: Robinhood testnet <strong>46630</strong> \xB7 Sealed = AES-256-GCM (not FHE) \xB7 Not mainnet.</p>
+  <p>Local stdio MCP for operators: <code>veya-anchor/packages/mcp</code></p>
+</body></html>`);
+  });
+  return app;
+}
+function startHttpServer(cfg = loadConfig()) {
+  const app = createHttpApp(cfg);
+  return app.listen(cfg.port, cfg.host, () => {
+    console.log(`[veyanet/mcp] listening on http://${cfg.host}:${cfg.port}`);
+    console.log(`[veyanet/mcp] MCP POST ${cfg.publicMcpUrl} (local /mcp)`);
+    console.log(`[veyanet/mcp] writesEnabled=${writesEnabled(cfg)}`);
+  });
+}
+export {
+  MCP_SERVICE_NAME,
+  MCP_SERVICE_VERSION,
+  createHttpApp,
+  createMcpServer,
+  loadConfig,
+  startHttpServer,
+  writesEnabled
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config.ts","../src/server.ts","../src/tools/public.ts","../src/sdk.ts","../src/tools/write.ts","../src/auth.ts","../src/http.ts"],"sourcesContent":["export type McpServiceConfig = {\r\n  port: number;\r\n  host: string;\r\n  publicMcpUrl: string;\r\n  chainId: number;\r\n  rpcUrl: string;\r\n  explorerUrl: string;\r\n  contractAddress: string;\r\n  apiUrl: string;\r\n  mcpApiKey: string | null;\r\n  relayerPrivateKey: string | null;\r\n  corsOrigins: string[];\r\n  nodeEnv: string;\r\n};\r\n\r\nexport const MCP_SERVICE_NAME = \"@veyanet/mcp\";\r\nexport const MCP_SERVICE_VERSION = \"1.0.0\";\r\n\r\nexport function loadConfig(): McpServiceConfig {\r\n  const mcpApiKey = process.env.MCP_API_KEY?.trim() || null;\r\n  const relayer =\r\n    process.env.VEYA_RELAYER_PRIVATE_KEY?.trim() ||\r\n    process.env.VEYA_DEPLOYER_PRIVATE_KEY?.trim() ||\r\n    null;\r\n\r\n  return {\r\n    port: Number(process.env.PORT || 8788),\r\n    host: process.env.HOST || \"0.0.0.0\",\r\n    publicMcpUrl: (process.env.PUBLIC_MCP_URL || \"https://mcp.veyanet.tech/mcp\").replace(/\\/$/, \"\"),\r\n    chainId: Number(process.env.ROBINHOOD_CHAIN_ID || 46630),\r\n    rpcUrl: process.env.ROBINHOOD_RPC_URL || \"https://rpc.testnet.chain.robinhood.com\",\r\n    explorerUrl:\r\n      process.env.ROBINHOOD_EXPLORER_URL || \"https://explorer.testnet.chain.robinhood.com\",\r\n    contractAddress:\r\n      process.env.VEYA_CONTRACT_ADDRESS || \"0x1a1Dc3c55550FCE9F70ef6cDEeF967c0b72a5d84\",\r\n    apiUrl: (process.env.VEYA_API_URL || \"https://api.veyanet.tech\").replace(/\\/$/, \"\"),\r\n    mcpApiKey,\r\n    relayerPrivateKey: relayer,\r\n    corsOrigins: (process.env.CORS_ORIGIN || \"\")\r\n      .split(\",\")\r\n      .map((s) => s.trim())\r\n      .filter(Boolean),\r\n    nodeEnv: process.env.NODE_ENV || \"development\",\r\n  };\r\n}\r\n\r\nexport function writesEnabled(cfg: McpServiceConfig): boolean {\r\n  return Boolean(cfg.mcpApiKey && cfg.relayerPrivateKey);\r\n}\r\n","import { AsyncLocalStorage } from \"node:async_hooks\";\r\nimport { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\r\nimport {\r\n  MCP_SERVICE_NAME,\r\n  MCP_SERVICE_VERSION,\r\n  type McpServiceConfig,\r\n} from \"./config.js\";\r\nimport { registerPublicTools } from \"./tools/public.js\";\r\nimport { registerWriteTools } from \"./tools/write.js\";\r\n\r\nexport const requestAuth = new AsyncLocalStorage<{ bearer: string | null }>();\r\n\r\nexport function createMcpServer(cfg: McpServiceConfig): McpServer {\r\n  const server = new McpServer({\r\n    name: MCP_SERVICE_NAME,\r\n    version: MCP_SERVICE_VERSION,\r\n  });\r\n\r\n  registerPublicTools(server, cfg);\r\n  registerWriteTools(server, cfg, () => requestAuth.getStore()?.bearer ?? null);\r\n\r\n  return server;\r\n}\r\n","import { z } from \"zod\";\r\nimport type { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\r\nimport { MCP_SERVICE_NAME, MCP_SERVICE_VERSION, type McpServiceConfig } from \"../config.js\";\r\nimport { createReadClient } from \"../sdk.js\";\r\n\r\nexport function registerPublicTools(server: McpServer, cfg: McpServiceConfig): void {\r\n  server.tool(\r\n    \"veya_describe\",\r\n    \"Honesty card: what this MCP is (AES sealed elsewhere, testnet 46630, not FHE/mainnet)\",\r\n    {},\r\n    async () => ({\r\n      content: [\r\n        {\r\n          type: \"text\",\r\n          text: JSON.stringify(\r\n            {\r\n              name: MCP_SERVICE_NAME,\r\n              version: MCP_SERVICE_VERSION,\r\n              publicUrl: cfg.publicMcpUrl,\r\n              settlement: {\r\n                network: \"Robinhood Chain testnet\",\r\n                chainId: cfg.chainId,\r\n                contract: cfg.contractAddress,\r\n                explorer: cfg.explorerUrl,\r\n                rpc: cfg.rpcUrl,\r\n              },\r\n              productApi: cfg.apiUrl,\r\n              sealed: \"AES-256-GCM sealed-node (not FHE; TFHE is Phase 4)\",\r\n              mainnet: \"Not a VEYA settlement claim (Phase 3)\",\r\n              writes: \"Require Authorization: Bearer <MCP_API_KEY> when enabled on the server\",\r\n              stdioSibling: \"Local stdio MCP remains at veya-anchor/packages/mcp (operators)\",\r\n            },\r\n            null,\r\n            2,\r\n          ),\r\n        },\r\n      ],\r\n    }),\r\n  );\r\n\r\n  server.tool(\r\n    \"veya_ping_chain\",\r\n    \"Ping Robinhood Chain RPC — chain id, block, contract\",\r\n    {},\r\n    async () => {\r\n      const client = createReadClient(cfg);\r\n      const ping = await client.pingChain();\r\n      return {\r\n        content: [\r\n          {\r\n            type: \"text\",\r\n            text: JSON.stringify(\r\n              {\r\n                ...ping,\r\n                chainId: ping.chainId.toString(),\r\n                expectedChainId: cfg.chainId,\r\n                config: client.describe(),\r\n              },\r\n              null,\r\n              2,\r\n            ),\r\n          },\r\n        ],\r\n      };\r\n    },\r\n  );\r\n\r\n  server.tool(\r\n    \"veya_hash_blake3\",\r\n    \"Compute BLAKE3 hex digest (commitment helper)\",\r\n    { data: z.string().min(1) },\r\n    async ({ data }) => {\r\n      const client = createReadClient(cfg);\r\n      const hash = await client.hashBlake3(data);\r\n      return {\r\n        content: [{ type: \"text\", text: JSON.stringify({ hash }, null, 2) }],\r\n      };\r\n    },\r\n  );\r\n\r\n  server.tool(\r\n    \"veya_verify_transaction\",\r\n    \"Verify a Veya.sol commitment from a Robinhood Chain tx hash\",\r\n    { txHash: z.string().min(66) },\r\n    async ({ txHash }) => {\r\n      const client = createReadClient(cfg);\r\n      const result = await client.verifyTransaction(txHash);\r\n      return {\r\n        content: [{ type: \"text\", text: JSON.stringify(result, null, 2) }],\r\n      };\r\n    },\r\n  );\r\n\r\n  server.tool(\r\n    \"veya_api_health\",\r\n    \"Probe the public VEYA API /health (api.veyanet.tech) — honest degraded when fleet down\",\r\n    {},\r\n    async () => {\r\n      const res = await fetch(`${cfg.apiUrl}/health`, {\r\n        signal: AbortSignal.timeout(8000),\r\n      });\r\n      const body = await res.json().catch(() => ({}));\r\n      return {\r\n        content: [\r\n          {\r\n            type: \"text\",\r\n            text: JSON.stringify({ httpStatus: res.status, body }, null, 2),\r\n          },\r\n        ],\r\n      };\r\n    },\r\n  );\r\n}\r\n","import { VeyaClient } from \"@veyanet/sdk\";\r\nimport type { McpServiceConfig } from \"./config.js\";\r\n\r\nexport function createReadClient(cfg: McpServiceConfig): VeyaClient {\r\n  return new VeyaClient({\r\n    rpcUrl: cfg.rpcUrl,\r\n    contractAddress: cfg.contractAddress,\r\n    chainId: cfg.chainId,\r\n    explorerUrl: cfg.explorerUrl,\r\n  });\r\n}\r\n\r\nexport function createWriteClient(cfg: McpServiceConfig): VeyaClient {\r\n  if (!cfg.relayerPrivateKey) {\r\n    throw new Error(\"VEYA_RELAYER_PRIVATE_KEY required for write tools\");\r\n  }\r\n  return new VeyaClient({\r\n    rpcUrl: cfg.rpcUrl,\r\n    contractAddress: cfg.contractAddress,\r\n    chainId: cfg.chainId,\r\n    explorerUrl: cfg.explorerUrl,\r\n    payerPrivateKey: cfg.relayerPrivateKey,\r\n  });\r\n}\r\n\r\nexport function parseHexBytes(value: string, expectedLen?: number): Uint8Array {\r\n  const hex = value.trim().replace(/^0x/, \"\");\r\n  if (!/^[0-9a-fA-F]*$/.test(hex) || hex.length % 2 !== 0) {\r\n    throw new Error(\"Expected even-length hex string\");\r\n  }\r\n  const buf = Buffer.from(hex, \"hex\");\r\n  if (expectedLen !== undefined && buf.length !== expectedLen) {\r\n    throw new Error(`Expected ${expectedLen} bytes, got ${buf.length}`);\r\n  }\r\n  return Uint8Array.from(buf);\r\n}\r\n","import { z } from \"zod\";\r\nimport type { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\r\nimport type { McpServiceConfig } from \"../config.js\";\r\nimport { writesEnabled } from \"../config.js\";\r\nimport { assertWriteAuthorized } from \"../auth.js\";\r\nimport { createWriteClient, parseHexBytes } from \"../sdk.js\";\r\n\r\n/**\r\n * Write tools are registered only when MCP_API_KEY + relayer key exist.\r\n * Callers must still pass Authorization: Bearer on the HTTP request;\r\n * bearer is read from request AsyncLocalStorage.\r\n */\r\nexport function registerWriteTools(\r\n  server: McpServer,\r\n  cfg: McpServiceConfig,\r\n  getBearer: () => string | null,\r\n): void {\r\n  if (!writesEnabled(cfg)) {\r\n    server.tool(\r\n      \"veya_writes_status\",\r\n      \"Reports that on-chain write tools are disabled on this server\",\r\n      {},\r\n      async () => ({\r\n        content: [\r\n          {\r\n            type: \"text\",\r\n            text: JSON.stringify({\r\n              writesEnabled: false,\r\n              reason: \"Set MCP_API_KEY and VEYA_RELAYER_PRIVATE_KEY to enable write tools\",\r\n            }),\r\n          },\r\n        ],\r\n      }),\r\n    );\r\n    return;\r\n  }\r\n\r\n  function requireAuth(): void {\r\n    assertWriteAuthorized(cfg, getBearer());\r\n  }\r\n\r\n  server.tool(\r\n    \"veya_store_commitment\",\r\n    \"Write a 32-byte commitment to Veya.sol (requires MCP_API_KEY). Use content Use stamps prefer product-site + API.\",\r\n    {\r\n      environmentUuidHex: z.string().min(32),\r\n      commitmentHex: z.string().min(64),\r\n    },\r\n    async ({ environmentUuidHex, commitmentHex }) => {\r\n      requireAuth();\r\n      const client = createWriteClient(cfg);\r\n      const txHash = await client.requireEvm().storeCommitment(\r\n        parseHexBytes(environmentUuidHex, 16),\r\n        parseHexBytes(commitmentHex, 32),\r\n      );\r\n      return {\r\n        content: [\r\n          {\r\n            type: \"text\",\r\n            text: JSON.stringify({ txHash, explorer: client.explorerFor(txHash) }, null, 2),\r\n          },\r\n        ],\r\n      };\r\n    },\r\n  );\r\n\r\n  server.tool(\r\n    \"veya_attest_execution\",\r\n    \"attestExecution on Veya.sol with ML-DSA bytes (requires MCP_API_KEY)\",\r\n    {\r\n      environmentUuidHex: z.string().min(32),\r\n      blake3HashHex: z.string().min(64),\r\n      mldsaSigHex: z.string().min(8),\r\n    },\r\n    async ({ environmentUuidHex, blake3HashHex, mldsaSigHex }) => {\r\n      requireAuth();\r\n      const client = createWriteClient(cfg);\r\n      const txHash = await client.requireEvm().attestExecution(\r\n        parseHexBytes(environmentUuidHex, 16),\r\n        parseHexBytes(blake3HashHex, 32),\r\n        parseHexBytes(mldsaSigHex),\r\n      );\r\n      return {\r\n        content: [\r\n          {\r\n            type: \"text\",\r\n            text: JSON.stringify({ txHash, explorer: client.explorerFor(txHash) }, null, 2),\r\n          },\r\n        ],\r\n      };\r\n    },\r\n  );\r\n\r\n  server.tool(\r\n    \"veya_register_environment\",\r\n    \"registerEnvironment on Veya.sol (requires MCP_API_KEY)\",\r\n    {\r\n      environmentUuidHex: z.string().min(32),\r\n      pqPubkeyHashHex: z.string().min(64),\r\n      envType: z.number().int().min(0).max(10).default(0),\r\n    },\r\n    async ({ environmentUuidHex, pqPubkeyHashHex, envType }) => {\r\n      requireAuth();\r\n      const client = createWriteClient(cfg);\r\n      const txHash = await client.requireEvm().registerEnvironment(\r\n        parseHexBytes(environmentUuidHex, 16),\r\n        parseHexBytes(pqPubkeyHashHex, 32),\r\n        envType,\r\n      );\r\n      return {\r\n        content: [\r\n          {\r\n            type: \"text\",\r\n            text: JSON.stringify({ txHash, explorer: client.explorerFor(txHash) }, null, 2),\r\n          },\r\n        ],\r\n      };\r\n    },\r\n  );\r\n}\r\n","import type { Request } from \"express\";\r\nimport type { McpServiceConfig } from \"./config.js\";\r\n\r\nexport function extractBearer(req: Request): string | null {\r\n  const h = req.header(\"authorization\") || req.header(\"Authorization\");\r\n  if (!h) return null;\r\n  const m = /^Bearer\\s+(.+)$/i.exec(h.trim());\r\n  return m?.[1]?.trim() || null;\r\n}\r\n\r\n/** Write tools require MCP_API_KEY match. Fail closed if key unset. */\r\nexport function assertWriteAuthorized(cfg: McpServiceConfig, bearer: string | null): void {\r\n  if (!cfg.mcpApiKey) {\r\n    throw new Error(\r\n      \"Write tools disabled on this server (set MCP_API_KEY + VEYA_RELAYER_PRIVATE_KEY)\",\r\n    );\r\n  }\r\n  if (!bearer || bearer !== cfg.mcpApiKey) {\r\n    throw new Error(\"Unauthorized: provide Authorization: Bearer <MCP_API_KEY>\");\r\n  }\r\n  if (!cfg.relayerPrivateKey) {\r\n    throw new Error(\"Write tools disabled: VEYA_RELAYER_PRIVATE_KEY not configured\");\r\n  }\r\n}\r\n","import express, { type Request, type Response } from \"express\";\r\nimport cors from \"cors\";\r\nimport { randomUUID } from \"node:crypto\";\r\nimport { StreamableHTTPServerTransport } from \"@modelcontextprotocol/sdk/server/streamableHttp.js\";\r\nimport { isInitializeRequest } from \"@modelcontextprotocol/sdk/types.js\";\r\nimport {\r\n  loadConfig,\r\n  writesEnabled,\r\n  MCP_SERVICE_NAME,\r\n  MCP_SERVICE_VERSION,\r\n  type McpServiceConfig,\r\n} from \"./config.js\";\r\nimport { extractBearer } from \"./auth.js\";\r\nimport { createMcpServer, requestAuth } from \"./server.js\";\r\n\r\nexport function createHttpApp(cfg: McpServiceConfig = loadConfig()) {\r\n  const app = express();\r\n  app.use(express.json({ limit: \"1mb\" }));\r\n\r\n  app.use(\r\n    cors({\r\n      origin(origin, cb) {\r\n        if (!origin) return cb(null, true);\r\n        if (cfg.corsOrigins.length === 0) return cb(null, false);\r\n        if (cfg.corsOrigins.includes(origin)) return cb(null, true);\r\n        return cb(null, false);\r\n      },\r\n      credentials: true,\r\n    }),\r\n  );\r\n\r\n  app.get(\"/health\", (_req, res) => {\r\n    res.json({\r\n      status: \"ok\",\r\n      service: MCP_SERVICE_NAME,\r\n      version: MCP_SERVICE_VERSION,\r\n      publicMcpUrl: cfg.publicMcpUrl,\r\n      chainId: cfg.chainId,\r\n      contractAddress: cfg.contractAddress,\r\n      writesEnabled: writesEnabled(cfg),\r\n      sealed: \"AES-256-GCM (not FHE)\",\r\n      settlement: \"Robinhood Chain testnet 46630\",\r\n    });\r\n  });\r\n\r\n  // Stateless Streamable HTTP — paste URL into Claude / Cursor (POST /mcp)\r\n  app.post(\"/mcp\", async (req: Request, res: Response) => {\r\n    const bearer = extractBearer(req);\r\n    await requestAuth.run({ bearer }, async () => {\r\n      try {\r\n        const server = createMcpServer(cfg);\r\n        const transport = new StreamableHTTPServerTransport({\r\n          sessionIdGenerator: undefined,\r\n        });\r\n        await server.connect(transport);\r\n        await transport.handleRequest(req, res, req.body);\r\n        res.on(\"close\", () => {\r\n          void transport.close();\r\n          void server.close();\r\n        });\r\n      } catch (err) {\r\n        console.error(\"[veyanet/mcp] POST /mcp\", err);\r\n        if (!res.headersSent) {\r\n          res.status(500).json({\r\n            jsonrpc: \"2.0\",\r\n            error: { code: -32603, message: \"Internal server error\" },\r\n            id: null,\r\n          });\r\n        }\r\n      }\r\n    });\r\n  });\r\n\r\n  // Optional stateful path for clients that send MCP-Session-Id\r\n  const sessions = new Map<string, StreamableHTTPServerTransport>();\r\n\r\n  app.post(\"/mcp/session\", async (req: Request, res: Response) => {\r\n    const bearer = extractBearer(req);\r\n    await requestAuth.run({ bearer }, async () => {\r\n      try {\r\n        const sessionId = req.header(\"mcp-session-id\") || undefined;\r\n        if (sessionId && sessions.has(sessionId)) {\r\n          await sessions.get(sessionId)!.handleRequest(req, res, req.body);\r\n          return;\r\n        }\r\n        if (!sessionId && isInitializeRequest(req.body)) {\r\n          const transport = new StreamableHTTPServerTransport({\r\n            sessionIdGenerator: () => randomUUID(),\r\n            onsessioninitialized: (id) => {\r\n              sessions.set(id, transport);\r\n            },\r\n          });\r\n          transport.onclose = () => {\r\n            if (transport.sessionId) sessions.delete(transport.sessionId);\r\n          };\r\n          const server = createMcpServer(cfg);\r\n          await server.connect(transport);\r\n          await transport.handleRequest(req, res, req.body);\r\n          return;\r\n        }\r\n        res.status(400).json({\r\n          jsonrpc: \"2.0\",\r\n          error: { code: -32000, message: \"No valid MCP session\" },\r\n          id: null,\r\n        });\r\n      } catch (err) {\r\n        console.error(\"[veyanet/mcp] POST /mcp/session\", err);\r\n        if (!res.headersSent) {\r\n          res.status(500).json({\r\n            jsonrpc: \"2.0\",\r\n            error: { code: -32603, message: \"Internal server error\" },\r\n            id: null,\r\n          });\r\n        }\r\n      }\r\n    });\r\n  });\r\n\r\n  app.get(\"/\", (_req, res) => {\r\n    res.type(\"html\").send(`<!doctype html>\r\n<html><head><meta charset=\"utf-8\"/><title>VEYA MCP</title></head>\r\n<body style=\"font-family:system-ui;max-width:40rem;margin:2rem auto;line-height:1.5\">\r\n  <h1>VEYA MCP</h1>\r\n  <p>Paste this URL into Claude / Cursor (Streamable HTTP):</p>\r\n  <pre>${cfg.publicMcpUrl}</pre>\r\n  <p>Local: <code>POST http://127.0.0.1:${cfg.port}/mcp</code></p>\r\n  <p>Health: <a href=\"/health\">/health</a></p>\r\n  <p>Settlement: Robinhood testnet <strong>46630</strong> · Sealed = AES-256-GCM (not FHE) · Not mainnet.</p>\r\n  <p>Local stdio MCP for operators: <code>veya-anchor/packages/mcp</code></p>\r\n</body></html>`);\r\n  });\r\n\r\n  return app;\r\n}\r\n\r\nexport function startHttpServer(cfg: McpServiceConfig = loadConfig()) {\r\n  const app = createHttpApp(cfg);\r\n  return app.listen(cfg.port, cfg.host, () => {\r\n    console.log(`[veyanet/mcp] listening on http://${cfg.host}:${cfg.port}`);\r\n    console.log(`[veyanet/mcp] MCP POST ${cfg.publicMcpUrl} (local /mcp)`);\r\n    console.log(`[veyanet/mcp] writesEnabled=${writesEnabled(cfg)}`);\r\n  });\r\n}\r\n"],"mappings":";AAeO,IAAM,mBAAmB;AACzB,IAAM,sBAAsB;AAE5B,SAAS,aAA+B;AAC7C,QAAM,YAAY,QAAQ,IAAI,aAAa,KAAK,KAAK;AACrD,QAAM,UACJ,QAAQ,IAAI,0BAA0B,KAAK,KAC3C,QAAQ,IAAI,2BAA2B,KAAK,KAC5C;AAEF,SAAO;AAAA,IACL,MAAM,OAAO,QAAQ,IAAI,QAAQ,IAAI;AAAA,IACrC,MAAM,QAAQ,IAAI,QAAQ;AAAA,IAC1B,eAAe,QAAQ,IAAI,kBAAkB,gCAAgC,QAAQ,OAAO,EAAE;AAAA,IAC9F,SAAS,OAAO,QAAQ,IAAI,sBAAsB,KAAK;AAAA,IACvD,QAAQ,QAAQ,IAAI,qBAAqB;AAAA,IACzC,aACE,QAAQ,IAAI,0BAA0B;AAAA,IACxC,iBACE,QAAQ,IAAI,yBAAyB;AAAA,IACvC,SAAS,QAAQ,IAAI,gBAAgB,4BAA4B,QAAQ,OAAO,EAAE;AAAA,IAClF;AAAA,IACA,mBAAmB;AAAA,IACnB,cAAc,QAAQ,IAAI,eAAe,IACtC,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AAAA,IACjB,SAAS,QAAQ,IAAI,YAAY;AAAA,EACnC;AACF;AAEO,SAAS,cAAc,KAAgC;AAC5D,SAAO,QAAQ,IAAI,aAAa,IAAI,iBAAiB;AACvD;;;AChDA,SAAS,yBAAyB;AAClC,SAAS,iBAAiB;;;ACD1B,SAAS,SAAS;;;ACAlB,SAAS,kBAAkB;AAGpB,SAAS,iBAAiB,KAAmC;AAClE,SAAO,IAAI,WAAW;AAAA,IACpB,QAAQ,IAAI;AAAA,IACZ,iBAAiB,IAAI;AAAA,IACrB,SAAS,IAAI;AAAA,IACb,aAAa,IAAI;AAAA,EACnB,CAAC;AACH;AAEO,SAAS,kBAAkB,KAAmC;AACnE,MAAI,CAAC,IAAI,mBAAmB;AAC1B,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AACA,SAAO,IAAI,WAAW;AAAA,IACpB,QAAQ,IAAI;AAAA,IACZ,iBAAiB,IAAI;AAAA,IACrB,SAAS,IAAI;AAAA,IACb,aAAa,IAAI;AAAA,IACjB,iBAAiB,IAAI;AAAA,EACvB,CAAC;AACH;AAEO,SAAS,cAAc,OAAe,aAAkC;AAC7E,QAAM,MAAM,MAAM,KAAK,EAAE,QAAQ,OAAO,EAAE;AAC1C,MAAI,CAAC,iBAAiB,KAAK,GAAG,KAAK,IAAI,SAAS,MAAM,GAAG;AACvD,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACnD;AACA,QAAM,MAAM,OAAO,KAAK,KAAK,KAAK;AAClC,MAAI,gBAAgB,UAAa,IAAI,WAAW,aAAa;AAC3D,UAAM,IAAI,MAAM,YAAY,WAAW,eAAe,IAAI,MAAM,EAAE;AAAA,EACpE;AACA,SAAO,WAAW,KAAK,GAAG;AAC5B;;;AD9BO,SAAS,oBAAoB,QAAmB,KAA6B;AAClF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,CAAC;AAAA,IACD,aAAa;AAAA,MACX,SAAS;AAAA,QACP;AAAA,UACE,MAAM;AAAA,UACN,MAAM,KAAK;AAAA,YACT;AAAA,cACE,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW,IAAI;AAAA,cACf,YAAY;AAAA,gBACV,SAAS;AAAA,gBACT,SAAS,IAAI;AAAA,gBACb,UAAU,IAAI;AAAA,gBACd,UAAU,IAAI;AAAA,gBACd,KAAK,IAAI;AAAA,cACX;AAAA,cACA,YAAY,IAAI;AAAA,cAChB,QAAQ;AAAA,cACR,SAAS;AAAA,cACT,QAAQ;AAAA,cACR,cAAc;AAAA,YAChB;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,CAAC;AAAA,IACD,YAAY;AACV,YAAM,SAAS,iBAAiB,GAAG;AACnC,YAAM,OAAO,MAAM,OAAO,UAAU;AACpC,aAAO;AAAA,QACL,SAAS;AAAA,UACP;AAAA,YACE,MAAM;AAAA,YACN,MAAM,KAAK;AAAA,cACT;AAAA,gBACE,GAAG;AAAA,gBACH,SAAS,KAAK,QAAQ,SAAS;AAAA,gBAC/B,iBAAiB,IAAI;AAAA,gBACrB,QAAQ,OAAO,SAAS;AAAA,cAC1B;AAAA,cACA;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;AAAA,IAC1B,OAAO,EAAE,KAAK,MAAM;AAClB,YAAM,SAAS,iBAAiB,GAAG;AACnC,YAAM,OAAO,MAAM,OAAO,WAAW,IAAI;AACzC,aAAO;AAAA,QACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,EAAE,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC;AAAA,MACrE;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;AAAA,IAC7B,OAAO,EAAE,OAAO,MAAM;AACpB,YAAM,SAAS,iBAAiB,GAAG;AACnC,YAAM,SAAS,MAAM,OAAO,kBAAkB,MAAM;AACpD,aAAO;AAAA,QACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,EAAE,CAAC;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,CAAC;AAAA,IACD,YAAY;AACV,YAAM,MAAM,MAAM,MAAM,GAAG,IAAI,MAAM,WAAW;AAAA,QAC9C,QAAQ,YAAY,QAAQ,GAAI;AAAA,MAClC,CAAC;AACD,YAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,aAAO;AAAA,QACL,SAAS;AAAA,UACP;AAAA,YACE,MAAM;AAAA,YACN,MAAM,KAAK,UAAU,EAAE,YAAY,IAAI,QAAQ,KAAK,GAAG,MAAM,CAAC;AAAA,UAChE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;AEhHA,SAAS,KAAAA,UAAS;;;ACGX,SAAS,cAAc,KAA6B;AACzD,QAAM,IAAI,IAAI,OAAO,eAAe,KAAK,IAAI,OAAO,eAAe;AACnE,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,IAAI,mBAAmB,KAAK,EAAE,KAAK,CAAC;AAC1C,SAAO,IAAI,CAAC,GAAG,KAAK,KAAK;AAC3B;AAGO,SAAS,sBAAsB,KAAuB,QAA6B;AACxF,MAAI,CAAC,IAAI,WAAW;AAClB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,UAAU,WAAW,IAAI,WAAW;AACvC,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,MAAI,CAAC,IAAI,mBAAmB;AAC1B,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACF;;;ADXO,SAAS,mBACd,QACA,KACA,WACM;AACN,MAAI,CAAC,cAAc,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,CAAC;AAAA,MACD,aAAa;AAAA,QACX,SAAS;AAAA,UACP;AAAA,YACE,MAAM;AAAA,YACN,MAAM,KAAK,UAAU;AAAA,cACnB,eAAe;AAAA,cACf,QAAQ;AAAA,YACV,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA;AAAA,EACF;AAEA,WAAS,cAAoB;AAC3B,0BAAsB,KAAK,UAAU,CAAC;AAAA,EACxC;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,MACE,oBAAoBC,GAAE,OAAO,EAAE,IAAI,EAAE;AAAA,MACrC,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE;AAAA,IAClC;AAAA,IACA,OAAO,EAAE,oBAAoB,cAAc,MAAM;AAC/C,kBAAY;AACZ,YAAM,SAAS,kBAAkB,GAAG;AACpC,YAAM,SAAS,MAAM,OAAO,WAAW,EAAE;AAAA,QACvC,cAAc,oBAAoB,EAAE;AAAA,QACpC,cAAc,eAAe,EAAE;AAAA,MACjC;AACA,aAAO;AAAA,QACL,SAAS;AAAA,UACP;AAAA,YACE,MAAM;AAAA,YACN,MAAM,KAAK,UAAU,EAAE,QAAQ,UAAU,OAAO,YAAY,MAAM,EAAE,GAAG,MAAM,CAAC;AAAA,UAChF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,MACE,oBAAoBA,GAAE,OAAO,EAAE,IAAI,EAAE;AAAA,MACrC,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE;AAAA,MAChC,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC/B;AAAA,IACA,OAAO,EAAE,oBAAoB,eAAe,YAAY,MAAM;AAC5D,kBAAY;AACZ,YAAM,SAAS,kBAAkB,GAAG;AACpC,YAAM,SAAS,MAAM,OAAO,WAAW,EAAE;AAAA,QACvC,cAAc,oBAAoB,EAAE;AAAA,QACpC,cAAc,eAAe,EAAE;AAAA,QAC/B,cAAc,WAAW;AAAA,MAC3B;AACA,aAAO;AAAA,QACL,SAAS;AAAA,UACP;AAAA,YACE,MAAM;AAAA,YACN,MAAM,KAAK,UAAU,EAAE,QAAQ,UAAU,OAAO,YAAY,MAAM,EAAE,GAAG,MAAM,CAAC;AAAA,UAChF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,MACE,oBAAoBA,GAAE,OAAO,EAAE,IAAI,EAAE;AAAA,MACrC,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE;AAAA,MAClC,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA,IACpD;AAAA,IACA,OAAO,EAAE,oBAAoB,iBAAiB,QAAQ,MAAM;AAC1D,kBAAY;AACZ,YAAM,SAAS,kBAAkB,GAAG;AACpC,YAAM,SAAS,MAAM,OAAO,WAAW,EAAE;AAAA,QACvC,cAAc,oBAAoB,EAAE;AAAA,QACpC,cAAc,iBAAiB,EAAE;AAAA,QACjC;AAAA,MACF;AACA,aAAO;AAAA,QACL,SAAS;AAAA,UACP;AAAA,YACE,MAAM;AAAA,YACN,MAAM,KAAK,UAAU,EAAE,QAAQ,UAAU,OAAO,YAAY,MAAM,EAAE,GAAG,MAAM,CAAC;AAAA,UAChF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;AH7GO,IAAM,cAAc,IAAI,kBAA6C;AAErE,SAAS,gBAAgB,KAAkC;AAChE,QAAM,SAAS,IAAI,UAAU;AAAA,IAC3B,MAAM;AAAA,IACN,SAAS;AAAA,EACX,CAAC;AAED,sBAAoB,QAAQ,GAAG;AAC/B,qBAAmB,QAAQ,KAAK,MAAM,YAAY,SAAS,GAAG,UAAU,IAAI;AAE5E,SAAO;AACT;;;AKtBA,OAAO,aAA8C;AACrD,OAAO,UAAU;AACjB,SAAS,kBAAkB;AAC3B,SAAS,qCAAqC;AAC9C,SAAS,2BAA2B;AAW7B,SAAS,cAAc,MAAwB,WAAW,GAAG;AAClE,QAAM,MAAM,QAAQ;AACpB,MAAI,IAAI,QAAQ,KAAK,EAAE,OAAO,MAAM,CAAC,CAAC;AAEtC,MAAI;AAAA,IACF,KAAK;AAAA,MACH,OAAO,QAAQ,IAAI;AACjB,YAAI,CAAC,OAAQ,QAAO,GAAG,MAAM,IAAI;AACjC,YAAI,IAAI,YAAY,WAAW,EAAG,QAAO,GAAG,MAAM,KAAK;AACvD,YAAI,IAAI,YAAY,SAAS,MAAM,EAAG,QAAO,GAAG,MAAM,IAAI;AAC1D,eAAO,GAAG,MAAM,KAAK;AAAA,MACvB;AAAA,MACA,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAEA,MAAI,IAAI,WAAW,CAAC,MAAM,QAAQ;AAChC,QAAI,KAAK;AAAA,MACP,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,SAAS;AAAA,MACT,cAAc,IAAI;AAAA,MAClB,SAAS,IAAI;AAAA,MACb,iBAAiB,IAAI;AAAA,MACrB,eAAe,cAAc,GAAG;AAAA,MAChC,QAAQ;AAAA,MACR,YAAY;AAAA,IACd,CAAC;AAAA,EACH,CAAC;AAGD,MAAI,KAAK,QAAQ,OAAO,KAAc,QAAkB;AACtD,UAAM,SAAS,cAAc,GAAG;AAChC,UAAM,YAAY,IAAI,EAAE,OAAO,GAAG,YAAY;AAC5C,UAAI;AACF,cAAM,SAAS,gBAAgB,GAAG;AAClC,cAAM,YAAY,IAAI,8BAA8B;AAAA,UAClD,oBAAoB;AAAA,QACtB,CAAC;AACD,cAAM,OAAO,QAAQ,SAAS;AAC9B,cAAM,UAAU,cAAc,KAAK,KAAK,IAAI,IAAI;AAChD,YAAI,GAAG,SAAS,MAAM;AACpB,eAAK,UAAU,MAAM;AACrB,eAAK,OAAO,MAAM;AAAA,QACpB,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,gBAAQ,MAAM,2BAA2B,GAAG;AAC5C,YAAI,CAAC,IAAI,aAAa;AACpB,cAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YACnB,SAAS;AAAA,YACT,OAAO,EAAE,MAAM,QAAQ,SAAS,wBAAwB;AAAA,YACxD,IAAI;AAAA,UACN,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AAGD,QAAM,WAAW,oBAAI,IAA2C;AAEhE,MAAI,KAAK,gBAAgB,OAAO,KAAc,QAAkB;AAC9D,UAAM,SAAS,cAAc,GAAG;AAChC,UAAM,YAAY,IAAI,EAAE,OAAO,GAAG,YAAY;AAC5C,UAAI;AACF,cAAM,YAAY,IAAI,OAAO,gBAAgB,KAAK;AAClD,YAAI,aAAa,SAAS,IAAI,SAAS,GAAG;AACxC,gBAAM,SAAS,IAAI,SAAS,EAAG,cAAc,KAAK,KAAK,IAAI,IAAI;AAC/D;AAAA,QACF;AACA,YAAI,CAAC,aAAa,oBAAoB,IAAI,IAAI,GAAG;AAC/C,gBAAM,YAAY,IAAI,8BAA8B;AAAA,YAClD,oBAAoB,MAAM,WAAW;AAAA,YACrC,sBAAsB,CAAC,OAAO;AAC5B,uBAAS,IAAI,IAAI,SAAS;AAAA,YAC5B;AAAA,UACF,CAAC;AACD,oBAAU,UAAU,MAAM;AACxB,gBAAI,UAAU,UAAW,UAAS,OAAO,UAAU,SAAS;AAAA,UAC9D;AACA,gBAAM,SAAS,gBAAgB,GAAG;AAClC,gBAAM,OAAO,QAAQ,SAAS;AAC9B,gBAAM,UAAU,cAAc,KAAK,KAAK,IAAI,IAAI;AAChD;AAAA,QACF;AACA,YAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACnB,SAAS;AAAA,UACT,OAAO,EAAE,MAAM,OAAQ,SAAS,uBAAuB;AAAA,UACvD,IAAI;AAAA,QACN,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,gBAAQ,MAAM,mCAAmC,GAAG;AACpD,YAAI,CAAC,IAAI,aAAa;AACpB,cAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YACnB,SAAS;AAAA,YACT,OAAO,EAAE,MAAM,QAAQ,SAAS,wBAAwB;AAAA,YACxD,IAAI;AAAA,UACN,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AAED,MAAI,IAAI,KAAK,CAAC,MAAM,QAAQ;AAC1B,QAAI,KAAK,MAAM,EAAE,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,SAKjB,IAAI,YAAY;AAAA,0CACiB,IAAI,IAAI;AAAA;AAAA;AAAA;AAAA,eAInC;AAAA,EACb,CAAC;AAED,SAAO;AACT;AAEO,SAAS,gBAAgB,MAAwB,WAAW,GAAG;AACpE,QAAM,MAAM,cAAc,GAAG;AAC7B,SAAO,IAAI,OAAO,IAAI,MAAM,IAAI,MAAM,MAAM;AAC1C,YAAQ,IAAI,qCAAqC,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;AACvE,YAAQ,IAAI,0BAA0B,IAAI,YAAY,eAAe;AACrE,YAAQ,IAAI,+BAA+B,cAAc,GAAG,CAAC,EAAE;AAAA,EACjE,CAAC;AACH;","names":["z","z"]}

package/docs/ARCHITECTURE.md

@@ -0,0 +1,77 @@
+# System Architecture — VEYA MCP
+
+## Purpose
+
+`@veyanet/mcp` is a **thin Streamable HTTP gate** in front of `@veyanet/sdk`. It exists so agent clients can paste `https://mcp.veyanet.tech/mcp` and call selected VEYA capabilities without embedding the SDK. It is not a second cryptography stack and not a token service.
+
+## Trust boundaries
+
+```text
+┌─────────────────────────────────────────────────────────────┐
+│  MCP Client (Claude / Cursor / custom agent)                │
+│  Trusts: TLS to mcp.veyanet.tech, tool JSON responses       │
+│  Does not receive: relayer private keys, MCP_API_KEY dump   │
+└────────────────────────────┬────────────────────────────────┘
+                             │ HTTPS Streamable HTTP
+                             ▼
+┌─────────────────────────────────────────────────────────────┐
+│  @veyanet/mcp process                                       │
+│  Owns: POST /mcp, /health, tool registry, Bearer check      │
+│  Does not own: PQ primitives, consensus quorum, sealed AES  │
+└────────────────────────────┬────────────────────────────────┘
+                             │ in-process import
+                             ▼
+┌─────────────────────────────────────────────────────────────┐
+│  @veyanet/sdk                                               │
+│  Owns: BLAKE3, verify receipts, EvmAnchor, chain id guard   │
+└────────────────────────────┬────────────────────────────────┘
+                             │ JSON-RPC
+                             ▼
+┌─────────────────────────────────────────────────────────────┐
+│  Robinhood Chain testnet 46630 · Veya.sol                   │
+│  Owns: commitments, environments, attestations (protocol)   │
+└─────────────────────────────────────────────────────────────┘
+
+Optional side call:
+  veya_api_health → https://api.veyanet.tech/health
+  (product API fleet honesty; independent of MCP process uptime)
+```
+
+## Components inside this package
+
+| Module | Role |
+|--------|------|
+| `src/http.ts` | Express app: `/`, `/health`, `POST /mcp`, optional session path |
+| `src/server.ts` | `McpServer` construction + tool registration |
+| `src/config.ts` | Env load, defaults, `writesEnabled` |
+| `src/auth.ts` | Bearer extract + write assert |
+| `src/sdk.ts` | Read/write `VeyaClient` factories |
+| `src/tools/public.ts` | Public tools |
+| `src/tools/write.ts` | Authenticated write tools |
+| `scripts/smoke.ts` | Live initialize + tool smoke |
+
+## What this architecture refuses
+
+* Inventing 2-of-3 quorum inside MCP without validators
+* Claiming FHE / SGX / Nitro as the sealed product path
+* Claiming mainnet settlement before Phase 3
+* Exposing write tools without both API key and relayer key
+* Treating `Veya.sol` as ERC-20
+
+## Relationship to stdio MCP
+
+`veya-anchor/packages/mcp/` is a **local stdio** operator surface. `@veyanet/mcp` is the **HTTP** public surface. Both should stay honest about the same chain pins; they are not nested packages.
+
+## Failure domains
+
+| Domain | Symptom | Operator action |
+|--------|---------|-----------------|
+| MCP process down | Connector timeout | Restart Node / systemd |
+| RPC down | `veya_ping_chain` / verify fail | Check Robinhood RPC |
+| Product API degraded | `veya_api_health` body degraded | Fleet / SHIP.md — MCP can still serve describe/ping if RPC works |
+| Wrong Bearer | Write tool error | Rotate / fix `MCP_API_KEY` |
+| Chain mismatch | SDK `CHAIN_MISMATCH` on writes | Fix RPC / chain id env |
+
+## Security notes
+
+See [AUTHENTICATION.md](./AUTHENTICATION.md) and [../SECURITY.md](../SECURITY.md). Relayer keys are high value: use a dedicated testnet wallet, minimal ETH, and rotate if leaked.

package/docs/AUTHENTICATION.md

@@ -0,0 +1,76 @@
+# Authentication & Writes — VEYA MCP
+
+## Model summary
+
+| Surface | Auth |
+|---------|------|
+| Public tools | None |
+| `/health`, `/` | None |
+| Write tools | `Authorization: Bearer <MCP_API_KEY>` **and** server-side relayer key |
+
+There is no end-user wallet login inside this MCP process. Wallet / guest sessions belong to the product API and product-site.
+
+## Enabling writes
+
+Both must be set in the server environment:
+
+```bash
+MCP_API_KEY=...                # shared secret for callers
+VEYA_RELAYER_PRIVATE_KEY=0x... # pays gas on Robinhood testnet
+```
+
+`VEYA_DEPLOYER_PRIVATE_KEY` is accepted as an alternate payer env name.
+
+If either is missing, `writesEnabled(cfg)` is false:
+* Write tools are **not** registered
+* `veya_writes_status` is registered instead
+
+## Bearer validation
+
+`src/auth.ts`:
+
+1. Extract `Authorization: Bearer …`
+2. Require `cfg.mcpApiKey` to be set
+3. Require bearer equality (constant-time string compare is not currently used; treat key as high entropy and rotate on suspicion)
+4. Require relayer private key present
+
+Failure throws; the tool call fails closed.
+
+## Client example (conceptual)
+
+MCP clients differ in how they attach HTTP headers. Operators testing with raw HTTP must send:
+
+```http
+POST /mcp HTTP/1.1
+Host: mcp.veyanet.tech
+Authorization: Bearer <MCP_API_KEY>
+Content-Type: application/json
+Accept: application/json, text/event-stream
+```
+
+If your Claude/Cursor build cannot attach custom headers, keep writes **disabled** on the public URL and run a separate private MCP instance for authorized writers.
+
+## Key custody
+
+| Secret | Where it lives | Never |
+|--------|----------------|-------|
+| `MCP_API_KEY` | Server `.env`, optionally CI secret store | README, git, screenshots |
+| Relayer private key | Server `.env` only | Logs, tool responses, `/health` |
+| User wallet keys | Not used by this MCP | — |
+
+## Recommended production posture
+
+1. Public `mcp.veyanet.tech` → **reads only** (`writesEnabled: false`)
+2. Private operator instance (VPN / IP allowlist) → writes enabled with dedicated testnet wallet
+3. Rotate `MCP_API_KEY` if any authorized client is compromised
+4. Fund relayer with minimal testnet ETH; monitor explorer for unexpected txs
+
+## Abuse considerations
+
+Write tools can spend testnet gas and mutate protocol state (commitments, environments, attestations). Treat Bearer distribution like production API key distribution. Rate limiting at nginx is recommended before enabling public writes.
+
+## Related
+
+* [TOOLS.md](./TOOLS.md) — write tool argument lists
+* [CONFIGURATION.md](./CONFIGURATION.md) — env names
+* [../SECURITY.md](../SECURITY.md) — disclosure