@vultisig/mcp 0.1.1

package/CHANGELOG.md

@@ -0,0 +1,9 @@
+# @vultisig/mcp
+
+## 0.1.1
+
+### Patch Changes
+
+- Updated dependencies [[`0388700`](https://github.com/vultisig/vultisig-sdk/commit/03887009b7579fc0b193d068d4a205cdd3b7c214), [`83fe4c3`](https://github.com/vultisig/vultisig-sdk/commit/83fe4c3c58637aea4823d0eaa7f21d4c5cdf3dc7)]:
+  - @vultisig/client-shared@0.2.0
+  - @vultisig/sdk@0.16.0

package/README.md

@@ -0,0 +1,47 @@
+# @vultisig/mcp
+
+Model Context Protocol server that exposes the Vultisig SDK to LLM tool-calling hosts (Claude Desktop, IDEs, agent frameworks). Runs over stdio as a JSON-RPC 2.0 transport.
+
+## Install
+
+```bash
+npm install -g @vultisig/mcp
+```
+
+## Usage
+
+```bash
+# Set up credentials via the CLI first
+vsig auth setup
+
+# Then run the MCP server (stdio)
+vmcp --vault <id-or-path>
+
+# Read-only profile (disables send/swap)
+vmcp --vault <id-or-path> --profile harness
+```
+
+## Tools
+
+| Profile   | Tools                                                                               |
+| --------- | ----------------------------------------------------------------------------------- |
+| `defi` (default) | `get_balances`, `get_portfolio`, `get_address`, `vault_info`, `supported_chains`, `swap_quote`, `send`, `swap` |
+| `harness` | `get_balances`, `get_portfolio`, `get_address`, `vault_info`, `supported_chains`, `swap_quote` (read-only)       |
+
+## Confirmation model (important)
+
+**Mutating tools (`send`, `swap`) rely on the MCP host to gate human confirmation.** The server treats a call as a broadcast-for-real only when the host passes `confirmed: true` (strict boolean via Zod — `"true"`, `1`, or truthy strings are rejected). Without `confirmed`, the call is a dry-run preview.
+
+**This means:**
+
+- A well-behaved MCP host (Claude Desktop, Cursor, etc.) **must** show the user the tool-call payload and require explicit confirmation before passing `confirmed: true`.
+- A buggy or malicious host can bypass that gate. **Do not run `@vultisig/mcp` against untrusted hosts when the `defi` profile is active.**
+- For server-deployed MCP instances, prefer `--profile harness` (read-only) unless you have a second-factor gate out of band.
+
+If you want to add your own confirmation flow (e.g. 2FA, webhook, manual approval service), run the server with `--profile harness` and wire `send`/`swap` through your own tooling.
+
+## Security notes
+
+- Credentials are read from the same keyring (or encrypted file fallback) that the CLI uses — `@napi-rs/keyring` with AES-256-GCM + async scrypt fallback for headless environments.
+- stdio framing is kept strict: all SDK log output is redirected to stderr before initialization to prevent JSON-RPC stream corruption.
+- Tools do not accept arbitrary user-supplied RPC overrides; use CLI config for endpoint customization.

package/dist/bin/mcp-server.js

@@ -0,0 +1,367 @@
+#!/usr/bin/env node
+
+// bin/mcp-server.ts
+import { readFileSync } from "node:fs";
+import { executeAuthSetup as executeAuthSetup2, getServerPassword as getServerPassword2 } from "@vultisig/client-shared";
+import { Vultisig } from "@vultisig/sdk";
+
+// src/index.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+// src/tools.ts
+import { descriptions } from "@vultisig/client-shared";
+import * as z from "zod/v4";
+function success(data) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(data, (_k, v) => typeof v === "bigint" ? v.toString() : v) }]
+  };
+}
+function error(message, hint) {
+  const payload = { error: message };
+  if (hint) payload.hint = hint;
+  return { content: [{ type: "text", text: JSON.stringify(payload) }], isError: true };
+}
+async function wrapHandler(fn) {
+  try {
+    return success(await fn());
+  } catch (err) {
+    if (err instanceof Error) return error(err.message);
+    return error(String(err));
+  }
+}
+function resolveChain(name, knownChains) {
+  const match = knownChains.find((c) => c.toLowerCase() === name.toLowerCase());
+  if (!match) throw new Error(`Unknown chain "${name}". Use supported_chains or vault_info to see available chains.`);
+  return match;
+}
+function parseChainToken(input, knownChains) {
+  const parts = input.split(":");
+  const chain = resolveChain(parts[0], knownChains);
+  return { chain, symbol: parts[1] };
+}
+var READ_ONLY_TOOLS = ["get_balances", "get_portfolio", "get_address", "vault_info", "supported_chains", "swap_quote"];
+function getTools(vault, profile = "defi") {
+  const knownChains = vault.chains;
+  const all = {
+    get_balances: {
+      description: descriptions.balance.description,
+      inputSchema: z.object({
+        chain: z.string().optional().describe(descriptions.balance.params.chain),
+        includeTokens: z.boolean().optional().describe(descriptions.balance.params.includeTokens)
+      }),
+      handler: (args) => wrapHandler(async () => {
+        const includeTokens = args.includeTokens ?? false;
+        const balances = await vault.allBalances(includeTokens);
+        const chainFilter = args.chain;
+        if (!chainFilter) return balances;
+        const target = resolveChain(chainFilter, knownChains);
+        return balances.filter((b) => b.chain === target);
+      })
+    },
+    get_portfolio: {
+      description: descriptions.portfolio.description,
+      inputSchema: z.object({
+        chain: z.string().optional().describe(descriptions.portfolio.params.chain)
+      }),
+      handler: (args) => wrapHandler(async () => {
+        const portfolio = await vault.portfolio();
+        const chainFilter = args.chain;
+        if (!chainFilter) return portfolio;
+        const target = resolveChain(chainFilter, knownChains);
+        return {
+          ...portfolio,
+          balances: portfolio.balances.filter((b) => b.chain === target)
+        };
+      })
+    },
+    get_address: {
+      description: descriptions.address.description,
+      inputSchema: z.object({
+        chain: z.string().describe(descriptions.address.params.chain)
+      }),
+      handler: (args) => wrapHandler(async () => {
+        const chain = resolveChain(args.chain, knownChains);
+        const address = await vault.address(chain);
+        return { chain, address };
+      })
+    },
+    vault_info: {
+      description: descriptions.vaultInfo.description,
+      inputSchema: z.object({}),
+      handler: () => wrapHandler(async () => ({
+        name: vault.name,
+        type: vault.type,
+        chains: vault.chains,
+        signers: vault.signers,
+        localPartyId: vault.localPartyId,
+        threshold: vault.threshold,
+        createdAt: vault.createdAt
+      }))
+    },
+    supported_chains: {
+      description: descriptions.supportedChains.description,
+      inputSchema: z.object({}),
+      handler: () => wrapHandler(async () => {
+        const chains = vault.getSupportedSwapChains();
+        return { chains };
+      })
+    },
+    swap_quote: {
+      description: descriptions.swapQuote.description,
+      inputSchema: z.object({
+        from: z.string().describe(descriptions.swapQuote.params.from),
+        to: z.string().describe(descriptions.swapQuote.params.to),
+        amount: z.string().describe(descriptions.swapQuote.params.amount)
+      }),
+      handler: (args) => wrapHandler(async () => {
+        const from = parseChainToken(args.from, knownChains);
+        const to = parseChainToken(args.to, knownChains);
+        return vault.swap({
+          fromChain: from.chain,
+          fromSymbol: from.symbol,
+          toChain: to.chain,
+          toSymbol: to.symbol,
+          amount: args.amount,
+          dryRun: true
+        });
+      })
+    },
+    send: {
+      description: descriptions.send.description,
+      inputSchema: z.object({
+        chain: z.string().describe(descriptions.send.params.chain),
+        to: z.string().describe(descriptions.send.params.to),
+        amount: z.string().describe(descriptions.send.params.amount),
+        token: z.string().optional().describe(descriptions.send.params.token),
+        memo: z.string().optional().describe(descriptions.send.params.memo),
+        confirmed: z.boolean().optional().describe(descriptions.send.params.confirmed)
+      }),
+      handler: (args) => wrapHandler(async () => {
+        const chain = resolveChain(args.chain, knownChains);
+        return vault.send({
+          chain,
+          to: args.to,
+          amount: args.amount,
+          symbol: args.token,
+          memo: args.memo,
+          dryRun: args.confirmed !== true
+        });
+      })
+    },
+    swap: {
+      description: descriptions.swap.description,
+      inputSchema: z.object({
+        from: z.string().describe(descriptions.swap.params.from),
+        to: z.string().describe(descriptions.swap.params.to),
+        amount: z.string().describe(descriptions.swap.params.amount),
+        confirmed: z.boolean().optional().describe(descriptions.swap.params.confirmed)
+      }),
+      handler: (args) => wrapHandler(async () => {
+        const from = parseChainToken(args.from, knownChains);
+        const to = parseChainToken(args.to, knownChains);
+        return vault.swap({
+          fromChain: from.chain,
+          fromSymbol: from.symbol,
+          toChain: to.chain,
+          toSymbol: to.symbol,
+          amount: args.amount,
+          dryRun: args.confirmed !== true
+        });
+      })
+    }
+  };
+  if (profile === "harness") {
+    const filtered = {};
+    for (const name of READ_ONLY_TOOLS) {
+      if (all[name]) filtered[name] = all[name];
+    }
+    return filtered;
+  }
+  return all;
+}
+
+// src/adapters/auth.ts
+import { executeAuthSetup, executeAuthStatus, getDecryptionPassword, getServerPassword } from "@vultisig/client-shared";
+
+// src/index.ts
+var VERSION = "0.1.0";
+function createMcpServer(vault, profile = "defi") {
+  const server = new McpServer({
+    name: "vultisig",
+    version: VERSION
+  });
+  const tools = getTools(vault, profile);
+  for (const [name, tool] of Object.entries(tools)) {
+    server.registerTool(
+      name,
+      {
+        description: tool.description,
+        inputSchema: tool.inputSchema
+      },
+      async (args) => tool.handler(args)
+    );
+  }
+  return server;
+}
+async function startMcpServer(vault, profile = "defi") {
+  const toStderr2 = (...args) => {
+    process.stderr.write(args.map(String).join(" ") + "\n");
+  };
+  console.log = toStderr2;
+  console.info = toStderr2;
+  console.warn = toStderr2;
+  const server = createMcpServer(vault, profile);
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+}
+
+// bin/mcp-server.ts
+var toStderr = (...args) => {
+  process.stderr.write(args.map(String).join(" ") + "\n");
+};
+console.log = toStderr;
+console.info = toStderr;
+console.warn = toStderr;
+var PROFILES = ["harness", "defi"];
+function parseArgs() {
+  const args = process.argv.slice(2);
+  if (args.includes("--help") || args.includes("-h")) {
+    process.stderr.write(`
+vultisig-mcp \u2014 MCP server for Vultisig wallet operations
+
+SETUP (first time):
+  vmcp --setup            Import a vault and store credentials interactively
+  vmcp --setup --vault-file <path>   Import a specific vault file
+
+USAGE:
+  vmcp [options]
+
+OPTIONS:
+  --profile <harness|defi>   Tool profile (default: defi)
+                             harness = read-only tools only
+                             defi    = all tools including send/swap
+  --vault-id <id>            Use a specific vault (default: first found)
+  --setup                    Run interactive auth setup, then exit
+
+CI / HEADLESS (skip interactive auth):
+  --vault-file <path>        Load vault directly from a .vult file
+                             Requires VAULT_PASSWORD and/or VAULT_DECRYPT_PASSWORD
+                             environment variables for encrypted vaults
+
+EXAMPLES:
+  # First time setup:
+  vmcp --setup
+
+  # Start the server:
+  vmcp
+  vmcp --profile harness
+
+  # Claude Code integration:
+  claude mcp add vultisig -- vmcp
+  claude mcp add vultisig -- npx @vultisig/mcp
+
+  # CI / headless:
+  VAULT_PASSWORD=xxx vmcp --vault-file ./vault.vult
+`);
+    process.exit(0);
+  }
+  let profile = "defi";
+  let vaultId;
+  let vaultFile;
+  const setup = args.includes("--setup");
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--profile" && args[i + 1]) {
+      const value = args[++i];
+      if (!PROFILES.includes(value)) {
+        process.stderr.write(`Invalid profile "${value}". Must be one of: ${PROFILES.join(", ")}
+`);
+        process.exit(1);
+      }
+      profile = value;
+    } else if (arg === "--vault-id" && args[i + 1]) {
+      vaultId = args[++i];
+    } else if (arg === "--vault-file" && args[i + 1]) {
+      vaultFile = args[++i];
+    }
+  }
+  return { profile, vaultId, vaultFile, setup };
+}
+async function runSetup(vaultFile) {
+  console.log = process.stdout.write.bind(process.stdout);
+  process.stderr.write("[vultisig-mcp] Running auth setup...\n");
+  const result = await executeAuthSetup2({ vaultFile });
+  process.stderr.write(
+    `[vultisig-mcp] Auth complete: vault "${result.vaultName}" (${result.storageBackend})
+[vultisig-mcp] You can now start the server with: vmcp
+`
+  );
+}
+async function main() {
+  const { profile, vaultId, vaultFile, setup } = parseArgs();
+  if (setup) {
+    await runSetup(vaultFile);
+    return;
+  }
+  const sdk = new Vultisig({
+    onPasswordRequired: async (vaultId2) => {
+      const password = await getServerPassword2(vaultId2);
+      if (!password) throw new Error("No server password found. Run: vmcp --setup");
+      return password;
+    }
+  });
+  await sdk.initialize();
+  let vault;
+  if (vaultFile) {
+    process.stderr.write(`[vultisig-mcp] Loading vault from file: ${vaultFile}
+`);
+    const content = readFileSync(vaultFile, "utf-8");
+    vault = await sdk.importVault(content);
+  } else {
+    const vaults = await sdk.listVaults();
+    if (vaultId) {
+      vault = vaults.find((v) => v.id === vaultId);
+      if (!vault) {
+        const available = vaults.map((v) => `  - ${v.id} (${v.name})`).join("\n");
+        process.stderr.write(
+          `Vault "${vaultId}" not found.
+
+` + (vaults.length ? `Available vaults:
+${available}
+` : `No vaults imported. Run this first:
+  vmcp --setup
+`)
+        );
+        process.exit(1);
+      }
+    } else {
+      vault = vaults[0];
+      if (!vault) {
+        process.stderr.write(
+          `No vaults found. You need to set up auth before starting the MCP server.
+
+Run:
+  vmcp --setup
+
+For CI/headless environments, use --vault-file instead:
+  VAULT_PASSWORD=xxx vmcp --vault-file ./vault.vult
+
+Run vmcp --help for more options.
+`
+        );
+        process.exit(1);
+      }
+    }
+  }
+  process.stderr.write(`[vultisig-mcp] Vault loaded: ${vault.name} (${vault.type})
+`);
+  process.stderr.write(`[vultisig-mcp] Profile: ${profile} | Tools: ${profile === "harness" ? "read-only" : "all"}
+`);
+  await startMcpServer(vault, profile);
+}
+main().catch((err) => {
+  process.stderr.write(`${err}
+`);
+  process.exit(1);
+});

package/dist/src/index.js

@@ -0,0 +1,223 @@
+// src/index.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+// src/tools.ts
+import { descriptions } from "@vultisig/client-shared";
+import * as z from "zod/v4";
+function success(data) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(data, (_k, v) => typeof v === "bigint" ? v.toString() : v) }]
+  };
+}
+function error(message, hint) {
+  const payload = { error: message };
+  if (hint) payload.hint = hint;
+  return { content: [{ type: "text", text: JSON.stringify(payload) }], isError: true };
+}
+async function wrapHandler(fn) {
+  try {
+    return success(await fn());
+  } catch (err) {
+    if (err instanceof Error) return error(err.message);
+    return error(String(err));
+  }
+}
+function resolveChain(name, knownChains) {
+  const match = knownChains.find((c) => c.toLowerCase() === name.toLowerCase());
+  if (!match) throw new Error(`Unknown chain "${name}". Use supported_chains or vault_info to see available chains.`);
+  return match;
+}
+function parseChainToken(input, knownChains) {
+  const parts = input.split(":");
+  const chain = resolveChain(parts[0], knownChains);
+  return { chain, symbol: parts[1] };
+}
+var READ_ONLY_TOOLS = ["get_balances", "get_portfolio", "get_address", "vault_info", "supported_chains", "swap_quote"];
+var WRITE_TOOLS = ["send", "swap"];
+function getTools(vault, profile = "defi") {
+  const knownChains = vault.chains;
+  const all = {
+    get_balances: {
+      description: descriptions.balance.description,
+      inputSchema: z.object({
+        chain: z.string().optional().describe(descriptions.balance.params.chain),
+        includeTokens: z.boolean().optional().describe(descriptions.balance.params.includeTokens)
+      }),
+      handler: (args) => wrapHandler(async () => {
+        const includeTokens = args.includeTokens ?? false;
+        const balances = await vault.allBalances(includeTokens);
+        const chainFilter = args.chain;
+        if (!chainFilter) return balances;
+        const target = resolveChain(chainFilter, knownChains);
+        return balances.filter((b) => b.chain === target);
+      })
+    },
+    get_portfolio: {
+      description: descriptions.portfolio.description,
+      inputSchema: z.object({
+        chain: z.string().optional().describe(descriptions.portfolio.params.chain)
+      }),
+      handler: (args) => wrapHandler(async () => {
+        const portfolio = await vault.portfolio();
+        const chainFilter = args.chain;
+        if (!chainFilter) return portfolio;
+        const target = resolveChain(chainFilter, knownChains);
+        return {
+          ...portfolio,
+          balances: portfolio.balances.filter((b) => b.chain === target)
+        };
+      })
+    },
+    get_address: {
+      description: descriptions.address.description,
+      inputSchema: z.object({
+        chain: z.string().describe(descriptions.address.params.chain)
+      }),
+      handler: (args) => wrapHandler(async () => {
+        const chain = resolveChain(args.chain, knownChains);
+        const address = await vault.address(chain);
+        return { chain, address };
+      })
+    },
+    vault_info: {
+      description: descriptions.vaultInfo.description,
+      inputSchema: z.object({}),
+      handler: () => wrapHandler(async () => ({
+        name: vault.name,
+        type: vault.type,
+        chains: vault.chains,
+        signers: vault.signers,
+        localPartyId: vault.localPartyId,
+        threshold: vault.threshold,
+        createdAt: vault.createdAt
+      }))
+    },
+    supported_chains: {
+      description: descriptions.supportedChains.description,
+      inputSchema: z.object({}),
+      handler: () => wrapHandler(async () => {
+        const chains = vault.getSupportedSwapChains();
+        return { chains };
+      })
+    },
+    swap_quote: {
+      description: descriptions.swapQuote.description,
+      inputSchema: z.object({
+        from: z.string().describe(descriptions.swapQuote.params.from),
+        to: z.string().describe(descriptions.swapQuote.params.to),
+        amount: z.string().describe(descriptions.swapQuote.params.amount)
+      }),
+      handler: (args) => wrapHandler(async () => {
+        const from = parseChainToken(args.from, knownChains);
+        const to = parseChainToken(args.to, knownChains);
+        return vault.swap({
+          fromChain: from.chain,
+          fromSymbol: from.symbol,
+          toChain: to.chain,
+          toSymbol: to.symbol,
+          amount: args.amount,
+          dryRun: true
+        });
+      })
+    },
+    send: {
+      description: descriptions.send.description,
+      inputSchema: z.object({
+        chain: z.string().describe(descriptions.send.params.chain),
+        to: z.string().describe(descriptions.send.params.to),
+        amount: z.string().describe(descriptions.send.params.amount),
+        token: z.string().optional().describe(descriptions.send.params.token),
+        memo: z.string().optional().describe(descriptions.send.params.memo),
+        confirmed: z.boolean().optional().describe(descriptions.send.params.confirmed)
+      }),
+      handler: (args) => wrapHandler(async () => {
+        const chain = resolveChain(args.chain, knownChains);
+        return vault.send({
+          chain,
+          to: args.to,
+          amount: args.amount,
+          symbol: args.token,
+          memo: args.memo,
+          dryRun: args.confirmed !== true
+        });
+      })
+    },
+    swap: {
+      description: descriptions.swap.description,
+      inputSchema: z.object({
+        from: z.string().describe(descriptions.swap.params.from),
+        to: z.string().describe(descriptions.swap.params.to),
+        amount: z.string().describe(descriptions.swap.params.amount),
+        confirmed: z.boolean().optional().describe(descriptions.swap.params.confirmed)
+      }),
+      handler: (args) => wrapHandler(async () => {
+        const from = parseChainToken(args.from, knownChains);
+        const to = parseChainToken(args.to, knownChains);
+        return vault.swap({
+          fromChain: from.chain,
+          fromSymbol: from.symbol,
+          toChain: to.chain,
+          toSymbol: to.symbol,
+          amount: args.amount,
+          dryRun: args.confirmed !== true
+        });
+      })
+    }
+  };
+  if (profile === "harness") {
+    const filtered = {};
+    for (const name of READ_ONLY_TOOLS) {
+      if (all[name]) filtered[name] = all[name];
+    }
+    return filtered;
+  }
+  return all;
+}
+function getToolNames(profile) {
+  if (profile === "harness") return [...READ_ONLY_TOOLS];
+  return [...READ_ONLY_TOOLS, ...WRITE_TOOLS];
+}
+
+// src/adapters/auth.ts
+import { executeAuthSetup, executeAuthStatus, getDecryptionPassword, getServerPassword } from "@vultisig/client-shared";
+
+// src/index.ts
+var VERSION = "0.1.0";
+function createMcpServer(vault, profile = "defi") {
+  const server = new McpServer({
+    name: "vultisig",
+    version: VERSION
+  });
+  const tools = getTools(vault, profile);
+  for (const [name, tool] of Object.entries(tools)) {
+    server.registerTool(
+      name,
+      {
+        description: tool.description,
+        inputSchema: tool.inputSchema
+      },
+      async (args) => tool.handler(args)
+    );
+  }
+  return server;
+}
+async function startMcpServer(vault, profile = "defi") {
+  const toStderr = (...args) => {
+    process.stderr.write(args.map(String).join(" ") + "\n");
+  };
+  console.log = toStderr;
+  console.info = toStderr;
+  console.warn = toStderr;
+  const server = createMcpServer(vault, profile);
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+}
+export {
+  createMcpServer,
+  executeAuthSetup,
+  executeAuthStatus,
+  getToolNames,
+  getTools,
+  startMcpServer
+};

package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "@vultisig/mcp",
+  "version": "0.1.1",
+  "description": "MCP server for Vultisig SDK - Model Context Protocol wrapper over wallet operations",
+  "type": "module",
+  "bin": {
+    "vmcp": "./dist/bin/mcp-server.js",
+    "vultisig-mcp": "./dist/bin/mcp-server.js"
+  },
+  "main": "dist/src/index.js",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "node build.mjs",
+    "dev": "npx tsx src/index.ts",
+    "start": "node dist/bin/mcp-server.js",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit"
+  },
+  "keywords": [
+    "vultisig",
+    "mcp",
+    "model-context-protocol",
+    "wallet",
+    "blockchain"
+  ],
+  "author": {
+    "name": "Vultisig",
+    "email": "info@vultisig.com",
+    "url": "https://vultisig.com"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/vultisig/vultisig-sdk.git",
+    "directory": "clients/mcp"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "~1.29.0",
+    "@napi-rs/keyring": "^1.1.6",
+    "@vultisig/client-shared": "^0.2.0",
+    "@vultisig/sdk": "^0.16.0",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@types/node": "^25.5.0",
+    "esbuild": "^0.27.4",
+    "tsx": "^4.21.0",
+    "typescript": "^5.9.3",
+    "vitest": "^3.0.9"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  }
+}