cordon-mcp 0.1.0 → 0.2.0

package/dist/cordon-mcp.js

@@ -9,13 +9,15 @@ import { join } from "node:path";
 
 // ../fixtures/src/gates.gen.ts
 var GATE_RUNS = {
-  "G1": { "id": "G1", "status": "green", "tests": 66, "passed": 66, "recordedAt": "2026-09-11" },
+  "G1": { "id": "G1", "status": "green", "tests": 68, "passed": 68, "recordedAt": "2026-09-26" },
   "G2": { "id": "G2", "status": "green", "tests": 8, "passed": 8, "recordedAt": "2026-09-11" },
   "G3": { "id": "G3", "status": "green", "tests": 5, "passed": 5, "recordedAt": "2026-09-10" },
-  "G4": { "id": "G4", "status": "green", "tests": 1, "passed": 1, "recordedAt": "2026-09-08" },
-  "G5": { "id": "G5", "status": "green", "tests": 12, "passed": 12, "recordedAt": "2026-09-08" },
-  "G6": { "id": "G6", "status": "green", "tests": 14, "passed": 14, "recordedAt": "2026-09-08" },
-  "G7": { "id": "G7", "status": "green", "tests": 10, "passed": 10, "recordedAt": "2026-09-09" }
+  "G4": { "id": "G4", "status": "green", "tests": 1, "passed": 1, "recordedAt": "2026-09-26" },
+  "G5": { "id": "G5", "status": "green", "tests": 12, "passed": 12, "recordedAt": "2026-09-26" },
+  "G6": { "id": "G6", "status": "green", "tests": 16, "passed": 16, "recordedAt": "2026-09-26" },
+  "G7": { "id": "G7", "status": "green", "tests": 10, "passed": 10, "recordedAt": "2026-09-09" },
+  "G8": { "id": "G8", "status": "green", "tests": 14, "passed": 14, "recordedAt": "2026-09-26" },
+  "G9": { "id": "G9", "status": "green", "tests": 4, "passed": 4, "recordedAt": "2026-09-26" }
 };
 
 // ../fixtures/src/search.gen.ts
@@ -33,13 +35,13 @@ var SEARCH = {
 
 // ../fixtures/src/deployment.gen.ts
 var DEPLOYMENT = {
-  chainId: 5042002,
-  registry: "0xf86de085e63b00c9fba300b19807c883deb961e9",
-  vault: "0x00ab57acd260c594a661b6101bdf7e92267af135",
-  record: "0x2a8361ac23f5ffcfde9f0d7bc7618178770332d0",
-  fromBlock: "61265318",
-  commit: "ee3955b82fb0b6f7786bbfb5b2f5ebc2b174f8cc",
-  deployedAt: "2026-09-09T17:24:22.882Z"
+  chainId: 11155111,
+  registry: "0xe799edc4aa6bcaf6915c7a5eadbdc4e709aef4b2",
+  vault: "0x22d539bdf23e08a856fc80bc991e34948921ad46",
+  record: "0x5c026b1b129a9e2171e53c5024f76052006ef1e0",
+  fromBlock: "11784955",
+  commit: "6c83270702ecca055240055c5dbe9340fbfa867f",
+  deployedAt: "2026-09-26T08:09:50.086Z"
 };
 
 // ../fixtures/src/drill.gen.ts
@@ -79,6 +81,8 @@ var ARC = {
   faucet: "https://faucet.circle.com",
   /** Gas token is USDC, native, 18 decimals. */
   nativeDecimals: 18,
+  nativeName: "USDC",
+  nativeSymbol: "USDC",
   /**
    * The ERC-20 view of the same balance. balanceOf truncates below 1e-6.
    *
@@ -111,6 +115,97 @@ var ARC = {
   multicall3: "0xcA11bde05977b3631167028862bE2a173976CA11",
   mainnetLaunched: false
 };
+var SEPOLIA = {
+  chainId: 11155111,
+  name: "Ethereum Sepolia",
+  /* Answered `eth_getBalance`, `eth_getCode` and `eth_call` on 25 Sep 2026;
+     the other two public endpoints tried that day returned 404 and a paywall. */
+  rpc: "https://ethereum-sepolia-rpc.publicnode.com",
+  explorer: "https://sepolia.etherscan.io",
+  /** ETH, for gas. Arc's faucet pours the gas token, which there is USDC. */
+  faucet: "https://cloud.google.com/application/web3/faucet/ethereum/sepolia",
+  /** USDC, from Circle, and a separate errand from the gas above. */
+  usdcFaucet: "https://faucet.circle.com",
+  /** ETH's, and it has nothing to do with USDC on this chain. */
+  nativeDecimals: 18,
+  nativeName: "Ether",
+  nativeSymbol: "ETH",
+  /**
+   * USDC, and the only view of it. A real FiatTokenV2 with EIP-3009, so x402
+   * `exact` settles here: probed on 20 Sep 2026 for `version() -> "2"`,
+   * `DOMAIN_SEPARATOR()` and an `authorizationState` that answers rather than
+   * falls through. Carried code on 25 Sep 2026.
+   */
+  erc20: "0x1c7D4B196Cb0C7B01d743Fbc6116a902379C7238",
+  erc20Decimals: 6,
+  /** Multicall3, at the address it has on every chain that has one. */
+  multicall3: "0xcA11bde05977b3631167028862bE2a173976CA11",
+  mainnetLaunched: false
+};
+var ANVIL = {
+  chainId: 31337,
+  name: "Anvil",
+  rpc: "http://127.0.0.1:8545",
+  explorer: "",
+  faucet: "",
+  nativeDecimals: 18,
+  nativeName: "Ether",
+  nativeSymbol: "ETH",
+  erc20: "0x0000000000000000000000000000000000000000",
+  erc20Decimals: 6,
+  mainnetLaunched: false
+};
+var CHAINS = {
+  [ARC.chainId]: ARC,
+  [SEPOLIA.chainId]: SEPOLIA,
+  [ANVIL.chainId]: ANVIL
+};
+var DEFAULT_CHAIN = SEPOLIA;
+function chainFacts(chainId) {
+  return CHAINS[chainId];
+}
+var ENSV2 = {
+  chainId: SEPOLIA.chainId,
+  registry: "0x657ea849311d3d5823348dded7c2aaafb3ede09e",
+  rootRegistry: "0x9703dbd26dab89504490994138cf2c575251a9ce",
+  registrar: "0xabe76f6c8dfced81aa5a2bb8034202a7136b94ca",
+  universalResolver: "0x5d25c1d6acbb71b7a28aa7899618a3412a8303e3",
+  permissionedResolverImpl: "0x14f09fd05d4585759e54844dc9b00147131cf243",
+  /**
+   * How a name gets subnames: they live in a registry of their own, a
+   * UserRegistry proxy the parent deploys through this factory and then points
+   * at with `setSubregistry`. A mandate tree is a tree of these.
+   */
+  verifiableFactory: "0x9e726eb570beb6bceb495ab8cda7df517d4e841c",
+  userRegistryImpl: "0xa80338aaa8d23831cea25e858d1774534abb0263",
+  /**
+   * What the registrar charges, and the reason this set is the right one.
+   *
+   * Sepolia carries two complete ENSv2 deployments, both live and both with
+   * names registered in them, because the contracts are an early preview and
+   * are redeployed as they change — a chain keeps every one of them. The other
+   * set is documented only in an unmerged docs build. This set is the one the
+   * published docs list, and it is self-consistent where it counts: the
+   * registrar at the address above answers `rentPriceOracle()` with exactly
+   * the oracle the docs list for it, and the root registry answers
+   * `getSubregistry("eth")` with exactly the registry above. Checked against
+   * the chain on 25 Sep 2026.
+   */
+  rentPriceOracle: "0x9b0b9c65bdaf9794ff7697e4dcfb1f50581072bb",
+  /**
+   * What the registrar charges registration fees in, and a different token
+   * from the one a mandate spends.
+   *
+   * It mints to anyone who asks, with no access control, which is what makes
+   * it safe to demo with — and exactly why it may never reach a vault. The
+   * money Cordon bounds is `SEPOLIA.erc20`, whose supply nobody here can
+   * conjure. Confusing the two turns a budget into a suggestion.
+   */
+  feeToken: "0x16f95d91dba7da3aca778ec053df0ff6c6a8aa8e",
+  feeTokenDecimals: 6,
+  /** The registrar takes either. Listed so the pair is not discovered late. */
+  feeTokenDai: "0x278053acc97888e63ec81c80fec641bf0bf19664"
+};
 var ERC8004 = {
   identity: "0x8004A818BFB912233c491871b3d84c89A494BD9e",
   reputation: "0x8004B663056A597Dffe9eCcC1965A193B7388713",
@@ -206,6 +301,19 @@ var GATEWAY = {
   mintGas6: 2975n,
   settlementVerifiedOn: "2026-09-11"
 };
+var DEMOS = {
+  5042002: {
+    owner: "0x736159a06C89Ea5b12eD88BE658741edCa64324D",
+    root: "0xd08820db0e1cd58426ba9dc8e78513b05d244b42cdaf841070b0a00d49b901ad",
+    agentId: "894124"
+  },
+  11155111: {
+    owner: "0x9F846D2054689a439DA8D0619f37F6c70Db03597",
+    root: "0x7a64b3d4db9223e41fa3e5ddd3c4512a44f47a9d48218f5a7224b1cf80dc18ff",
+    agentId: "10521"
+  }
+};
+var DEMO = DEMOS[5042002];
 var PENDING_ADDRESS = "pending \u2014 written by the deploy script";
 var PENDING_MANDATE = "pending \u2014 no mandate signed yet";
 var MANDATE = {
@@ -342,6 +450,10 @@ var STRUCTURING = {
 // ../daemon/src/config.ts
 var ConfigError = class extends Error {
 };
+function isLoopback(bind) {
+  const host = bind.trim().replace(/^\[|\]$/g, "").toLowerCase();
+  return host === "localhost" || host === "::1" || /^127\./.test(host);
+}
 var ENV = {
   required: {
     CORDON_VAULT: "TreeVault address, from deployments/<chainId>.json",
@@ -352,13 +464,15 @@ var ENV = {
   optional: {
     CORDON_RECORD: "ConductRecord, from deployments/<chainId>.json. Without it, refusals are enforced but never published",
     CORDON_IDENTITY: `ERC-8004 Identity; defaults to ${ERC8004.identity}`,
-    CORDON_RPC: `defaults to ${ARC.rpc}`,
-    CORDON_CHAIN_ID: `defaults to ${ARC.chainId}`,
-    CORDON_USDC: "the 6-decimal ERC-20 view; defaults to Arc's",
+    CORDON_RPC: `defaults to ${DEFAULT_CHAIN.rpc}`,
+    CORDON_CHAIN_ID: `defaults to ${DEFAULT_CHAIN.chainId} (${DEFAULT_CHAIN.name})`,
+    CORDON_USDC: `the 6-decimal ERC-20 view; defaults to ${DEFAULT_CHAIN.name}'s`,
     CORDON_NETWORKS: "CAIP-2 ids this daemon will settle on",
     CORDON_ASSETS: "assets it will pay in",
     CORDON_PORT: "defaults to 8402",
-    CORDON_POLL_MS: "receipt polling interval; defaults to 250, matched to Arc's finality rather than to viem's 4,000",
+    CORDON_BIND: "the interface to listen on; defaults to 127.0.0.1. Anything else requires CORDON_TOKEN",
+    CORDON_TOKEN: "a shared secret every request must send as `Authorization: Bearer <token>`. Optional on loopback, required off it",
+    CORDON_POLL_MS: "receipt polling interval; 250 on Arc, matched to its sub-second finality, and 4,000 elsewhere \u2014 asking a public endpoint forty times per twelve-second block is how an address gets rate limited",
     CORDON_KEY_FILE: "where a spawned child's key is written, before the spawn is sent; defaults to ~/.cordon/cordon.env"
   }
 };
@@ -385,18 +499,27 @@ function load(env = process.env) {
     keys.push({ node: value, keyEnv });
   }
   if (keys.length === 0) throw new ConfigError("no CORDON_NODE_<label> is set");
+  const bind = env.CORDON_BIND ?? "127.0.0.1";
+  const token = env.CORDON_TOKEN || void 0;
+  if (!isLoopback(bind) && !token) {
+    throw new ConfigError(
+      `CORDON_BIND is ${bind}, which is reachable from off this machine, and CORDON_TOKEN is not set. This process holds the operator keys: bind to 127.0.0.1, or set a token.`
+    );
+  }
   return {
-    rpcUrl: env.CORDON_RPC ?? ARC.rpc,
-    chainId: Number(env.CORDON_CHAIN_ID ?? ARC.chainId),
+    rpcUrl: env.CORDON_RPC ?? DEFAULT_CHAIN.rpc,
+    chainId: Number(env.CORDON_CHAIN_ID ?? DEFAULT_CHAIN.chainId),
     vault: address(env, "CORDON_VAULT"),
     registry: address(env, "CORDON_REGISTRY"),
-    usdc: env.CORDON_USDC ?? ARC.erc20,
+    usdc: env.CORDON_USDC ?? DEFAULT_CHAIN.erc20,
     record: env.CORDON_RECORD ? address(env, "CORDON_RECORD") : void 0,
     identity: env.CORDON_IDENTITY ?? ERC8004.identity,
-    networks: (env.CORDON_NETWORKS ?? `eip155:${ARC.chainId}`).split(",").map((s) => s.trim()),
-    assets: (env.CORDON_ASSETS ?? ARC.erc20).split(",").map((s) => s.trim()),
+    networks: (env.CORDON_NETWORKS ?? `eip155:${DEFAULT_CHAIN.chainId}`).split(",").map((s) => s.trim()),
+    assets: (env.CORDON_ASSETS ?? DEFAULT_CHAIN.erc20).split(",").map((s) => s.trim()),
     port: Number(env.CORDON_PORT ?? 8402),
-    pollMs: Number(env.CORDON_POLL_MS ?? 250),
+    bind,
+    token,
+    pollMs: Number(env.CORDON_POLL_MS ?? (Number(env.CORDON_CHAIN_ID ?? DEFAULT_CHAIN.chainId) === ARC.chainId ? 250 : 4e3)),
     keys,
     keyFile: env.CORDON_KEY_FILE ?? join(homedir(), ".cordon", "cordon.env")
   };
@@ -498,6 +621,25 @@ var TreeVaultAbi = [
     ],
     "stateMutability": "view"
   },
+  {
+    "type": "function",
+    "name": "delivered",
+    "inputs": [
+      {
+        "name": "node",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "",
+        "type": "uint128",
+        "internalType": "uint128"
+      }
+    ],
+    "stateMutability": "view"
+  },
   {
     "type": "function",
     "name": "draw",
@@ -740,6 +882,25 @@ var TreeVaultAbi = [
     "outputs": [],
     "stateMutability": "nonpayable"
   },
+  {
+    "type": "function",
+    "name": "releasedSpent",
+    "inputs": [
+      {
+        "name": "node",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "",
+        "type": "uint128",
+        "internalType": "uint128"
+      }
+    ],
+    "stateMutability": "view"
+  },
   {
     "type": "function",
     "name": "treasury6",
@@ -983,6 +1144,12 @@ var TreeVaultAbi = [
         "type": "uint128",
         "indexed": false,
         "internalType": "uint128"
+      },
+      {
+        "name": "released6",
+        "type": "uint128",
+        "indexed": false,
+        "internalType": "uint128"
       }
     ],
     "anonymous": false
@@ -1023,6 +1190,22 @@ var TreeVaultAbi = [
       }
     ]
   },
+  {
+    "type": "error",
+    "name": "BranchIsCut",
+    "inputs": [
+      {
+        "name": "id",
+        "type": "uint256",
+        "internalType": "uint256"
+      },
+      {
+        "name": "cutAt",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      }
+    ]
+  },
   {
     "type": "error",
     "name": "InsufficientTreasury",
@@ -1128,6 +1311,19 @@ var MandateRegistryAbi = [
     ],
     "stateMutability": "view"
   },
+  {
+    "type": "function",
+    "name": "MAX_TREE_DEPTH",
+    "inputs": [],
+    "outputs": [
+      {
+        "name": "",
+        "type": "uint8",
+        "internalType": "uint8"
+      }
+    ],
+    "stateMutability": "view"
+  },
   {
     "type": "function",
     "name": "exists",
@@ -2371,6 +2567,48 @@ var Recorder = class {
   }
 };
 
+// ../daemon/src/repeats.ts
+var keyOf = (b) => `${b.node.toLowerCase()}|${b.counterparty.toLowerCase()}|${b.amount}|${b.reason}`;
+var RefusalRepeats = class {
+  seen = /* @__PURE__ */ new Map();
+  now;
+  constructor(options = {}) {
+    this.now = options.now ?? Date.now;
+  }
+  /**
+   * The refusal already on chain for exactly this bound, while it still
+   * stands. A window that has rolled is a different window, and a refusal in
+   * it is a new fact about a fresh budget — so the memory expires with it.
+   */
+  recall(bound) {
+    const hit = this.seen.get(keyOf(bound));
+    if (!hit) return void 0;
+    if (hit.until <= this.now()) {
+      this.seen.delete(keyOf(bound));
+      return void 0;
+    }
+    return hit.published;
+  }
+  /** Remember what was published, for as long as it stays the current answer. */
+  remember(bound, published, holdsForMs) {
+    if (holdsForMs <= 0) return;
+    this.seen.set(keyOf(bound), { published, until: this.now() + holdsForMs });
+  }
+  /**
+   * Drop what has expired. Nothing depends on this being called — `recall`
+   * checks expiry itself — but a daemon runs for weeks and a tree that has
+   * refused many distinct bounds should not keep all of them.
+   */
+  prune() {
+    const now = this.now();
+    for (const [key, hit] of this.seen) if (hit.until <= now) this.seen.delete(key);
+  }
+  /** How many bounds are being remembered. For tests and for `/status`. */
+  get size() {
+    return this.seen.size;
+  }
+};
+
 // ../fixtures/src/serial.ts
 function serialiseByKey() {
   const tails = /* @__PURE__ */ new Map();
@@ -2413,6 +2651,10 @@ var Gate = class {
    * said it was in bounds. Keyed by node, so two nodes still draw at once.
    */
   inTurn = serialiseByKey();
+  /** Identical refusals already on chain, so the loop pays for one. */
+  repeats = new RefusalRepeats();
+  /** `windowSeconds` per node, which is immutable once the mandate exists. */
+  windowCache = /* @__PURE__ */ new Map();
   /**
    * The record. It borrows this gate's signer rather than holding a copy of a
    * key, so there is still exactly one place in the process where an operator
@@ -2421,10 +2663,20 @@ var Gate = class {
   recorder;
   constructor(config2) {
     this.config = config2;
+    const facts = chainFacts(config2.chainId);
+    if (!facts) {
+      throw new Error(
+        `chain ${config2.chainId} is not one this build knows. Chains live in packages/fixtures/src/index.ts and nowhere else.`
+      );
+    }
     const chain = defineChain({
-      id: config2.chainId,
-      name: `chain-${config2.chainId}`,
-      nativeCurrency: { name: "USDC", symbol: "USDC", decimals: 18 },
+      id: facts.chainId,
+      name: facts.name,
+      nativeCurrency: {
+        name: facts.nativeName,
+        symbol: facts.nativeSymbol,
+        decimals: facts.nativeDecimals
+      },
       rpcUrls: { default: { http: [config2.rpcUrl] } }
     });
     this.chain = chain;
@@ -2557,6 +2809,31 @@ var Gate = class {
       args: [node2]
     });
   }
+  /**
+   * How long a refusal for this node stays the current answer.
+   *
+   * The window, because that is exactly when the budget it was refused
+   * against is replaced — a refusal in a fresh window is a new fact. Read
+   * once per node and kept: `windowSeconds` is set when the mandate is opened
+   * and no function raises it.
+   *
+   * A read that fails returns 0, which suppresses nothing. A daemon that
+   * cannot reach the registry should send the transaction, not invent a
+   * silence.
+   */
+  async windowMs(node2) {
+    const key = node2.toLowerCase();
+    const cached = this.windowCache.get(key);
+    if (cached !== void 0) return cached;
+    try {
+      const m = await this.mandate(node2);
+      const ms = Number(m.windowSeconds) * 1e3;
+      this.windowCache.set(key, ms);
+      return ms;
+    } catch {
+      return 0;
+    }
+  }
   async mandate(node2) {
     return this.publicClient.readContract({
       address: this.config.registry,
@@ -2650,11 +2927,36 @@ var Gate = class {
       args: [node2, counterparty, amount],
       account: wallet.account
     });
-    const [wouldRelease] = result;
+    const [wouldRelease, , reasonCode] = result;
+    if (!wouldRelease) {
+      const bound = { node: node2, counterparty, amount, reason: REASONS[reasonCode] ?? UNRECOGNISED };
+      const already = this.repeats.recall(bound);
+      if (already) {
+        return {
+          released: false,
+          reason: already.reason,
+          breachedAt: already.breachedAt,
+          refusalId: already.refusalId,
+          txHash: already.txHash
+        };
+      }
+    }
     const txHash = await wallet.writeContract(request);
     const outcome = { ...await this.outcomeFrom(txHash), txHash };
     if (!wouldRelease) {
       await this.publish(node2, outcome);
+      if (outcome.refusalId !== void 0 && outcome.txHash !== void 0) {
+        this.repeats.remember(
+          { node: node2, counterparty, amount, reason: outcome.reason },
+          {
+            refusalId: outcome.refusalId,
+            txHash: outcome.txHash,
+            reason: outcome.reason,
+            breachedAt: outcome.breachedAt
+          },
+          await this.windowMs(node2)
+        );
+      }
     }
     return outcome;
   }
@@ -2769,6 +3071,87 @@ var Gate = class {
 // ../daemon/src/settle.ts
 import { parseAbi as parseAbi2 } from "viem";
 
+// ../daemon/src/challenge.ts
+var ChallengeError = class extends Error {
+};
+var ADDRESS = /^0x[0-9a-fA-F]{40}$/;
+var CAIP2 = /^[-a-z0-9]{3,8}:[-_a-zA-Z0-9]{1,32}$/;
+function parseChallenge(status, body) {
+  if (status !== 402) return null;
+  if (typeof body !== "object" || body === null) {
+    throw new ChallengeError("402 with no JSON body");
+  }
+  const raw = body;
+  const version = raw.x402Version;
+  if (typeof version !== "number") {
+    throw new ChallengeError("402 body has no x402Version");
+  }
+  const accepts = raw.accepts;
+  if (!Array.isArray(accepts) || accepts.length === 0) {
+    throw new ChallengeError("402 body offers no way to pay");
+  }
+  return { x402Version: version, offers: accepts.map(parseOffer) };
+}
+function parseOffer(input, index) {
+  if (typeof input !== "object" || input === null) {
+    throw new ChallengeError(`accepts[${index}] is not an object`);
+  }
+  const o = input;
+  const scheme = str(o.scheme, `accepts[${index}].scheme`);
+  const network = str(o.network, `accepts[${index}].network`);
+  if (!CAIP2.test(network)) {
+    throw new ChallengeError(`accepts[${index}].network is not a CAIP-2 id: ${network}`);
+  }
+  const payTo = str(o.payTo, `accepts[${index}].payTo`);
+  const asset = str(o.asset, `accepts[${index}].asset`);
+  const amountRaw = o.amount;
+  if (typeof amountRaw !== "string" || !/^\d+$/.test(amountRaw)) {
+    throw new ChallengeError(`accepts[${index}].amount is not a base-unit string`);
+  }
+  const amount = BigInt(amountRaw);
+  if (amount <= 0n) {
+    throw new ChallengeError(`accepts[${index}].amount is not positive`);
+  }
+  return {
+    scheme,
+    network,
+    asset,
+    payTo,
+    amount,
+    maxTimeoutSeconds: typeof o.maxTimeoutSeconds === "number" ? o.maxTimeoutSeconds : void 0,
+    extra: typeof o.extra === "object" && o.extra !== null ? o.extra : void 0
+  };
+}
+function str(v, where) {
+  if (typeof v !== "string" || v.length === 0) {
+    throw new ChallengeError(`${where} is missing`);
+  }
+  return v;
+}
+var MAX_AUTH_SECONDS = 600;
+function selectOffer(challenge, ok) {
+  const scheme = ok.scheme ?? "exact";
+  const networks = new Set(ok.networks);
+  const assets = new Set(ok.assets.map((a) => a.toLowerCase()));
+  const match = challenge.offers.find(
+    (o) => o.scheme === scheme && networks.has(o.network) && assets.has(o.asset.toLowerCase())
+  );
+  if (!match) {
+    throw new ChallengeError(
+      `no offer this daemon can settle: seller accepts ${challenge.offers.map((o) => `${o.scheme}/${o.network}`).join(", ")}`
+    );
+  }
+  if (match.network.startsWith("eip155:") && !ADDRESS.test(match.payTo)) {
+    throw new ChallengeError(`payTo is not an address: ${match.payTo}`);
+  }
+  if (match.maxTimeoutSeconds !== void 0 && match.maxTimeoutSeconds > MAX_AUTH_SECONDS) {
+    throw new ChallengeError(
+      `seller asks for an authorisation valid ${match.maxTimeoutSeconds}s; this daemon signs none longer than ${MAX_AUTH_SECONDS}s`
+    );
+  }
+  return match;
+}
+
 // ../daemon/src/gateway.ts
 import { pad, toHex, parseAbi } from "viem";
 var GATEWAY_EIP712_DOMAIN = { name: "GatewayWallet", version: "1" };
@@ -2986,56 +3369,83 @@ var CircleSettler = class {
    * one that surfaces as a seller's revert against a signature that verified.
    */
   async assertCanPay(payment, operator) {
-    const read = this.options.balanceOf ?? ((token, holder) => this.options.publicClient.readContract({
-      address: token,
-      abi: ERC20,
-      functionName: "balanceOf",
-      args: [holder]
-    }));
-    const held = await read(payment.asset, operator);
+    const held = await readBalance(this.options, payment.asset, operator);
     if (held >= payment.value) return;
     throw new SettlementError(
       `${operator} holds ${held} base units and this purchase authorises ${payment.value}. The burn returned the price less Circle's ${GATEWAY.baseFee6} fee, so an operator needs that difference in its own float \u2014 the same place its gas comes from, and outside the mandate either way. The draw has already happened, so the window is debited.`
     );
   }
   /** The x402 `exact` payload: an EIP-3009 authorisation the seller submits. */
-  async authorise(wallet, operator, payment, token) {
-    const now = Math.floor((this.options.now?.() ?? Date.now()) / 1e3);
-    const authorization = {
-      from: operator,
-      to: payment.to,
-      value: payment.value,
-      validAfter: 0n,
-      validBefore: BigInt(now + (payment.maxTimeoutSeconds ?? 300)),
-      nonce: this.options.nonce?.() ?? randomNonce()
-    };
-    const signature = await wallet.signTypedData({
-      account: wallet.account,
-      domain: token,
-      types: TRANSFER_WITH_AUTHORIZATION_TYPES,
-      primaryType: "TransferWithAuthorization",
-      message: authorization
-    });
-    return Buffer.from(
-      JSON.stringify({
-        x402Version: 2,
-        scheme: "exact",
-        network: payment.network,
-        asset: payment.asset,
-        payload: {
-          signature,
-          authorization: {
-            ...authorization,
-            value: authorization.value.toString(),
-            validAfter: authorization.validAfter.toString(),
-            validBefore: authorization.validBefore.toString()
-          }
-        }
-      }),
-      "utf8"
-    ).toString("base64");
+  authorise(wallet, operator, payment, token) {
+    return authoriseExact(wallet, operator, payment, token, this.options);
   }
 };
+var DirectSettler = class {
+  options;
+  constructor(options) {
+    this.options = options;
+  }
+  async settle(node2, payment) {
+    const wallet = this.options.walletFor(node2);
+    const operator = wallet.account.address;
+    const token = tokenDomain(payment, this.options.chainId);
+    const held = await readBalance(this.options, payment.asset, operator);
+    if (held < payment.value) {
+      throw new SettlementError(
+        `${operator} holds ${held} base units and this purchase authorises ${payment.value}. On this chain the vault deposits into the operator's own balance, so a draw that returned should have covered it \u2014 a shortfall here means the money left again. The draw has already happened, so the window is debited.`
+      );
+    }
+    return { proof: await authoriseExact(wallet, operator, payment, token, this.options) };
+  }
+};
+function readBalance(options, token, holder) {
+  if (options.balanceOf) return options.balanceOf(token, holder);
+  return options.publicClient.readContract({
+    address: token,
+    abi: ERC20,
+    functionName: "balanceOf",
+    args: [holder]
+  });
+}
+async function authoriseExact(wallet, operator, payment, token, clock) {
+  const now = Math.floor((clock.now?.() ?? Date.now()) / 1e3);
+  const authorization = {
+    from: operator,
+    to: payment.to,
+    value: payment.value,
+    validAfter: 0n,
+    /* Clamped at the signature, not only at the offer: this is the last point
+       before a bearer instrument exists, and it is the one that must hold
+       however the payment got here. */
+    validBefore: BigInt(now + Math.min(payment.maxTimeoutSeconds ?? 300, MAX_AUTH_SECONDS)),
+    nonce: clock.nonce?.() ?? randomNonce()
+  };
+  const signature = await wallet.signTypedData({
+    account: wallet.account,
+    domain: token,
+    types: TRANSFER_WITH_AUTHORIZATION_TYPES,
+    primaryType: "TransferWithAuthorization",
+    message: authorization
+  });
+  return Buffer.from(
+    JSON.stringify({
+      x402Version: 2,
+      scheme: "exact",
+      network: payment.network,
+      asset: payment.asset,
+      payload: {
+        signature,
+        authorization: {
+          ...authorization,
+          value: authorization.value.toString(),
+          validAfter: authorization.validAfter.toString(),
+          validBefore: authorization.validBefore.toString()
+        }
+      }
+    }),
+    "utf8"
+  ).toString("base64");
+}
 function tokenDomain(payment, chainId) {
   const extra = payment.extra ?? {};
   const name = typeof extra.name === "string" ? extra.name : void 0;
@@ -3158,16 +3568,31 @@ CORDON_NODE_${label}=
 }
 
 // ../daemon/src/released.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname2 } from "node:path";
 var ChainReleases = class {
   options;
   spent;
+  /**
+   * One claim at a time per node.
+   *
+   * `claimInTurn` reads the chain twice between finding an unspent release and
+   * marking it spent, and an `await` is where another request gets to run. Two
+   * concurrent `POST /fetch` for the same purchase both passed the `spent`
+   * check, both reserved the same release, and one owner signature paid twice.
+   *
+   * `gate.draw` was already serialised per node for the nonce; this was not,
+   * and `cordonFetch` calls it first. Same queue, same key.
+   */
+  inTurn = serialiseByKey();
   constructor(options) {
     this.options = options;
     this.spent = existsSync2(options.file) ? new Set(JSON.parse(readFileSync2(options.file, "utf8")).map(String)) : /* @__PURE__ */ new Set();
   }
-  async claim(node2, payTo, amount6) {
+  claim(node2, payTo, amount6) {
+    return this.inTurn(node2, () => this.claimInTurn(node2, payTo, amount6));
+  }
+  async claimInTurn(node2, payTo, amount6) {
     const count = await this.options.count();
     const scan = BigInt(this.options.scan ?? 256);
     const floor = count > scan ? count - scan : 0n;
@@ -3189,9 +3614,18 @@ var ChainReleases = class {
   unclaim(refusalId) {
     if (this.spent.delete(refusalId.toString())) this.save();
   }
+  /**
+   * Written beside and renamed over, the way `keyfile.ts` writes.
+   *
+   * A crash during `writeFileSync` leaves a truncated file, and this one is
+   * parsed in the constructor — so a half-written ledger of spent releases
+   * does not cost a purchase, it stops the daemon starting at all.
+   */
   save() {
     mkdirSync2(dirname2(this.options.file), { recursive: true });
-    writeFileSync2(this.options.file, JSON.stringify([...this.spent], null, 2) + "\n");
+    const staging = `${this.options.file}.tmp-${process.pid}`;
+    writeFileSync2(staging, JSON.stringify([...this.spent], null, 2) + "\n");
+    renameSync2(staging, this.options.file);
   }
 };
 
@@ -3203,80 +3637,9 @@ import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { generatePrivateKey } from "viem/accounts";
 
-// ../daemon/src/challenge.ts
-var ChallengeError = class extends Error {
-};
-var ADDRESS = /^0x[0-9a-fA-F]{40}$/;
-var CAIP2 = /^[-a-z0-9]{3,8}:[-_a-zA-Z0-9]{1,32}$/;
-function parseChallenge(status, body) {
-  if (status !== 402) return null;
-  if (typeof body !== "object" || body === null) {
-    throw new ChallengeError("402 with no JSON body");
-  }
-  const raw = body;
-  const version = raw.x402Version;
-  if (typeof version !== "number") {
-    throw new ChallengeError("402 body has no x402Version");
-  }
-  const accepts = raw.accepts;
-  if (!Array.isArray(accepts) || accepts.length === 0) {
-    throw new ChallengeError("402 body offers no way to pay");
-  }
-  return { x402Version: version, offers: accepts.map(parseOffer) };
-}
-function parseOffer(input, index) {
-  if (typeof input !== "object" || input === null) {
-    throw new ChallengeError(`accepts[${index}] is not an object`);
-  }
-  const o = input;
-  const scheme = str(o.scheme, `accepts[${index}].scheme`);
-  const network = str(o.network, `accepts[${index}].network`);
-  if (!CAIP2.test(network)) {
-    throw new ChallengeError(`accepts[${index}].network is not a CAIP-2 id: ${network}`);
-  }
-  const payTo = str(o.payTo, `accepts[${index}].payTo`);
-  const asset = str(o.asset, `accepts[${index}].asset`);
-  const amountRaw = o.amount;
-  if (typeof amountRaw !== "string" || !/^\d+$/.test(amountRaw)) {
-    throw new ChallengeError(`accepts[${index}].amount is not a base-unit string`);
-  }
-  const amount = BigInt(amountRaw);
-  if (amount <= 0n) {
-    throw new ChallengeError(`accepts[${index}].amount is not positive`);
-  }
-  return {
-    scheme,
-    network,
-    asset,
-    payTo,
-    amount,
-    maxTimeoutSeconds: typeof o.maxTimeoutSeconds === "number" ? o.maxTimeoutSeconds : void 0,
-    extra: typeof o.extra === "object" && o.extra !== null ? o.extra : void 0
-  };
-}
-function str(v, where) {
-  if (typeof v !== "string" || v.length === 0) {
-    throw new ChallengeError(`${where} is missing`);
-  }
-  return v;
-}
-function selectOffer(challenge, ok) {
-  const scheme = ok.scheme ?? "exact";
-  const networks = new Set(ok.networks);
-  const assets = new Set(ok.assets.map((a) => a.toLowerCase()));
-  const match = challenge.offers.find(
-    (o) => o.scheme === scheme && networks.has(o.network) && assets.has(o.asset.toLowerCase())
-  );
-  if (!match) {
-    throw new ChallengeError(
-      `no offer this daemon can settle: seller accepts ${challenge.offers.map((o) => `${o.scheme}/${o.network}`).join(", ")}`
-    );
-  }
-  if (match.network.startsWith("eip155:") && !ADDRESS.test(match.payTo)) {
-    throw new ChallengeError(`payTo is not an address: ${match.payTo}`);
-  }
-  return match;
-}
+// ../daemon/src/fetch.ts
+import http2 from "node:http";
+import https from "node:https";
 
 // ../daemon/src/egress.ts
 import { lookup } from "node:dns/promises";
@@ -3342,11 +3705,65 @@ async function assertPublicUrl(raw, options = {}) {
   }
   return url;
 }
+var publicAddressesOnly = (address2) => !isPrivateAddress(address2);
+function pinnedLookup(allow = publicAddressesOnly) {
+  return (hostname, _options, callback) => {
+    const literal = isIP(hostname);
+    if (literal) {
+      if (!allow(hostname)) {
+        return callback(
+          Object.assign(new EgressError(`${hostname} is not an address this daemon connects to`), {
+            code: "ECONNREFUSED"
+          })
+        );
+      }
+      return callback(null, hostname, literal);
+    }
+    lookup(hostname, { all: true, verbatim: true }).then(
+      (answers) => {
+        for (const answer of answers) {
+          if (!allow(answer.address)) {
+            return callback(
+              Object.assign(
+                new EgressError(
+                  `${hostname} resolves to ${answer.address}, which is on this machine or its private network. The connection was refused at the socket, so no request was sent to it.`
+                ),
+                { code: "ECONNREFUSED" }
+              )
+            );
+          }
+        }
+        const chosen = answers[0];
+        if (!chosen) {
+          return callback(
+            Object.assign(new EgressError(`${hostname} does not resolve, so there is nothing to ask`), {
+              code: "ENOTFOUND"
+            })
+          );
+        }
+        return callback(null, chosen.address, chosen.family);
+      },
+      (error) => callback(Object.assign(error, { code: "ENOTFOUND" }))
+    );
+  };
+}
 
 // ../daemon/src/fetch.ts
+var PURCHASE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "POST"]);
+var MethodRefused = class extends Error {
+};
+function assertPurchaseMethod(raw) {
+  const method = raw.toUpperCase();
+  if (!PURCHASE_METHODS.has(method)) {
+    throw new MethodRefused(
+      `${method} is not a method this daemon fetches with. A purchase is a request answered with 402 and retried with a signature, so GET, HEAD and POST are what that needs. A verb whose point is to leave state on someone else's server is an egress channel, and this tool is not one.`
+    );
+  }
+  return method;
+}
 async function cordonFetch(request, deps) {
   const { gate: gate2, settler, acceptable, transport } = deps;
-  const method = request.method ?? "GET";
+  const method = assertPurchaseMethod(request.method ?? "GET");
   const headers = { ...request.headers };
   const first = await transport(request.url, { method, headers, body: request.body });
   const challenge = parseChallenge(first.status, first.body);
@@ -3393,35 +3810,67 @@ async function cordonFetch(request, deps) {
   };
 }
 var MAX_REDIRECTS = 3;
-var httpTransport = (url, init) => httpTransportWith(assertPublicUrl)(url, init);
-var httpTransportWith = (assert) => async (url, init) => {
+var httpTransport = (url, init) => httpTransportWith(assertPublicUrl, publicAddressesOnly)(url, init);
+function requestOnce(target, init, allow) {
+  const secure = target.protocol === "https:";
+  const driver = secure ? https : http2;
+  const agent = new driver.Agent({ lookup: pinnedLookup(allow) });
+  return new Promise((resolve, reject) => {
+    const req = driver.request(
+      {
+        protocol: target.protocol,
+        hostname: target.hostname,
+        port: target.port || (secure ? 443 : 80),
+        path: `${target.pathname}${target.search}`,
+        method: init.method,
+        headers: init.headers,
+        agent,
+        /* TLS is still verified against the NAME, not the pinned address: the
+           certificate has to be for the host the daemon meant to reach. */
+        ...secure ? { servername: target.hostname } : {}
+      },
+      (res) => {
+        const chunks = [];
+        res.on("data", (chunk) => {
+          chunks.push(chunk);
+          if (chunks.reduce((n, c) => n + c.length, 0) > MAX_BODY_BYTES) {
+            req.destroy(new EgressError(`${target.origin} sent more than ${MAX_BODY_BYTES} bytes`));
+          }
+        });
+        res.on("end", () => {
+          const headers = {};
+          for (const [name, value] of Object.entries(res.headers)) {
+            if (value === void 0) continue;
+            headers[name] = Array.isArray(value) ? value.join(", ") : value;
+          }
+          resolve({ status: res.statusCode ?? 0, headers, body: Buffer.concat(chunks).toString("utf8") });
+        });
+        res.on("error", reject);
+      }
+    );
+    req.setTimeout(3e4, () => req.destroy(new EgressError(`${target.origin} did not answer in 30s`)));
+    req.on("error", reject);
+    if (init.body !== void 0) req.write(init.body);
+    req.end();
+  });
+}
+var MAX_BODY_BYTES = 8 * 1024 * 1024;
+var httpTransportWith = (assert, allow) => async (url, init) => {
   let target = await assert(url);
   const origin = target.origin;
   const carriesPayment = Object.keys(init.headers).some(
     (name) => name.toLowerCase() === "payment-signature" || name.toLowerCase() === "x-payment"
   );
   for (let hop = 0; ; hop++) {
-    const response = await fetch(target, {
-      method: init.method,
-      headers: init.headers,
-      body: init.body,
-      /* Followed below instead, so each hop is checked. */
-      redirect: "manual",
-      signal: AbortSignal.timeout(3e4)
-    });
-    const location = response.headers.get("location");
+    const response = await requestOnce(target, init, allow);
+    const location = response.headers["location"];
     if (response.status < 300 || response.status >= 400 || !location) {
-      const text2 = await response.text();
-      let body = text2;
+      let body = response.body;
       try {
-        body = JSON.parse(text2);
+        body = JSON.parse(response.body);
       } catch {
       }
-      return {
-        status: response.status,
-        headers: Object.fromEntries(response.headers.entries()),
-        body
-      };
+      return { status: response.status, headers: response.headers, body };
     }
     if (hop >= MAX_REDIRECTS) {
       throw new EgressError(`${url} redirected more than ${MAX_REDIRECTS} times`);
@@ -3480,11 +3929,58 @@ function renderPaid(outcome, offer, body) {
   ].filter(Boolean).join("\n");
 }
 
+// package.json
+var package_default = {
+  name: "cordon-mcp",
+  version: "0.2.0",
+  description: "Cordon inside an MCP client: an agent that can buy things and cannot spend past the mandate its owner signed, bounded by contracts it cannot reach.",
+  license: "MIT",
+  author: "Youvandra Febrial",
+  homepage: "https://getcordon.xyz",
+  bugs: {
+    url: "https://github.com/youvandra/cordon/issues"
+  },
+  repository: {
+    type: "git",
+    url: "git+https://github.com/youvandra/cordon.git",
+    directory: "packages/mcp"
+  },
+  keywords: ["mcp", "mcp-server", "x402", "agents", "ai-agents", "agent-payments", "spending-limits", "arc", "sepolia", "circle", "usdc", "erc-8004", "ens", "ensv2"],
+  type: "module",
+  bin: {
+    "cordon-mcp": "dist/cordon-mcp.js"
+  },
+  files: ["dist", "SKILL.md", "README.md", "LICENSE"],
+  engines: {
+    node: ">=22"
+  },
+  publishConfig: {
+    access: "public"
+  },
+  scripts: {
+    build: "tsc --noEmit",
+    bundle: "esbuild src/main.ts --bundle --platform=node --format=esm --target=node22 --outfile=dist/cordon-mcp.js --external:viem --external:@modelcontextprotocol/sdk --external:zod",
+    prepack: "npm run bundle",
+    test: 'node --test "test/*.test.ts"',
+    start: "node src/main.ts"
+  },
+  dependencies: {
+    "@modelcontextprotocol/sdk": "^1.12.0",
+    viem: "^2.21.55",
+    zod: "^4.5.4"
+  },
+  devDependencies: {
+    "@types/node": "^22.10.2",
+    esbuild: "^0.25.12",
+    typescript: "^5.7.2"
+  }
+};
+
 // src/server.ts
 var text = (s) => ({ content: [{ type: "text", text: s }] });
 function createMcpServer(deps) {
   const server2 = new McpServer(
-    { name: "cordon", version: "0.1.0" },
+    { name: "cordon", version: package_default.version },
     {
       instructions: "Cordon bounds what this agent can spend. Use cordon_fetch for any URL that may charge; it pays through a contract that can refuse. There is no tool here that sends money to an address, and a refusal is a final answer rather than an error to retry."
     }
@@ -3627,6 +4123,19 @@ if (!node) {
   );
   process.exit(1);
 }
+function settlerFor(chainId) {
+  const options = {
+    publicClient: gate.publicClientForSettlement,
+    walletFor: (node2) => gate.signerFor(node2),
+    chainId
+  };
+  return chainId === ARC.chainId ? new CircleSettler(options) : new DirectSettler(options);
+}
+function explorerFor(chainId) {
+  if (chainId === ARC.chainId) return ARC.explorer;
+  if (chainId === SEPOLIA.chainId) return SEPOLIA.explorer;
+  return void 0;
+}
 var server = createMcpServer({
   gate,
   keyFile: keyFileAt(config.keyFile),
@@ -3638,14 +4147,10 @@ var server = createMcpServer({
     live: (node2) => gate.isLive(node2),
     file: join2(dirname3(config.keyFile), "released-spent.json")
   }),
-  settler: new CircleSettler({
-    publicClient: gate.publicClientForSettlement,
-    walletFor: (node2) => gate.signerFor(node2),
-    chainId: config.chainId
-  }),
+  settler: settlerFor(config.chainId),
   acceptable: { networks: config.networks, assets: config.assets },
   node,
-  explorer: config.chainId === ARC.chainId ? ARC.explorer : void 0
+  explorer: explorerFor(config.chainId)
 });
 console.error(`cordon mcp: node ${node} on chain ${config.chainId}`);
 await server.connect(new StdioServerTransport());