@ironwallet/mcp-server 1.0.0-preprod.0

package/dist/keystore/store.js

@@ -0,0 +1,224 @@
+/**
+ * Keystore persistence: reads/writes the encrypted keystore file and provides
+ * seed generation/import. Mnemonics are held in memory only transiently during
+ * signing; they are never returned to callers of these functions except the
+ * local browser wallet manager.
+ */
+import { mkdirSync, readFileSync, writeFileSync, existsSync, chmodSync, } from "node:fs";
+import { join } from "node:path";
+import { getConfig } from "../config.js";
+import { encryptSecret, decryptSecret } from "./crypto.js";
+import { deriveAddresses, newMnemonic, isValidMnemonic, } from "../wallet/derive.js";
+import { logDebug, logError, logInfo } from "../log.js";
+function keystorePath() {
+    return join(getConfig().keystoreDir, "keystore.json");
+}
+function ensureDir() {
+    const dir = getConfig().keystoreDir;
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+}
+export function loadKeystore() {
+    const path = keystorePath();
+    if (!existsSync(path)) {
+        logDebug("keystore.load", { path, exists: false, walletCount: 0 });
+        return { version: 1, wallets: [] };
+    }
+    const raw = readFileSync(path, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== 1) {
+        throw new Error(`Unsupported keystore version: ${parsed.version}`);
+    }
+    logDebug("keystore.load", {
+        path,
+        exists: true,
+        walletCount: parsed.wallets.length,
+        names: parsed.wallets.map((w) => w.name),
+    });
+    return parsed;
+}
+function saveKeystore(ks) {
+    ensureDir();
+    const path = keystorePath();
+    writeFileSync(path, JSON.stringify(ks, null, 2), { mode: 0o600 });
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        // best effort on platforms without POSIX perms
+    }
+    logInfo("keystore.save", {
+        path,
+        walletCount: ks.wallets.length,
+        names: ks.wallets.map((w) => w.name),
+    });
+}
+export function walletNames() {
+    return loadKeystore().wallets.map((w) => w.name);
+}
+export function getEntry(name) {
+    return loadKeystore().wallets.find((w) => w.name === name);
+}
+/**
+ * Resolve which wallet to use. If `name` is given it must exist. If omitted and
+ * exactly one wallet exists, that one is used. Otherwise an error is thrown.
+ */
+export function resolveEntry(name) {
+    const ks = loadKeystore();
+    if (name) {
+        const found = ks.wallets.find((w) => w.name === name);
+        if (!found)
+            throw new Error(`Wallet "${name}" not found.`);
+        return found;
+    }
+    if (ks.wallets.length === 1)
+        return ks.wallets[0];
+    if (ks.wallets.length === 0) {
+        throw new Error("No wallets found. Create one with the create_wallets tool or open_wallet_manager.");
+    }
+    throw new Error(`Multiple wallets exist (${ks.wallets
+        .map((w) => w.name)
+        .join(", ")}). Specify which one with the "wallet" parameter.`);
+}
+function uniqueName(base, existing) {
+    if (!existing.has(base))
+        return base;
+    let i = 2;
+    while (existing.has(`${base}-${i}`))
+        i++;
+    return `${base}-${i}`;
+}
+/**
+ * Create N brand-new wallets. Returns names + addresses. The mnemonic is only
+ * echoed back when `revealMnemonic` is true (wallet manager), never for the
+ * MCP tool path.
+ */
+export function createWallets(count, passphrase, opts = {}) {
+    if (count < 1 || count > 50) {
+        throw new Error("count must be between 1 and 50.");
+    }
+    logInfo("keystore.create_wallets.start", {
+        count,
+        namePrefix: opts.namePrefix,
+        revealMnemonic: Boolean(opts.revealMnemonic),
+    });
+    const ks = loadKeystore();
+    const existing = new Set(ks.wallets.map((w) => w.name));
+    const prefix = opts.namePrefix ?? "wallet";
+    const created = [];
+    for (let i = 0; i < count; i++) {
+        const mnemonic = newMnemonic(12);
+        const addresses = deriveAddresses(mnemonic);
+        const name = uniqueName(count === 1 && opts.namePrefix ? prefix : `${prefix}-${existing.size + 1}`, existing);
+        existing.add(name);
+        const entry = {
+            name,
+            encSeed: encryptSecret(mnemonic, passphrase),
+            addresses,
+            backedUp: false,
+            createdAt: new Date().toISOString(),
+        };
+        ks.wallets.push(entry);
+        created.push({
+            name,
+            addresses,
+            mnemonic: opts.revealMnemonic ? mnemonic : undefined,
+        });
+    }
+    saveKeystore(ks);
+    logInfo("keystore.create_wallets.ok", {
+        created: created.map((c) => ({ name: c.name, addresses: c.addresses })),
+    });
+    return created;
+}
+/** Import an existing mnemonic under a name. */
+export function importWallet(mnemonic, passphrase, name) {
+    const trimmed = mnemonic.trim();
+    if (!isValidMnemonic(trimmed)) {
+        logError("keystore.import.fail", new Error("Invalid BIP-39 mnemonic."), {
+            requestedName: name,
+        });
+        throw new Error("Invalid BIP-39 mnemonic.");
+    }
+    const ks = loadKeystore();
+    const existing = new Set(ks.wallets.map((w) => w.name));
+    const finalName = uniqueName(name ?? "imported", existing);
+    const addresses = deriveAddresses(trimmed);
+    const entry = {
+        name: finalName,
+        encSeed: encryptSecret(trimmed, passphrase),
+        addresses,
+        backedUp: true, // user already has these words
+        createdAt: new Date().toISOString(),
+    };
+    ks.wallets.push(entry);
+    saveKeystore(ks);
+    logInfo("keystore.import.ok", { name: finalName, addresses });
+    return { name: finalName, addresses };
+}
+/** Decrypt and return a wallet's mnemonic. CLI/backup use only. */
+export function revealMnemonic(name, passphrase) {
+    const entry = getEntry(name);
+    if (!entry)
+        throw new Error(`Wallet "${name}" not found.`);
+    return decryptSecret(entry.encSeed, passphrase);
+}
+/** Decrypt a wallet's mnemonic for internal signing. Never expose the result. */
+export function unlockMnemonic(entry, passphrase) {
+    return decryptSecret(entry.encSeed, passphrase);
+}
+/**
+ * Fill in any newly supported network addresses missing from an older keystore
+ * entry (e.g. litecoin/doge added after the wallet was created). Persists when
+ * something was missing.
+ */
+export function syncAddresses(entry, mnemonic) {
+    const fresh = deriveAddresses(mnemonic);
+    let changed = false;
+    const merged = { ...entry.addresses };
+    for (const [net, addr] of Object.entries(fresh)) {
+        if (!merged[net]) {
+            merged[net] = addr;
+            changed = true;
+        }
+    }
+    if (!changed)
+        return entry;
+    const ks = loadKeystore();
+    const stored = ks.wallets.find((w) => w.name === entry.name);
+    if (!stored)
+        return { ...entry, addresses: merged };
+    stored.addresses = merged;
+    saveKeystore(ks);
+    logInfo("keystore.sync_addresses", {
+        name: entry.name,
+        added: Object.keys(fresh).filter((n) => !entry.addresses[n]),
+    });
+    return { ...entry, addresses: merged };
+}
+export function markBackedUp(name) {
+    const ks = loadKeystore();
+    const entry = ks.wallets.find((w) => w.name === name);
+    if (!entry)
+        throw new Error(`Wallet "${name}" not found.`);
+    entry.backedUp = true;
+    saveKeystore(ks);
+}
+export function removeWallet(name) {
+    const ks = loadKeystore();
+    const before = ks.wallets.length;
+    ks.wallets = ks.wallets.filter((w) => w.name !== name);
+    if (ks.wallets.length === before)
+        throw new Error(`Wallet "${name}" not found.`);
+    saveKeystore(ks);
+    logInfo("keystore.remove.ok", { name, remaining: ks.wallets.length });
+}
+export function setPolicy(name, policy) {
+    const ks = loadKeystore();
+    const entry = ks.wallets.find((w) => w.name === name);
+    if (!entry)
+        throw new Error(`Wallet "${name}" not found.`);
+    entry.policy = policy;
+    saveKeystore(ks);
+}
+//# sourceMappingURL=store.js.map

package/dist/keystore/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/keystore/store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,SAAS,EACT,YAAY,EACZ,aAAa,EACb,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EACL,eAAe,EACf,WAAW,EACX,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAExD,SAAS,YAAY;IACnB,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC,WAAW,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;QACnE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACrC,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;IAC/C,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,QAAQ,CAAC,eAAe,EAAE;QACxB,IAAI;QACJ,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;QAClC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KACzC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,EAAgB;IACpC,SAAS,EAAE,CAAC;IACZ,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IACD,OAAO,CAAC,eAAe,EAAE;QACvB,IAAI;QACJ,WAAW,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM;QAC9B,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KACrC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,YAAY,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,YAAY,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CACb,2BAA2B,EAAE,CAAC,OAAO;SAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,IAAI,CAAC,IAAI,CAAC,mDAAmD,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,QAAqB;IACrD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAAE,CAAC,EAAE,CAAC;IACzC,OAAO,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;AACxB,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,UAAkB,EAClB,OAA0D,EAAE;IAE5D,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,CAAC,+BAA+B,EAAE;QACvC,KAAK;QACL,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;KAC7C,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC;IAC3C,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,UAAU,CACrB,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,EAC1E,QAAQ,CACT,CAAC;QACF,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,KAAK,GAAgB;YACzB,IAAI;YACJ,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC;YAC5C,SAAS;YACT,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI;YACJ,SAAS;YACT,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SACrD,CAAC,CAAC;IACL,CAAC;IACD,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,4BAA4B,EAAE;QACpC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;KACxE,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,YAAY,CAC1B,QAAgB,EAChB,UAAkB,EAClB,IAAa;IAEb,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,sBAAsB,EAAE,IAAI,KAAK,CAAC,0BAA0B,CAAC,EAAE;YACtE,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAgB;QACzB,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC;QAC3C,SAAS;QACT,QAAQ,EAAE,IAAI,EAAE,+BAA+B;QAC/C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvB,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AACxC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,UAAkB;IAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IAC3D,OAAO,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,KAAkB,EAAE,UAAkB;IACnE,OAAO,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAkB,EAAE,QAAgB;IAChE,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YACnB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpD,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,yBAAyB,EAAE;QACjC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;KAC7D,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IAC3D,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACjC,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACvD,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IACjF,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,MAAoB;IAC1D,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IAC3D,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,CAAC,CAAC;AACnB,CAAC"}

package/dist/keystore/types.d.ts

@@ -0,0 +1,31 @@
+import type { NetworkId } from "../config.js";
+/** Per-wallet spending policy. Enforced only when `enabled` is true. */
+export interface WalletPolicy {
+    enabled: boolean;
+    /** If true, send_transfer and execute_swap are rejected. */
+    readOnly?: boolean;
+    /** Max amount per send_transfer or execute_swap (decimal string, asset units). */
+    maxPerTx?: string;
+    /**
+     * Allowed transfer destinations. Empty/undefined = no whitelist.
+     * When set, execute_swap is rejected (swap routers are not on this list).
+     */
+    allowedRecipients?: string[];
+}
+/** An encrypted seed record. The mnemonic is never stored in clear text. */
+export interface WalletEntry {
+    name: string;
+    /** Encrypted mnemonic blob (see keystore/crypto.ts EncryptedBlob JSON). */
+    encSeed: string;
+    /** Public addresses per network. Safe to read without the passphrase. */
+    addresses: Record<string, string>;
+    /** Whether the user confirmed they backed up the mnemonic. */
+    backedUp: boolean;
+    createdAt: string;
+    policy?: WalletPolicy;
+}
+export interface KeystoreFile {
+    version: 1;
+    wallets: WalletEntry[];
+}
+export type { NetworkId };

package/dist/keystore/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/keystore/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/keystore/types.ts"],"names":[],"mappings":""}

package/dist/local-secrets.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Machine-local secrets and install identity. Generated on first use and stored
+ * under the keystore directory (0600). Not written to User env, mcp.json, or
+ * the plugin dashboard.
+ *
+ * Env vars still win when set to a real value. Unexpanded `${VAR}` placeholders
+ * (Claude Code when the shell var is missing) are treated as unset.
+ */
+export declare function resolveKeystoreDir(): string;
+export declare function isUnsetSecret(value: string | undefined): boolean;
+/** x-api-key for Relay / Swap Proxy. UUID, stable per machine directory. */
+export declare function resolveRelayApiKey(): string;
+/** Keystore wrapping secret. Not the recovery phrase. */
+export declare function resolveKeystorePassphrase(): string;
+/** X-Device-Id. UUID, stable per keystore directory. */
+export declare function resolveDeviceId(): string;

package/dist/local-secrets.js

@@ -0,0 +1,73 @@
+/**
+ * Machine-local secrets and install identity. Generated on first use and stored
+ * under the keystore directory (0600). Not written to User env, mcp.json, or
+ * the plugin dashboard.
+ *
+ * Env vars still win when set to a real value. Unexpanded `${VAR}` placeholders
+ * (Claude Code when the shell var is missing) are treated as unset.
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+import { randomBytes, randomUUID } from "node:crypto";
+const RELAY_KEY_FILE = "relay-api-key";
+const PASSPHRASE_FILE = "keystore-passphrase";
+const DEVICE_ID_FILE = "device-id";
+export function resolveKeystoreDir() {
+    if (process.env.IW_KEYSTORE_DIR)
+        return process.env.IW_KEYSTORE_DIR;
+    const home = process.env.HOME ??
+        process.env.USERPROFILE ??
+        process.env.HOMEPATH ??
+        ".";
+    return `${home}/.ironwallet-mcp`;
+}
+export function isUnsetSecret(value) {
+    if (!value)
+        return true;
+    const trimmed = value.trim();
+    if (trimmed.length === 0)
+        return true;
+    return /^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/.test(trimmed);
+}
+function readOrCreate(filename, generate) {
+    const dir = resolveKeystoreDir();
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    const path = join(dir, filename);
+    if (existsSync(path)) {
+        const existing = readFileSync(path, "utf8").trim();
+        if (existing.length > 0 && !isUnsetSecret(existing))
+            return existing;
+    }
+    const value = generate();
+    writeFileSync(path, `${value}\n`, { mode: 0o600 });
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        // best effort on platforms without POSIX perms
+    }
+    return value;
+}
+/** x-api-key for Relay / Swap Proxy. UUID, stable per machine directory. */
+export function resolveRelayApiKey() {
+    const fromEnv = process.env.IW_RELAY_API_KEY;
+    if (!isUnsetSecret(fromEnv))
+        return fromEnv.trim();
+    return readOrCreate(RELAY_KEY_FILE, () => randomUUID());
+}
+/** Keystore wrapping secret. Not the recovery phrase. */
+export function resolveKeystorePassphrase() {
+    const fromEnv = process.env.IW_PASSPHRASE;
+    if (!isUnsetSecret(fromEnv))
+        return fromEnv.trim();
+    return readOrCreate(PASSPHRASE_FILE, () => randomBytes(24).toString("base64url"));
+}
+/** X-Device-Id. UUID, stable per keystore directory. */
+export function resolveDeviceId() {
+    const fromEnv = process.env.IW_DEVICE_ID;
+    if (!isUnsetSecret(fromEnv))
+        return fromEnv.trim();
+    return readOrCreate(DEVICE_ID_FILE, () => randomUUID());
+}
+//# sourceMappingURL=local-secrets.js.map

package/dist/local-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-secrets.js","sourceRoot":"","sources":["../src/local-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,cAAc,GAAG,eAAe,CAAC;AACvC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAC9C,MAAM,cAAc,GAAG,WAAW,CAAC;AAEnC,MAAM,UAAU,kBAAkB;IAChC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACpE,MAAM,IAAI,GACR,OAAO,CAAC,GAAG,CAAC,IAAI;QAChB,OAAO,CAAC,GAAG,CAAC,WAAW;QACvB,OAAO,CAAC,GAAG,CAAC,QAAQ;QACpB,GAAG,CAAC;IACN,OAAO,GAAG,IAAI,kBAAkB,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAyB;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,QAAsB;IAC5D,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,aAAa,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC7C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAQ,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,yBAAyB;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC1C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAQ,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,YAAY,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,eAAe;IAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACzC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAQ,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;AAC1D,CAAC"}

package/dist/log.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Append-only JSONL file logger for diagnosing relay/network instability.
+ *
+ * Writes ONLY to a file (never stdout — that carries MCP JSON-RPC). Optionally
+ * mirrors to stderr when IW_LOG_STDERR=1.
+ *
+ * Secrets (Authorization, x-api-key, mnemonics, private keys, full signatures)
+ * are redacted. Bodies are summarized by default; set IW_LOG_BODIES=1 to include
+ * truncated request/response bodies (still redacted for known secret fields).
+ */
+export type LogLevel = "debug" | "info" | "warn" | "error";
+/** Empty string / IW_LOG_ENABLED=0 disables file logging. */
+export declare function isLogEnabled(): boolean;
+export declare function getLogFilePath(): string | null;
+export declare function newCorrelationId(prefix?: string): string;
+/** Walk Error.cause chains (undici nests codes here). */
+export declare function errorDetails(err: unknown, depth?: number): Record<string, unknown>;
+export declare function truncate(s: string, max?: number): string;
+export declare function redactHeaders(headers?: Headers | Record<string, string> | [string, string][]): Record<string, string> | undefined;
+/** Deep-redact known secret keys; truncate long strings. */
+export declare function sanitize(value: unknown, depth?: number): unknown;
+/** Compact summary of a JSON/text body for logs (sizes + key fields). */
+export declare function summarizeBody(body: unknown): Record<string, unknown> | undefined;
+export declare function log(level: LogLevel, event: string, data?: Record<string, unknown>): void;
+export declare function logInfo(event: string, data?: Record<string, unknown>): void;
+export declare function logDebug(event: string, data?: Record<string, unknown>): void;
+export declare function logWarn(event: string, data?: Record<string, unknown>): void;
+export declare function logError(event: string, err: unknown, data?: Record<string, unknown>): void;
+/** One-shot banner so operators know where logs go. */
+export declare function logStartupBanner(extra?: Record<string, unknown>): void;